From c6d89024534d1d2d71bb0ef36da9944366c8886e Mon Sep 17 00:00:00 2001
From: Sandeep Patil <sspatil@google.com>
Date: Fri, 14 Apr 2017 19:06:56 -0700
Subject: [PATCH] add netutils_wrappers
Bug: 36463595
Test: Boot sailfish, make wifi call, internet over data and wifi
Change-Id: I81259b6412d7197725afe2fe4976aa0a03b8df6e
Signed-off-by: Sandeep Patil <sspatil@google.com>
---
private/file_contexts | 1 +
private/netutils_wrapper.te | 28 ++++++++++++++++++++++++++++
public/domain.te | 1 +
public/netutils_wrapper.te | 4 ++++
4 files changed, 34 insertions(+)
create mode 100644 private/netutils_wrapper.te
create mode 100644 public/netutils_wrapper.te
diff --git a/private/file_contexts b/private/file_contexts
index e61ef2984..66daf034c 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -191,6 +191,7 @@
/system/bin/dumpstate u:object_r:dumpstate_exec:s0
/system/bin/incident u:object_r:incident_exec:s0
/system/bin/incidentd u:object_r:incidentd_exec:s0
+/system/bin/netutils-wrapper-1\.0 u:object_r:netutils_wrapper_exec:s0
/system/bin/vold u:object_r:vold_exec:s0
/system/bin/netd u:object_r:netd_exec:s0
/system/bin/wificond u:object_r:wificond_exec:s0
diff --git a/private/netutils_wrapper.te b/private/netutils_wrapper.te
new file mode 100644
index 000000000..f7fe32ae4
--- /dev/null
+++ b/private/netutils_wrapper.te
@@ -0,0 +1,28 @@
+typeattribute netutils_wrapper coredomain;
+
+r_dir_file(netutils_wrapper, system_file);
+
+# For netutils (ip, iptables, tc)
+allow netutils_wrapper self:capability net_raw;
+
+allow netutils_wrapper system_file:file { execute execute_no_trans };
+allow netutils_wrapper proc_net:file { open read getattr };
+allow netutils_wrapper self:rawip_socket create_socket_perms;
+allow netutils_wrapper self:udp_socket create_socket_perms;
+allow netutils_wrapper self:capability net_admin;
+# ip utils need everything but ioctl
+allow netutils_wrapper self:netlink_route_socket ~ioctl;
+allow netutils_wrapper self:netlink_xfrm_socket ~ioctl;
+
+# For netutils (ndc) to be able to talk to netd
+allow netutils_wrapper netd_socket:sock_file { open getattr read write append };
+allow netutils_wrapper netd:unix_stream_socket { read getattr connectto };
+
+# For /data/misc/net access to ndc and ip
+r_dir_file(netutils_wrapper, net_data_file)
+
+domain_auto_trans({
+ domain
+ -coredomain
+ -appdomain
+}, netutils_wrapper_exec, netutils_wrapper)
diff --git a/public/domain.te b/public/domain.te
index 24e21e6d9..dfccfdd9c 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -691,6 +691,7 @@ full_treble_only(`
exec_type
-vendor_file_type
-crash_dump_exec
+ -netutils_wrapper_exec
}:file { entrypoint execute execute_no_trans };
')
')
diff --git a/public/netutils_wrapper.te b/public/netutils_wrapper.te
new file mode 100644
index 000000000..c844762c8
--- /dev/null
+++ b/public/netutils_wrapper.te
@@ -0,0 +1,4 @@
+type netutils_wrapper, domain;
+type netutils_wrapper_exec, exec_type, file_type;
+
+neverallow domain netutils_wrapper_exec:file execute_no_trans;
--
GitLab