| typeattribute netutils_wrapper coredomain; |
| |
| r_dir_file(netutils_wrapper, system_file); |
| |
| # For netutils (ip, iptables, tc) |
| allow netutils_wrapper self:capability net_raw; |
| |
| allow netutils_wrapper system_file:file { execute execute_no_trans }; |
| allow netutils_wrapper proc_net:file { open read getattr }; |
| allow netutils_wrapper self:rawip_socket create_socket_perms; |
| allow netutils_wrapper self:udp_socket create_socket_perms; |
| allow netutils_wrapper self:capability net_admin; |
| # ip utils need everything but ioctl |
| allow netutils_wrapper self:netlink_route_socket ~ioctl; |
| allow netutils_wrapper self:netlink_xfrm_socket ~ioctl; |
| |
| # For netutils (ndc) to be able to talk to netd |
| allow netutils_wrapper netd_socket:sock_file { open getattr read write append }; |
| allow netutils_wrapper netd:unix_stream_socket { read getattr connectto }; |
| |
| # For /data/misc/net access to ndc and ip |
| r_dir_file(netutils_wrapper, net_data_file) |
| |
| domain_auto_trans({ |
| domain |
| -coredomain |
| -appdomain |
| }, netutils_wrapper_exec, netutils_wrapper) |