| # wpa supplicant macsec or equivalent |
| type wpa_supplicant_macsec, domain; |
| type wpa_supplicant_macsec_exec, exec_type, vendor_file_type, file_type; |
| init_daemon_domain(wpa_supplicant_macsec) |
| |
| net_domain(wpa_supplicant_macsec) |
| |
| # Allow wpa_supplicant to configure nl80211 |
| allow wpa_supplicant_macsec proc_net_type:file write; |
| |
| # in addition to ioctls allowlisted for all domains, grant wpa_supplicant_macsec priv_sock_ioctls. |
| allowxperm wpa_supplicant_macsec self:udp_socket ioctl priv_sock_ioctls; |
| |
| r_dir_file(wpa_supplicant_macsec, sysfs_type) |
| r_dir_file(wpa_supplicant_macsec, proc_net_type) |
| |
| allow wpa_supplicant_macsec self:global_capability_class_set { setuid net_admin setgid net_raw }; |
| allow wpa_supplicant_macsec cgroup:dir create_dir_perms; |
| allow wpa_supplicant_macsec cgroup_v2:dir create_dir_perms; |
| allow wpa_supplicant_macsec self:netlink_route_socket nlmsg_write; |
| allow wpa_supplicant_macsec self:netlink_socket create_socket_perms_no_ioctl; |
| allow wpa_supplicant_macsec self:netlink_generic_socket create_socket_perms_no_ioctl; |
| allow wpa_supplicant_macsec self:packet_socket create_socket_perms; |
| allowxperm wpa_supplicant_macsec self:packet_socket ioctl { unpriv_sock_ioctls priv_sock_ioctls unpriv_tty_ioctls }; |
| |
| binder_use(wpa_supplicant_macsec) |
| hal_client_domain(wpa_supplicant_macsec, hal_macsec) |
| |