43 lines
1.4 KiB
Text
43 lines
1.4 KiB
Text
# General definitions
|
|
type ipacm, domain, domain_deprecated;
|
|
type ipacm-diag, domain, domain_deprecated;
|
|
type ipacm_exec, exec_type, file_type;
|
|
type ipacm-diag_exec, exec_type, file_type;
|
|
init_daemon_domain(ipacm)
|
|
init_daemon_domain(ipacm-diag)
|
|
|
|
# associate netdomain to use for accessing internet sockets
|
|
net_domain(ipacm)
|
|
|
|
userdebug_or_eng(`
|
|
# Allow using the logging file between ipacm and ipacm-diag
|
|
unix_socket_send(ipacm, ipacm, ipacm-diag)
|
|
diag_use(ipacm-diag)
|
|
')
|
|
|
|
# Allow capabilities to create netfilter_socket
|
|
allow ipacm self:netlink_netfilter_socket create_socket_perms;
|
|
|
|
# Allow capabilities to perform network operations and interactions with network interfaces
|
|
allow ipacm ipacm:capability net_admin;
|
|
|
|
# Allow operations with /dev/ipa, /dev/wwan_ioctl and /dev/ipaNatTable
|
|
allow ipacm ipa_dev:chr_file rw_file_perms;
|
|
|
|
# Allow receiving NETLINK messages
|
|
allow ipacm ipacm:{
|
|
netlink_route_socket
|
|
netlink_socket
|
|
# Allow querying the network stack via IOCTLs
|
|
udp_socket
|
|
netlink_generic_socket
|
|
} create_socket_perms;
|
|
|
|
# Allow creating and modifying the PID file
|
|
allow ipacm ipacm_data_file:dir w_dir_perms;
|
|
allow ipacm ipacm_data_file:file create_file_perms;
|
|
|
|
# Allow execution of 'ip neighbor change' command in shell
|
|
allow ipacm system_file:file rx_file_perms;
|
|
allow ipacm shell_exec:file rx_file_perms;
|
|
allow ipacm ipacm:netlink_route_socket nlmsg_write;
|