# Wifi manager
type netmgr, domain;
type netmgr_exec, exec_type, vendor_file_type, file_type;

init_daemon_domain(netmgr)
net_domain(netmgr)

allow netmgr execns:fd use;

# Set ctrl.restart property to restart hostapd when config changes
set_prop(netmgr, ctl_default_prop);
# Modify hostapd config file
allow netmgr hostapd_data_file:file rw_file_perms;
allow netmgr hostapd_data_file:dir rw_dir_perms;
# Assign addresses to new interfaces as hostapd brings them up
allow netmgr self:capability { net_raw net_admin };
allow netmgr self:socket { create ioctl };
allow netmgr self:packet_socket { ioctl getopt };
allow netmgr self:udp_socket { ioctl };
allow netmgr proc_net:file { read getattr open };
allowxperm netmgr self:socket ioctl { SIOCETHTOOL };
allowxperm netmgr self:udp_socket ioctl { SIOCSIFADDR SIOCSIFNETMASK SIOCSIFBRDADDR };
allowxperm netmgr self:packet_socket ioctl { SIOCGIFINDEX SIOCGIFHWADDR };

# Allow netmgr to run iptables to block and unblock network traffic
# TODO(b/113124961): clean up this Treble violation.
typeattribute netmgr vendor_executes_system_violators;
allow netmgr system_file:file execute_no_trans;
allow netmgr system_file:file lock;
# Packet socket for wifi forwarding
allow netmgr self:packet_socket { bind create read setopt write };