1typeattribute netutils_wrapper coredomain; 2 3r_dir_file(netutils_wrapper, system_file); 4 5# For netutils (ip, iptables, tc) 6allow netutils_wrapper self:global_capability_class_set net_raw; 7 8allow netutils_wrapper system_file:file { execute execute_no_trans }; 9allow netutils_wrapper proc_net_type:file { open read getattr }; 10allow netutils_wrapper self:rawip_socket create_socket_perms; 11allow netutils_wrapper self:udp_socket create_socket_perms; 12allow netutils_wrapper self:global_capability_class_set net_admin; 13# ip utils need everything but ioctl 14allow netutils_wrapper self:netlink_route_socket ~ioctl; 15allow netutils_wrapper self:netlink_xfrm_socket ~ioctl; 16 17# For netutils (ndc) to be able to talk to netd 18allow netutils_wrapper netd_service:service_manager find; 19allow netutils_wrapper dnsresolver_service:service_manager find; 20binder_use(netutils_wrapper); 21binder_call(netutils_wrapper, netd); 22 23# For vendor code that update the iptables rules at runtime. They need to reload 24# the whole chain including the xt_bpf rules. They need to access to the pinned 25# program when reloading the rule. 26allow netutils_wrapper fs_bpf:dir search; 27allow netutils_wrapper fs_bpf:file { read write }; 28allow netutils_wrapper bpfloader:bpf prog_run; 29 30# For /data/misc/net access to ndc and ip 31r_dir_file(netutils_wrapper, net_data_file) 32 33domain_auto_trans({ 34 domain 35 -coredomain 36 -appdomain 37}, netutils_wrapper_exec, netutils_wrapper) 38 39# suppress spurious denials 40dontaudit netutils_wrapper self:global_capability_class_set sys_resource; 41dontaudit netutils_wrapper sysfs_type:file read; 42 43# netutils wrapper may only use the following capabilities. 44neverallow netutils_wrapper self:global_capability_class_set ~{ net_admin net_raw }; 45