Lines Matching refs:netd

2 type netd, domain, mlstrustedsubject;
5 net_domain(netd)
6 # in addition to ioctls allowlisted for all domains, grant netd priv_sock_ioctls.
7 allowxperm netd self:udp_socket ioctl priv_sock_ioctls;
9 r_dir_file(netd, cgroup)
10 allow netd system_server:fd use;
12 allow netd self:capability { net_admin net_raw kill };
18 # for netd to operate.
19 dontaudit netd self:capability fsetid;
21 allow netd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
22 allow netd self:netlink_route_socket nlmsg_write;
23 allow netd self:netlink_nflog_socket create_socket_perms_no_ioctl;
24 allow netd self:netlink_socket create_socket_perms_no_ioctl;
25 allow netd self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read nlmsg_write };
26 allow netd self:netlink_generic_socket create_socket_perms_no_ioctl;
27 allow netd self:netlink_netfilter_socket create_socket_perms_no_ioctl;
28 allow netd shell_exec:file rx_file_perms;
29 allow netd system_file:file x_file_perms;
30 not_full_treble(`allow netd vendor_file:file x_file_perms;')
31 allow netd devpts:chr_file rw_file_perms;
34 allow netd system_file:file lock;
36 r_dir_file(netd, proc_net)
38 allow netd proc_net:file rw_file_perms;
41 r_dir_file(netd, sysfs_type)
43 allow netd sysfs:file write;
46 allow netd sysfs_usb:file write;
48 # TODO: netd previously thought it needed these permissions to do WiFi related
51 allow netd self:capability { dac_override chown };
54 allow netd net_data_file:file create_file_perms;
55 allow netd net_data_file:dir rw_dir_perms;
56 allow netd self:capability fowner;
58 # Allow netd to spawn dnsmasq in it's own domain
59 allow netd dnsmasq:process signal;
61 # Allow netd to start clatd in its own domain
62 allow netd clatd:process signal;
64 set_prop(netd, ctl_mdnsd_prop)
66 # Allow netd to publish a binder service and make binder calls.
67 binder_use(netd)
68 add_service(netd, netd_service)
69 allow netd dumpstate:fifo_file  { getattr write };
71 # Allow netd to call into the system server so it can check permissions.
72 allow netd system_server:binder call;
73 allow netd permission_service:service_manager find;
75 # Allow netd to talk to the framework service which collects netd events.
76 allow netd netd_listener_service:service_manager find;
78 # Allow netd to operate on sockets that are passed to it.
79 allow netd netdomain:{
85 allow netd netdomain:fd use;
87 # give netd permission to read and write netlink xfrm
88 allow netd self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_write nlmsg_read };
93 ### netd should NEVER do any of this
96 neverallow netd dev_type:blk_file { read write };
99 neverallow netd { domain }:process ptrace;
102 neverallow netd system_file:dir_file_class_set write;
105 neverallow netd { app_data_file system_data_file }:dir_file_class_set write;
107 # only system_server, dumpstate and netd  may interact with netd over binder
108 neverallow { domain -system_server -dumpstate -netd } netd_service:service_manager find;
109 neverallow { domain -system_server -dumpstate } netd:binder call;
110 neverallow netd { domain -system_server -servicemanager userdebug_or_eng(`-su') }:binder call;