1# Networking service app 2typeattribute network_stack coredomain, mlstrustedsubject; 3 4app_domain(network_stack); 5net_domain(network_stack); 6 7allow network_stack self:global_capability_class_set { 8 net_admin 9 net_bind_service 10 net_broadcast 11 net_raw 12}; 13 14# Allow access to net_admin ioctl, DHCP server uses SIOCSARP 15allowxperm network_stack self:udp_socket ioctl priv_sock_ioctls; 16 17# The DhcpClient uses packet_sockets 18allow network_stack self:packet_socket create_socket_perms_no_ioctl; 19 20# Monitor neighbors via netlink. 21allow network_stack self:netlink_route_socket nlmsg_write; 22 23allow network_stack app_api_service:service_manager find; 24allow network_stack dnsresolver_service:service_manager find; 25allow network_stack netd_service:service_manager find; 26allow network_stack network_watchlist_service:service_manager find; 27allow network_stack radio_service:service_manager find; 28allow network_stack system_config_service:service_manager find; 29allow network_stack radio_data_file:dir create_dir_perms; 30allow network_stack radio_data_file:file create_file_perms; 31 32binder_call(network_stack, netd); 33 34# in order to invoke side effect of close() on such a socket calling synchronize_rcu() 35# TODO: Remove this permission when 4.9 kernel is deprecated. 36allow network_stack self:key_socket create; 37# Java's Os.close() in libcore/luni/src/main/java/libcore/io/BlockGuardOs.java;l=100 38# calls if (fd.isSocket$()) if (isLingerSocket(fd)) ... 39dontaudit network_stack self:key_socket getopt; 40 41# Grant read permission of connectivity namespace system property prefix. 42get_prop(network_stack, device_config_connectivity_prop) 43 44# Create/use netlink_tcpdiag_socket to get tcp info 45allow network_stack self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read nlmsg_write }; 46############### Tethering Service app - Tethering.apk ############## 47hal_client_domain(network_stack, hal_tetheroffload) 48# Create and share netlink_netfilter_sockets for tetheroffload. 49allow network_stack self:netlink_netfilter_socket create_socket_perms_no_ioctl; 50allow network_stack network_stack_service:service_manager find; 51# allow Tethering(network_stack process) to run/update/read the eBPF maps to offload tethering traffic by eBPF. 52allow network_stack { fs_bpf fs_bpf_tethering }:dir search; 53allow network_stack { fs_bpf fs_bpf_tethering }:file { read write }; 54allow network_stack bpfloader:bpf { map_read map_write prog_run }; 55 56# Only the bpfloader and the network_stack should ever touch 'fs_bpf_tethering' programs/maps. 57# Unfortunately init/vendor_init have all sorts of extra privs 58neverallow { domain -bpfloader -init -network_stack -vendor_init } fs_bpf_tethering:dir ~getattr; 59neverallow { domain -bpfloader -init -network_stack -vendor_init } fs_bpf_tethering:file *; 60 61neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:dir ~{ getattr open read search setattr }; 62neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:file ~{ map open read setattr }; 63