1# Networking service app 2typeattribute network_stack coredomain; 3typeattribute network_stack mlstrustedsubject; 4typeattribute network_stack bpfdomain; 5 6app_domain(network_stack); 7net_domain(network_stack); 8 9allow network_stack self:global_capability_class_set { 10 net_admin 11 net_bind_service 12 net_broadcast 13 net_raw 14}; 15 16allow network_stack self:global_capability2_class_set wake_alarm; 17 18# Allow access to net_admin ioctl, DHCP server uses SIOCSARP 19allowxperm network_stack self:udp_socket ioctl priv_sock_ioctls; 20 21# The DhcpClient uses packet_sockets 22allow network_stack self:packet_socket create_socket_perms_no_ioctl; 23 24# Monitor neighbors via netlink. 25allow network_stack self:netlink_route_socket nlmsg_write; 26 27# Use netlink uevent sockets. 28allow network_stack self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; 29 30# give network_stack the same netlink permissions as netd 31allow network_stack self:netlink_nflog_socket create_socket_perms_no_ioctl; 32allow network_stack self:netlink_socket create_socket_perms_no_ioctl; 33allow network_stack self:netlink_generic_socket create_socket_perms_no_ioctl; 34 35allow network_stack app_api_service:service_manager find; 36allow network_stack dnsresolver_service:service_manager find; 37allow network_stack mdns_service:service_manager find; 38allow network_stack netd_service:service_manager find; 39allow network_stack network_watchlist_service:service_manager find; 40allow network_stack radio_service:service_manager find; 41allow network_stack system_config_service:service_manager find; 42allow network_stack radio_data_file:dir create_dir_perms; 43allow network_stack radio_data_file:file create_file_perms; 44 45binder_call(network_stack, netd); 46 47# in order to invoke side effect of close() on such a socket calling synchronize_rcu() 48# TODO: Still needed as of kernel 6.6-rc1 - see BpfUtils.h synchronizeKernelRCU() 49allow network_stack self:key_socket create; 50# Java's Os.close() in libcore/luni/src/main/java/libcore/io/BlockGuardOs.java;l=100 51# calls if (fd.isSocket$()) if (isLingerSocket(fd)) ... 52dontaudit network_stack self:key_socket getopt; 53 54# Allow network_stack to open/read/getattr various /proc/net files 55# (includes /proc/net/{anycast6,igmp,psched} /proc/sys/net/ipv4/ip_default_ttl) 56r_dir_file(network_stack, proc_net_type) 57 58# Grant read permission of connectivity namespace system property prefix. 59get_prop(network_stack, device_config_connectivity_prop) 60 61# Create/use netlink_tcpdiag_socket to get tcp info 62allow network_stack self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read nlmsg_write }; 63############### Tethering Service app - Tethering.apk ############## 64hal_client_domain(network_stack, hal_tetheroffload) 65# Create and share netlink_netfilter_sockets for tetheroffload. 66allow network_stack self:netlink_netfilter_socket create_socket_perms_no_ioctl; 67allow network_stack network_stack_service:service_manager find; 68# allow Tethering(network_stack process) to run/update/read the eBPF maps to offload tethering traffic by eBPF. 69allow network_stack { fs_bpf_net_private fs_bpf_net_shared fs_bpf_netd_readonly fs_bpf_netd_shared fs_bpf_tethering }:dir search; 70allow network_stack { fs_bpf_net_private fs_bpf_net_shared fs_bpf_netd_readonly fs_bpf_netd_shared fs_bpf_tethering }:file { getattr read write }; 71allow network_stack bpfloader:bpf prog_run; 72allow network_stack self:bpf map_create; 73allow network_stack { bpfloader netd network_stack system_server }:bpf { map_read map_write }; 74 75# allow Tethering(network_stack process) to read flag value in tethering_u_or_later_native namespace 76get_prop(network_stack, device_config_tethering_u_or_later_native_prop) 77 78# Use XFRM (IPsec) netlink sockets 79allow network_stack self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_write nlmsg_read }; 80 81# tun device used for 3rd party vpn apps and test network manager 82allow network_stack tun_device:chr_file rw_file_perms; 83allowxperm network_stack tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF TUNSETLINK TUNSETCARRIER }; 84 85############### NEVER ALLOW RULES 86# This place is as good as any for these rules, 87# and it is probably the most appropriate because 88# network_stack itself is entirely mainline code. 89 90# T+: Only the bpfloader and the network_stack should ever touch 'fs_bpf_net_private' programs/maps. 91neverallow { domain -bpfloader -network_stack } fs_bpf_net_private:dir ~getattr; 92neverallow { domain -bpfloader -network_stack } fs_bpf_net_private:file *; 93 94# T+: Only the bpfloader, network_stack and system_server should ever touch 'fs_bpf_net_shared' programs/maps. 95neverallow { domain -bpfloader -network_stack -system_server } fs_bpf_net_shared:dir ~getattr; 96neverallow { domain -bpfloader -network_stack -system_server } fs_bpf_net_shared:file *; 97 98# T+: Only the bpfloader, netd, network_stack and system_server should ever touch 'fs_bpf_netd_readonly' programs/maps. 99# netd's access should be readonly 100neverallow { domain -bpfloader -netd -network_stack -system_server } fs_bpf_netd_readonly:dir ~getattr; 101neverallow { domain -bpfloader -netd -network_stack -system_server } fs_bpf_netd_readonly:file *; 102neverallow netd fs_bpf_netd_readonly:file write; 103 104# T+: Only the bpfloader, netd, netutils_wrapper, network_stack and system_server should ever touch 'fs_bpf_netd_shared' programs/maps. 105# netutils_wrapper requires access to be able to run iptables and only needs readonly access 106neverallow { domain -bpfloader -netd -netutils_wrapper -network_stack -system_server } fs_bpf_netd_shared:dir ~getattr; 107neverallow { domain -bpfloader -netd -netutils_wrapper -network_stack -system_server } fs_bpf_netd_shared:file *; 108neverallow netutils_wrapper fs_bpf_netd_shared:file write; 109 110# S+: Only the bpfloader and the network_stack should ever touch 'fs_bpf_tethering' programs/maps. 111neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:dir ~getattr; 112neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:file *; 113