1type netmgrd, domain; 2type netmgrd_exec, exec_type, vendor_file_type, file_type; 3 4net_domain(netmgrd) 5init_daemon_domain(netmgrd) 6 7set_prop(netmgrd, net_radio_prop) 8set_prop(netmgrd, net_rmnet_prop) 9 10# communicate with netd 11unix_socket_connect(netmgrd, netd, netd) 12 13allow netmgrd netmgrd_socket:dir w_dir_perms; 14allow netmgrd netmgrd_socket:sock_file create_file_perms; 15allow netmgrd self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_write }; 16allow netmgrd self:netlink_generic_socket create_socket_perms_no_ioctl; 17allow netmgrd self:netlink_route_socket nlmsg_write; 18allow netmgrd self:netlink_socket create_socket_perms_no_ioctl; 19allow netmgrd self:socket create_socket_perms; 20allowxperm netmgrd self:socket ioctl msm_sock_ipc_ioctls; 21allowxperm netmgrd self:udp_socket ioctl priv_sock_ioctls; 22 23allow netmgrd sysfs_net:dir r_dir_perms; 24allow netmgrd sysfs_net:file rw_file_perms; 25allow netmgrd sysfs_soc:dir search; 26allow netmgrd sysfs_soc:file r_file_perms; 27allow netmgrd sysfs_msm_subsys:dir r_dir_perms; 28allow netmgrd sysfs_msm_subsys:file r_file_perms; 29 30allow netmgrd system_file:file lock; 31 32r_dir_file(netmgrd, sysfs_msm_subsys) 33 34wakelock_use(netmgrd) 35 36#Allow netutils usage 37domain_auto_trans(netmgrd, netutils_wrapper_exec, netutils_wrapper) 38 39#Allow diag logging 40allow netmgrd sysfs_timestamp_switch:file { read open }; 41userdebug_or_eng(` 42 r_dir_file(netmgrd, sysfs_diag) 43') 44 45#Ignore if device loading for private IOCTL failed 46dontaudit netmgrd kernel:system { module_request }; 47 48allow netmgrd proc_net:file rw_file_perms; 49allow netmgrd netmgr_data_file:dir rw_dir_perms; 50allow netmgrd netmgr_data_file:file create_file_perms; 51allow netmgrd system_file:file execute_no_trans; 52 53allow netmgrd self:capability { net_admin net_raw setgid setpcap setuid }; 54 55allow netmgrd vendor_toolbox_exec:file rx_file_perms; 56 57# Allow netmgrd to use netd HAL 58allow netmgrd system_net_netd_hwservice:hwservice_manager find; 59get_prop(netmgrd, hwservicemanager_prop) 60binder_call(netmgrd, netd) 61hwbinder_use(netmgrd) 62 63dontaudit netmgrd kernel:system module_request; 64dontaudit netmgrd self:system module_request; 65