Lines Matching refs:netd

2 type netd, domain, mlstrustedsubject;
5 net_domain(netd)
6 # in addition to ioctls allowlisted for all domains, grant netd priv_sock_ioctls.
7 allowxperm netd self:udp_socket ioctl priv_sock_ioctls;
9 r_dir_file(netd, cgroup)
11 allow netd system_server:fd use;
13 allow netd self:global_capability_class_set { net_admin net_raw kill };
19 # for netd to operate.
20 dontaudit netd self:global_capability_class_set fsetid;
22 # Allow netd to open /dev/tun, set it up and pass it to clatd
23 allow netd tun_device:chr_file rw_file_perms;
24 allowxperm netd tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF };
25 allow netd self:tun_socket create;
27 allow netd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
28 allow netd self:netlink_route_socket nlmsg_write;
29 allow netd self:netlink_nflog_socket create_socket_perms_no_ioctl;
30 allow netd self:netlink_socket create_socket_perms_no_ioctl;
31 allow netd self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read nlmsg_write };
32 allow netd self:netlink_generic_socket create_socket_perms_no_ioctl;
33 allow netd self:netlink_netfilter_socket create_socket_perms_no_ioctl;
34 allow netd shell_exec:file rx_file_perms;
35 allow netd system_file:file x_file_perms;
36 not_full_treble(`allow netd vendor_file:file x_file_perms;')
37 allow netd devpts:chr_file rw_file_perms;
40 allow netd system_file:file lock;
42 # Allow netd to write to qtaguid ctrl file.
45 allow netd proc_qtaguid_ctrl:file rw_file_perms;
46 # Allow netd to read /dev/qtaguid. This is the same privilege level that normal apps have.
47 allow netd qtaguid_device:chr_file r_file_perms;
49 r_dir_file(netd, proc_net_type)
51 allow netd proc_net_type:file rw_file_perms;
54 allow netd sysfs:dir r_dir_perms;
55 r_dir_file(netd, sysfs_net)
58 allow netd sysfs_net:file w_file_perms;
61 allow netd sysfs_usb:file write;
63 r_dir_file(netd, cgroup_bpf)
65 allow netd fs_bpf:dir search;
66 allow netd fs_bpf:file { read write setattr };
68 # TODO: netd previously thought it needed these permissions to do WiFi related
71 allow netd self:global_capability_class_set { dac_override dac_read_search chown };
74 allow netd net_data_file:file create_file_perms;
75 allow netd net_data_file:dir rw_dir_perms;
76 allow netd self:global_capability_class_set fowner;
79 allow netd system_file:file lock;
81 # Allow netd to spawn dnsmasq in it's own domain
82 allow netd dnsmasq:process signal;
84 # Allow netd to start clatd in its own domain
85 allow netd clatd:process signal;
87 set_prop(netd, ctl_mdnsd_prop)
88 set_prop(netd, netd_stable_secret_prop)
90 # Allow netd to publish a binder service and make binder calls.
91 binder_use(netd)
92 add_service(netd, netd_service)
93 add_service(netd, dnsresolver_service)
94 allow netd dumpstate:fifo_file  { getattr write };
96 # Allow netd to call into the system server so it can check permissions.
97 allow netd system_server:binder call;
98 allow netd permission_service:service_manager find;
100 # Allow netd to talk to the framework service which collects netd events.
101 allow netd netd_listener_service:service_manager find;
103 # Allow netd to operate on sockets that are passed to it.
104 allow netd netdomain:{
111 allow netd netdomain:fd use;
113 # give netd permission to read and write netlink xfrm
114 allow netd self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_write nlmsg_read };
116 # Allow netd to register as hal server.
117 add_hwservice(netd, system_net_netd_hwservice)
118 hwbinder_use(netd)
119 get_prop(netd, hwservicemanager_prop)
120 get_prop(netd, device_config_netd_native_prop)
125 ### netd should NEVER do any of this
128 neverallow netd dev_type:blk_file { read write };
131 neverallow netd { domain }:process ptrace;
134 neverallow netd system_file:dir_file_class_set write;
137 neverallow netd { app_data_file privapp_data_file system_data_file }:dir_file_class_set write;
139 # only system_server, dumpstate and network stack app may find netd service
145     -netd
155     -netd
159 # apps may not interact with netd over binder.
160 neverallow { appdomain -network_stack } netd:binder call;
161 neverallow netd { appdomain -network_stack userdebug_or_eng(`-su') }:binder call;
163 # persist.netd.stable_secret contains RFC 7217 secret key which should never be
165 neverallow { domain -netd -init -dumpstate } netd_stable_secret_prop:file r_file_perms;
167 # We want to ensure that no other process ever tries tampering with persist.netd.stable_secret,
168 # the RFC 7217 secret key managed by netd. Doing so could compromise user privacy.
169 neverallow { domain -netd -init } netd_stable_secret_prop:property_service set;
174 neverallow netd proc_net:dir no_w_dir_perms;
175 dontaudit netd proc_net:dir write;
177 neverallow netd sysfs_net:dir no_w_dir_perms;
178 dontaudit netd sysfs_net:dir write;