android_system_sepolicy/private/netd.te

typeattribute netd coredomain;

init_daemon_domain(netd)

# Allow netd to spawn dnsmasq in it's own domain
domain_auto_trans(netd, dnsmasq_exec, dnsmasq)

# Allow netd to start clatd in its own domain
domain_auto_trans(netd, clatd_exec, clatd)

# Allow netd to start bpfloader_exec in its own domain
domain_auto_trans(netd, bpfloader_exec, bpfloader)

# give netd permission to setup iptables rule with xt_bpf
allow netd bpfloader:bpf prog_run;
Vendor domains must not use Binder On PRODUCT_FULL_TREBLE devices, non-vendor domains (except vendor apps) are not permitted to use Binder. This commit thus: * groups non-vendor domains using the new "coredomain" attribute, * adds neverallow rules restricting Binder use to coredomain and appdomain only, and * temporarily exempts the domains which are currently violating this rule from this restriction. These domains are grouped using the new "binder_in_vendor_violators" attribute. The attribute is needed because the types corresponding to violators are not exposed to the public policy where the neverallow rules are. Test: mmm system/sepolicy Test: Device boots, no new denials Test: In Chrome, navigate to ip6.me, play a YouTube video Test: YouTube: play a video Test: Netflix: play a movie Test: Google Camera: take a photo, take an HDR+ photo, record video with sound, record slow motion video with sound. Confirm videos play back fine and with sound. Bug: 35870313 Change-Id: I0cd1a80b60bcbde358ce0f7a47b90f4435a45c95 2017-03-23 14:27:32 -07:00			`typeattribute netd coredomain;`

Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c 2016-07-22 13:13:11 -07:00			`init_daemon_domain(netd)`

			`# Allow netd to spawn dnsmasq in it's own domain`
			`domain_auto_trans(netd, dnsmasq_exec, dnsmasq)`

			`# Allow netd to start clatd in its own domain`
			`domain_auto_trans(netd, clatd_exec, clatd)`
Add sepolicy to lock down bpf access Add a new set of sepolicy for the process that only netd use to load and run ebpf programs. It is the only process that can load eBPF programs into the kernel and is only used to do that. Add some neverallow rules regarding which processes have access to bpf objects. Test: program successfully loaded and pinned at sys/fs/bpf after device boot. No selinux violation for bpfloader Bug: 30950746 Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f 2018-01-02 15:31:18 -08:00
			`# Allow netd to start bpfloader_exec in its own domain`
			`domain_auto_trans(netd, bpfloader_exec, bpfloader)`
Allow netd to setup xt_bpf iptable rules To better record the network traffic stats for each network interface. We use xt_bpf netfilter module to do the iface stats accounting instead of the cgroup bpf filter we currently use for per uid stats accounting. The xt_bpf module will take pinned eBPF program as iptables rule and run the program when packet pass through the netfilter hook. To setup the iptables rules. netd need to be able to access bpf filesystem and run the bpf program at boot time. The program used will still be created and pinned by the bpfloader process. Test: With selinux enforced, run "iptables -L -t raw" should show the xt_bpf related rule present in bw_raw_PREROUTING chain. Bug: 72111305 Change-Id: I11efe158d6bd5499df6adf15e8123a76cd67de04 2018-03-20 15:42:44 -07:00
			`# give netd permission to setup iptables rule with xt_bpf`
			`allow netd bpfloader:bpf prog_run;`