Commit Graph

14 Commits

Author SHA1 Message Date
markchien
c5aa4845d0 Allow tethering find netork stack service
Allow tethering service which is running in the same process as network
stack service "find" network stack service. Original design is passing
network_stack binder to tethering service directly when tethering
service is created. To allow creating tethering service and network
stack service in parallel. Let tethering service query network_stack
binder instead.

Bug: 144320246
Test: boot, flash, build
      OFF/ON hotspot

Change-Id: Ife0c2f4bdb2cfee4b5788d63d1cfc76af0ccc33c
2019-12-12 12:54:57 +08:00
Treehugger Robot
d16a3968f3 Merge changes Ifa33dae9,I69ccc6af,Ibb4db9d9
* changes:
  Revert "sepolicy: Permission changes for new wifi mainline module"
  Revert "wifi_stack: Move to network_stack process"
  Revert "sepolicy(wifi): Allow audio service access from wifi"
2019-11-27 00:41:35 +00:00
Roshan Pius
a483b5df72 Revert "wifi_stack: Move to network_stack process"
This reverts commit 1086c7d71d.

Reason for revert: Wifi services no longer plan to be a separate
APK/process for mainline. Will instead become a jar loaded from Apex.

Bug: 144722612
Test: Device boots up & connects to wifi networks
Change-Id: I69ccc6afbe15db88f516cdc64e13d8cfdb0c743c
2019-11-22 09:48:54 -08:00
Roshan Pius
845b10c3db Revert "sepolicy(wifi): Allow audio service access from wifi"
This reverts commit 386cf9d957.

Reason for revert: Wifi services no longer plan to be a separate
APK/process for mainline. Will instead become a jar loaded from Apex.

Bug: 144722612
Test: Device boots up & connects to wifi networks
Change-Id: Ibb4db9d92c8d9f1170fcc047fa3377eef2acfce6
2019-11-22 09:48:01 -08:00
markchien
e9bb9a4c98 [Tether12] Give network stack permission for tetheroffload
Tethering module would run in network stack process. Add network_stack
as client of tetheroffload hidl and give it permission to create and share
netlink_netfilter_sockets

Bug: 144320246
Test: -build, flas, boot
      -OFF/ON hotspot

Change-Id: Id961fd4af0d30f902eb0115aa15db612aaa8bb91
2019-11-21 12:58:31 +08:00
Chiachang Wang
e063585bbf Add permission for NetworkStack updatability
NetworkStack will need to use netlink_tcpdiag_socket to get tcp
info. In order to support updatability for NetworkStack as it's
a mainline module, get the information from kernel directly to
reduce the dependecy with framework.

Test: Build and test if NetworkStack can get the tcp_info without
SEPolicy exception
Bug: 136162280

Change-Id: I8f584f27d5ece5e97090fb5fafe8c70c5cbbe123
2019-10-12 21:21:10 +09:00
Roshan Pius
386cf9d957 sepolicy(wifi): Allow audio service access from wifi
Denial log:
10-03 13:37:05.726   603   603 I auditd  : avc:  denied  { find }
for pid=5443 uid=1073 name=media.audio_policy scontext=u:r:network_stack:s0
`1tcontext=u:object_r:audioserver_service:s0 tclass=service_manager permissive=0

Bug: 142053371
Bug: 135691051
Test: Device boots up and connects to network. No selinux denial seen
from network_stack

Change-Id: I0907504d02c987398467148c26a0847b5f8a7a8c
2019-10-03 08:19:17 -07:00
Roshan Pius
1086c7d71d wifi_stack: Move to network_stack process
The wifi stack APK will run inside the network_stack process. So, move
the sepolicy rules for wifi stack inside the network stack rules.

Bug: 135691051
Test: Manual tests
- manual connect to wifi networks
- Remove networks
Test: Will send for ACTS wifi regression testing
Change-Id: I9d5da80852f22fa1d12b2dbbc76b9e06c1275310
(cherry-picked from b83abf7af3df64e0d3c1b22548f2344b55aece28)
2019-10-02 11:49:43 -07:00
Xiao Ma
c06f0f602a Allow the netowrk stack to access its own data files.
After moving IpMemoryStore service to network stack module(aosp/906907),
the following untracked SELinux denials are observed on boot.

W id.networkstack: type=1400 audit(0.0:63): avc: denied { write } for
name="com.android.networkstack" dev="sda13" ino=704810
scontext=u:r:network_stack:s0:c49,c260,c512,c768
tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=0

Add radio_data_file type for network stack user configuration and
relevant permission to allow access to its data, as the network stack
is a privileged app.

Test: m -j passed
Change-Id: I6eab528714df6a17aae0cb546dcc3ad4bb21deea
2019-03-19 11:42:11 +09:00
Luke Huang
524f25ebb0 Add sepolicy for resolver service
Bug: 126141549
Test: built, flashed, booted
Change-Id: I34260e1e5cc238fbe92574f928252680c1e6b417
2019-03-05 15:49:33 +00:00
Remi NGUYEN VAN
780fbadf08 Add NetworkStack policies for netd and netlink
Allow netd to send network events to the NetworkStack, and allow the
NetworkStack to interact with netlink_route_socket for neighbor
monitoring.

Test: built, booted, WiFi works, no more violations
Bug: 112869080
Change-Id: If212b2897e37e9d249f81ba8139461bce461528e
2019-01-28 14:40:52 +09:00
Remi NGUYEN VAN
fd758cbddb Allow NetworkStack to find the telephony service
The network stack needs access to TelephonyManager#getAllCellInfo to
send network conditions broadcasts.

Bug: 122843997
Test: Flashed, verified violation not shown and cell info obtained
properly.

Change-Id: I6ef2858c9a2d1fbbb993164a93bd985e0eee8887
2019-01-15 16:57:32 +09:00
Remi NGUYEN VAN
d0f65ce2ff Allow network_stack to use common app api services
Bug: b/122620633
Test: m
Change-Id: I36fe66fc22a1664f9ef25c66f933a2613a6f346b
2019-01-11 07:48:21 +09:00
Remi NGUYEN VAN
5f3ba92c61 sepolicy changes for network stack app
The networking stack app hosts services that used to be in the system
server (IpClient, NetworkMonitor for now), but in a different process to
be packaged as a mainline module.

Test: booted, verified networking stack working when in app
Change-Id: I300a556f51b35c17378af961cea1ec937444e597
2018-12-20 12:05:31 +09:00