6cd57a43d2
This addresses the following denials that occur when switching
clatd from an IPv6 tun interface to packet and raw sockets:
avc: denied { net_raw } for pid=3540 comm="clatd" capability=13 scontext=u:r:clatd:s0 tcontext=u:r:clatd:s0 tclass=capability
avc: denied { create } for pid=3540 comm="clatd" scontext=u:r:clatd:s0 tcontext=u:r:clatd:s0 tclass=packet_socket
avc: denied { bind } for pid=3540 comm="clatd" scontext=u:r:clatd:s0 tcontext=u:r:clatd:s0 tclass=packet_socket
avc: denied { setopt } for pid=3540 comm="clatd" scontext=u:r:clatd:s0 tcontext=u:r:clatd:s0 tclass=packet_socket
avc: denied { read } for pid=3540 comm="clatd" path="socket:[19117]" dev="sockfs" ino=19117 scontext=u:r:clatd:s0 tcontext=u:r:clatd:s0 tclass=packet_socket
Bug: 15340961
Change-Id: I3c06e8e3e0cfc0869a7b73c803bbffe28369ee5e
27 lines
993 B
Plaintext
27 lines
993 B
Plaintext
# 464xlat daemon
|
|
type clatd, domain;
|
|
type clatd_exec, exec_type, file_type;
|
|
|
|
net_domain(clatd)
|
|
|
|
# Access objects inherited from netd.
|
|
allow clatd netd:fd use;
|
|
allow clatd netd:fifo_file { read write };
|
|
# TODO: Check whether some or all of these sockets should be close-on-exec.
|
|
allow clatd netd:netlink_kobject_uevent_socket { read write };
|
|
allow clatd netd:netlink_nflog_socket { read write };
|
|
allow clatd netd:netlink_route_socket { read write };
|
|
allow clatd netd:udp_socket { read write };
|
|
allow clatd netd:unix_stream_socket { read write };
|
|
allow clatd netd:unix_dgram_socket { read write };
|
|
|
|
allow clatd self:capability { net_admin net_raw setuid setgid };
|
|
|
|
# TODO: Run clatd in vpn group to avoid need for this on /dev/tun.
|
|
allow clatd self:capability dac_override;
|
|
|
|
allow clatd self:netlink_route_socket nlmsg_write;
|
|
allow clatd self:{ packet_socket rawip_socket tun_socket } create_socket_perms;
|
|
allow clatd tun_device:chr_file rw_file_perms;
|
|
allow clatd proc_net:file rw_file_perms;;
|