e063585bbf
NetworkStack will need to use netlink_tcpdiag_socket to get tcp info. In order to support updatability for NetworkStack as it's a mainline module, get the information from kernel directly to reduce the dependecy with framework. Test: Build and test if NetworkStack can get the tcp_info without SEPolicy exception Bug: 136162280 Change-Id: I8f584f27d5ece5e97090fb5fafe8c70c5cbbe123
73 lines
2.5 KiB
Plaintext
73 lines
2.5 KiB
Plaintext
############### Networking service app - NetworkStack.apk ##############
|
|
typeattribute network_stack coredomain;
|
|
|
|
app_domain(network_stack);
|
|
net_domain(network_stack);
|
|
|
|
allow network_stack self:global_capability_class_set {
|
|
net_admin
|
|
net_bind_service
|
|
net_broadcast
|
|
net_raw
|
|
};
|
|
|
|
# Allow access to net_admin ioctl, DHCP server uses SIOCSARP
|
|
allowxperm network_stack self:udp_socket ioctl priv_sock_ioctls;
|
|
|
|
# The DhcpClient uses packet_sockets
|
|
allow network_stack self:packet_socket create_socket_perms_no_ioctl;
|
|
|
|
# Monitor neighbors via netlink.
|
|
allow network_stack self:netlink_route_socket nlmsg_write;
|
|
|
|
allow network_stack app_api_service:service_manager find;
|
|
allow network_stack dnsresolver_service:service_manager find;
|
|
allow network_stack netd_service:service_manager find;
|
|
allow network_stack radio_service:service_manager find;
|
|
allow network_stack radio_data_file:dir create_dir_perms;
|
|
allow network_stack radio_data_file:file create_file_perms;
|
|
|
|
binder_call(network_stack, netd);
|
|
|
|
############### Wifi Service app - WifiStack.apk ##############
|
|
# Data file accesses.
|
|
# Manage /data/misc/wifi & /data/misc_ce/<user_id>/wifi.
|
|
allow network_stack wifi_data_file:dir create_dir_perms;
|
|
allow network_stack wifi_data_file:file create_file_perms;
|
|
|
|
# Property accesses
|
|
userdebug_or_eng(`
|
|
set_prop(network_stack, wifi_log_prop)
|
|
|
|
# Allow network_stack to read dmesg
|
|
# TODO(b/137085509): Remove this.
|
|
allow network_stack kernel:system syslog_read;
|
|
')
|
|
|
|
# Binder IPC.
|
|
allow network_stack audioserver_service:service_manager find;
|
|
allow network_stack network_score_service:service_manager find;
|
|
allow network_stack network_stack_service:service_manager find;
|
|
allow network_stack radio_service:service_manager find;
|
|
allow network_stack wificond_service:service_manager find;
|
|
allow network_stack wifiscanner_service:service_manager find;
|
|
binder_call(network_stack, system_server)
|
|
binder_call(network_stack, wificond)
|
|
|
|
# HwBinder IPC.
|
|
hal_client_domain(network_stack, hal_wifi)
|
|
hal_client_domain(network_stack, hal_wifi_hostapd)
|
|
hal_client_domain(network_stack, hal_wifi_supplicant)
|
|
|
|
# Allow WifiService to start, stop, and read wifi-specific trace events.
|
|
allow network_stack debugfs_tracing_instances:dir search;
|
|
allow network_stack debugfs_wifi_tracing:dir search;
|
|
allow network_stack debugfs_wifi_tracing:file rw_file_perms;
|
|
|
|
# dumpstate support
|
|
allow network_stack dumpstate:fd use;
|
|
allow network_stack dumpstate:fifo_file write;
|
|
|
|
# Create/use netlink_tcpdiag_socket to get tcp info
|
|
allow network_stack self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read nlmsg_write };
|