149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# network manager 249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaletype netd, domain, mlstrustedsubject; 349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaletype netd_exec, exec_type, file_type; 449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwalenet_domain(netd) 649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# in addition to ioctls whitelisted for all domains, grant netd priv_sock_ioctls. 749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallowxperm netd self:udp_socket ioctl priv_sock_ioctls; 849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaler_dir_file(netd, cgroup) 1049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 1149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd system_server:fd use; 1249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 1349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd self:global_capability_class_set { net_admin net_raw kill }; 1449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Note: fsetid is deliberately not included above. fsetid checks are 1549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# triggered by chmod on a directory or file owned by a group other 1649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# than one of the groups assigned to the current process to see if 1749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# the setgid bit should be cleared, regardless of whether the setgid 1849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# bit was even set. We do not appear to truly need this capability 1949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# for netd to operate. 2049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaledontaudit netd self:global_capability_class_set fsetid; 2149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 2249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; 2349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd self:netlink_route_socket nlmsg_write; 2449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd self:netlink_nflog_socket create_socket_perms_no_ioctl; 2549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd self:netlink_socket create_socket_perms_no_ioctl; 2649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read nlmsg_write }; 2749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd self:netlink_generic_socket create_socket_perms_no_ioctl; 2849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd self:netlink_netfilter_socket create_socket_perms_no_ioctl; 2949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd shell_exec:file rx_file_perms; 3049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd system_file:file x_file_perms; 3149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwalenot_full_treble(`allow netd vendor_file:file x_file_perms;') 3249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd devpts:chr_file rw_file_perms; 3349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 3449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Acquire advisory lock on /system/etc/xtables.lock 3549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd system_file:file lock; 3649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 3749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Allow netd to write to qtaguid ctrl file. This is the same privilege level that normal apps have 3849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# TODO: Add proper rules to prevent other process to access qtaguid_proc file after migration 3949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# complete 4049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd qtaguid_proc:file rw_file_perms; 4149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Allow netd to read /dev/qtaguid. This is the same privilege level that normal apps have. 4249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd qtaguid_device:chr_file r_file_perms; 4349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 4449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaler_dir_file(netd, proc_net) 4549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# For /proc/sys/net/ipv[46]/route/flush. 4649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd proc_net:file rw_file_perms; 4749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 4849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Enables PppController and interface enumeration (among others) 4949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd sysfs:dir r_dir_perms; 5049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaler_dir_file(netd, sysfs_net) 5149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 5249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Allows setting interface MTU 5349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd sysfs_net:file w_file_perms; 5449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 5549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# TODO: added to match above sysfs rule. Remove me? 5649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd sysfs_usb:file write; 5749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 5849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd fs_bpf:dir create_dir_perms; 5949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd fs_bpf:file create_file_perms; 6049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 6149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# TODO: netd previously thought it needed these permissions to do WiFi related 6249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# work. However, after all the WiFi stuff is gone, we still need them. 6349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Why? 6449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd self:global_capability_class_set { dac_override chown }; 6549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 6649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Needed to update /data/misc/net/rt_tables 6749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd net_data_file:file create_file_perms; 6849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd net_data_file:dir rw_dir_perms; 6949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd self:global_capability_class_set fowner; 7049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 7149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Needed to lock the iptables lock. 7249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd system_file:file lock; 7349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 7449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Allow netd to spawn dnsmasq in it's own domain 7549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd dnsmasq:process signal; 7649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 7749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Allow netd to start clatd in its own domain 7849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd clatd:process signal; 7949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 8049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleset_prop(netd, ctl_mdnsd_prop) 8149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleset_prop(netd, netd_stable_secret_prop) 8249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 8349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Allow netd to publish a binder service and make binder calls. 8449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwalebinder_use(netd) 8549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleadd_service(netd, netd_service) 8649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd dumpstate:fifo_file { getattr write }; 8749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 8849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Allow netd to call into the system server so it can check permissions. 8949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd system_server:binder call; 9049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd permission_service:service_manager find; 9149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 9249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Allow netd to talk to the framework service which collects netd events. 9349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd netd_listener_service:service_manager find; 9449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 9549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Allow netd to operate on sockets that are passed to it. 9649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd netdomain:{ 9749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale tcp_socket 9849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale udp_socket 9949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale rawip_socket 10049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale tun_socket 10149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale} { read write getattr setattr getopt setopt }; 10249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd netdomain:fd use; 10349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 10449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# give netd permission to read and write netlink xfrm 10549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_write nlmsg_read }; 10649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 10749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# give netd permission to use eBPF functionalities 10849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow netd self:bpf { map_create map_read map_write }; 10949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 11049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Allow netd to register as hal server. 11149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleadd_hwservice(netd, system_net_netd_hwservice) 11249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwalehwbinder_use(netd) 11349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleget_prop(netd, hwservicemanager_prop) 11449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 11549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale### 11649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale### Neverallow rules 11749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale### 11849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale### netd should NEVER do any of this 11949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 12049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Block device access. 12149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleneverallow netd dev_type:blk_file { read write }; 12249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 12349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# ptrace any other app 12449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleneverallow netd { domain }:process ptrace; 12549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 12649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Write to /system. 12749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleneverallow netd system_file:dir_file_class_set write; 12849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 12949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Write to files in /data/data or system files on /data 13049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleneverallow netd { app_data_file system_data_file }:dir_file_class_set write; 13149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 13249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# only system_server and dumpstate may find netd service 13349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleneverallow { domain -system_server -dumpstate -netd } netd_service:service_manager find; 13449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 13549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# only netd can create the bpf maps 13649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleneverallow { domain -netd } netd:bpf { map_create }; 13749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 13849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# apps may not interact with netd over binder. 13949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleneverallow appdomain netd:binder call; 14049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleneverallow netd { appdomain userdebug_or_eng(`-su') }:binder call; 14149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 14249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# persist.netd.stable_secret contains RFC 7217 secret key which should never be 14349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# leaked to other processes. Make sure it never leaks. 144763dcc317556b9c9d3137641d2ed86232bb189f9Ian Pedowitzneverallow { domain -netd -init -dumpstate } netd_stable_secret_prop:file r_file_perms; 14549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 14649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# We want to ensure that no other process ever tries tampering with persist.netd.stable_secret, 14749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# the RFC 7217 secret key managed by netd. Doing so could compromise user privacy. 14849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleneverallow { domain -netd -init } netd_stable_secret_prop:property_service set; 149