diff options
| author | Stephen Smalley <sds@tycho.nsa.gov> | 2013-11-14 08:46:49 -0800 |
|---|---|---|
| committer | Android Git Automerger <android-git-automerger@android.com> | 2013-11-14 08:46:49 -0800 |
| commit | 67a53232cec967ca53e6f7284fd582a5bdd3eb69 (patch) | |
| tree | 84e3d326c2f1136f1e4e2ddfdfafe43797972765 | |
| parent | ace68b1e06a2f5c433f4f7dd191e71411e86541f (diff) | |
| parent | b1cb3205cad978399fa7c9dcafed607fe5d07de6 (diff) | |
| download | sepolicy-67a53232cec967ca53e6f7284fd582a5bdd3eb69.tar.gz | |
am b1cb3205: Confine wpa_supplicant, but leave it permissive for now.
* commit 'b1cb3205cad978399fa7c9dcafed607fe5d07de6':
Confine wpa_supplicant, but leave it permissive for now.
| -rw-r--r-- | wpa_supplicant.te | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/wpa_supplicant.te b/wpa_supplicant.te index 5ef3573..12202fb 100644 --- a/wpa_supplicant.te +++ b/wpa_supplicant.te @@ -1,7 +1,21 @@ # wpa - wpa supplicant or equivalent type wpa, domain; +permissive wpa; type wpa_exec, exec_type, file_type; init_daemon_domain(wpa) -unconfined_domain(wpa) +allow wpa kernel:system module_request; +allow wpa self:capability { setuid net_admin setgid net_raw }; +allow wpa cgroup:dir create_dir_perms; +allow wpa self:netlink_route_socket *; +allow wpa self:netlink_socket *; +allow wpa self:packet_socket *; +allow wpa self:udp_socket *; +allow wpa wifi_data_file:dir create_dir_perms; +allow wpa wifi_data_file:file create_file_perms; +unix_socket_send(wpa, system_wpa, system_server) +allow wpa random_device:chr_file r_file_perms; + +# Create a socket for receiving info from wpa type_transition wpa wifi_data_file:sock_file wpa_socket; +allow wpa wpa_socket:sock_file create_file_perms; |