Fix IMS Registration failure

imsdatadaemon was failing due to selinux denials shown below

02-07 12:07:06.299 W imsdatadaemon: type=1400 audit(0.0:77): avc: denied
{ net_raw } for capability=13 scontext=u:r:ims:s0 tcontext=u:r:ims:s0
tclass=capability permissive=0
02-07 12:07:06.299 W imsdatadaemon: type=1400 audit(0.0:78): avc: denied
{ net_bind_service } for capability=10 scontext=u:r:ims:s0
tcontext=u:r:ims:s0 tclass=capability permissive=0
02-07 12:07:06.299 I auditd  : type=1400 audit(0.0:77): avc: denied {
net_raw } for comm="imsdatadaemon" capability=13 scontext=u:r:ims:s0
tcontext=u:r:ims:s0 tclass=capability permissive=0
02-07 12:07:06.299 I auditd  : type=1400 audit(0.0:78): avc: denied {
net_bind_service } for comm="imsdatadaemon" capability=10
scontext=u:r:ims:s0 tcontext=u:r:ims:s0 tclass=capability permissive=0

Test: Check IMS registration works on device with this fix
Change-Id: Ib0e5078d13f27ccec0ebea4f146d75f29153bf7c
This commit is contained in:
Naveen Kalla
2017-04-12 22:34:02 -07:00
parent 97bfbcc96c
commit 0266d437c7

View File

@@ -10,7 +10,7 @@ unix_socket_connect(ims, netmgrd, netmgrd)
allow ims sysfs_soc:dir search;
allow ims sysfs_soc:file r_file_perms;
allow ims self:capability { net_raw net_bind_service};
allow ims self:socket create_socket_perms;
allow ims self:netlink_generic_socket create_socket_perms_no_ioctl;
allow ims netmgrd_socket:dir search;