From 06f2fdfb7e2d21a41dc1d59d6adb91f0d55fbddd Mon Sep 17 00:00:00 2001 From: Jayachandran C Date: Wed, 5 Jul 2017 18:45:49 -0700 Subject: [PATCH] Fix netmgrd crash recovery denials This change fixes the following denials auditd : type=1400 audit(0.0:30032): avc: denied { unlink } for comm="netmgrd" name="netmgr_connect_socket" dev="tmpfs" ino=31621 scontext=u:r:netmgrd:s0 tcontext=u:object_r:netmgrd_socket:s0 tclass=sock_file permissive=0 auditd : type=1400 audit(0.0:35887): avc: denied { search } for comm="netmgrd" name="diagchar" dev="sysfs" ino=26926 scontext=u:r:netmgrd:s0 tcontext=u:object_r:sysfs_diag:s0 tclass=dir permissive=0 Test: Force crashed netmgrd and validated data working Bug: 63360347 Change-Id: I45a49628b486cb264e07037cfa8397e381f72a00 --- sepolicy/vendor/netmgrd.te | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sepolicy/vendor/netmgrd.te b/sepolicy/vendor/netmgrd.te index 41c3c4f7..af09105a 100644 --- a/sepolicy/vendor/netmgrd.te +++ b/sepolicy/vendor/netmgrd.te @@ -11,7 +11,7 @@ set_prop(netmgrd, net_rmnet_prop) unix_socket_connect(netmgrd, netd, netd) allow netmgrd netmgrd_socket:dir w_dir_perms; -allow netmgrd netmgrd_socket:sock_file { create setattr }; +allow netmgrd netmgrd_socket:sock_file create_file_perms; allow netmgrd self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_write }; allow netmgrd self:netlink_generic_socket create_socket_perms_no_ioctl; allow netmgrd self:netlink_route_socket nlmsg_write; @@ -38,6 +38,9 @@ domain_auto_trans(netmgrd, netutils_wrapper_exec, netutils_wrapper) #Allow diag logging allow netmgrd sysfs_timestamp_switch:file { read open }; +userdebug_or_eng(` + r_dir_file(netmgrd, sysfs_diag) +') #Ignore if device loading for private IOCTL failed dontaudit netmgrd kernel:system { module_request };