1typeattribute netutils_wrapper coredomain;
2
3r_dir_file(netutils_wrapper, system_file);
4
5# For netutils (ip, iptables, tc)
6allow netutils_wrapper self:global_capability_class_set net_raw;
7
8allow netutils_wrapper system_file:file { execute execute_no_trans };
9allow netutils_wrapper proc_net_type:file { open read getattr };
10allow netutils_wrapper self:rawip_socket create_socket_perms;
11allow netutils_wrapper self:udp_socket create_socket_perms;
12allow netutils_wrapper self:global_capability_class_set net_admin;
13# ip utils need everything but ioctl
14allow netutils_wrapper self:netlink_route_socket ~ioctl;
15allow netutils_wrapper self:netlink_xfrm_socket ~ioctl;
16
17# For netutils (ndc) to be able to talk to netd
18allow netutils_wrapper netd_service:service_manager find;
19allow netutils_wrapper dnsresolver_service:service_manager find;
20binder_use(netutils_wrapper);
21binder_call(netutils_wrapper, netd);
22
23# For vendor code that update the iptables rules at runtime. They need to reload
24# the whole chain including the xt_bpf rules. They need to access to the pinned
25# program when reloading the rule.
26allow netutils_wrapper fs_bpf:dir search;
27allow netutils_wrapper fs_bpf:file { read write };
28allow netutils_wrapper bpfloader:bpf prog_run;
29
30# For /data/misc/net access to ndc and ip
31r_dir_file(netutils_wrapper, net_data_file)
32
33domain_auto_trans({
34    domain
35    -coredomain
36    -appdomain
37}, netutils_wrapper_exec, netutils_wrapper)
38
39# suppress spurious denials
40dontaudit netutils_wrapper self:global_capability_class_set sys_resource;
41dontaudit netutils_wrapper sysfs_type:file read;
42
43# netutils wrapper may only use the following capabilities.
44neverallow netutils_wrapper self:global_capability_class_set ~{ net_admin net_raw };
45