1# network manager 2type netd, domain, mlstrustedsubject; 3type netd_exec, system_file_type, exec_type, file_type; 4 5net_domain(netd) 6# in addition to ioctls allowlisted for all domains, grant netd priv_sock_ioctls. 7allowxperm netd self:udp_socket ioctl priv_sock_ioctls; 8 9r_dir_file(netd, cgroup) 10 11allow netd system_server:fd use; 12 13allow netd self:global_capability_class_set { net_admin net_raw kill }; 14# Note: fsetid is deliberately not included above. fsetid checks are 15# triggered by chmod on a directory or file owned by a group other 16# than one of the groups assigned to the current process to see if 17# the setgid bit should be cleared, regardless of whether the setgid 18# bit was even set. We do not appear to truly need this capability 19# for netd to operate. 20dontaudit netd self:global_capability_class_set fsetid; 21 22# Allow netd to open /dev/tun, set it up and pass it to clatd 23allow netd tun_device:chr_file rw_file_perms; 24allowxperm netd tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF }; 25allow netd self:tun_socket create; 26 27allow netd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; 28allow netd self:netlink_route_socket nlmsg_write; 29allow netd self:netlink_nflog_socket create_socket_perms_no_ioctl; 30allow netd self:netlink_socket create_socket_perms_no_ioctl; 31allow netd self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read nlmsg_write }; 32allow netd self:netlink_generic_socket create_socket_perms_no_ioctl; 33allow netd self:netlink_netfilter_socket create_socket_perms_no_ioctl; 34allow netd shell_exec:file rx_file_perms; 35allow netd system_file:file x_file_perms; 36not_full_treble(`allow netd vendor_file:file x_file_perms;') 37allow netd devpts:chr_file rw_file_perms; 38 39# Acquire advisory lock on /system/etc/xtables.lock. If this file doesn't 40# exist, suppress the denial. 41allow netd system_file:file lock; 42dontaudit netd system_file:dir write; 43 44# Allow netd to write to qtaguid ctrl file. 45# TODO: Add proper rules to prevent other process to access qtaguid_proc file 46# after migration complete 47allow netd proc_qtaguid_ctrl:file rw_file_perms; 48# Allow netd to read /dev/qtaguid. This is the same privilege level that normal apps have. 49allow netd qtaguid_device:chr_file r_file_perms; 50 51r_dir_file(netd, proc_net_type) 52# For /proc/sys/net/ipv[46]/route/flush. 53allow netd proc_net_type:file rw_file_perms; 54 55# Enables PppController and interface enumeration (among others) 56allow netd sysfs:dir r_dir_perms; 57r_dir_file(netd, sysfs_net) 58 59# Allows setting interface MTU 60allow netd sysfs_net:file w_file_perms; 61 62# TODO: added to match above sysfs rule. Remove me? 63allow netd sysfs_usb:file write; 64 65r_dir_file(netd, cgroup_v2) 66 67allow netd fs_bpf:dir search; 68allow netd fs_bpf:file { read write }; 69 70# TODO: netd previously thought it needed these permissions to do WiFi related 71# work. However, after all the WiFi stuff is gone, we still need them. 72# Why? 73allow netd self:global_capability_class_set { dac_override dac_read_search chown }; 74 75# Needed to update /data/misc/net/rt_tables 76allow netd net_data_file:file create_file_perms; 77allow netd net_data_file:dir rw_dir_perms; 78allow netd self:global_capability_class_set fowner; 79 80# Needed to lock the iptables lock. 81allow netd system_file:file lock; 82 83# Allow netd to spawn dnsmasq in it's own domain 84allow netd dnsmasq:process signal; 85 86# Allow netd to publish a binder service and make binder calls. 87binder_use(netd) 88add_service(netd, netd_service) 89add_service(netd, dnsresolver_service) 90allow netd dumpstate:fifo_file { getattr write }; 91 92# Allow netd to call into the system server so it can check permissions. 93allow netd system_server:binder call; 94allow netd permission_service:service_manager find; 95 96# Allow netd to talk to the framework service which collects netd events. 97allow netd netd_listener_service:service_manager find; 98 99# Allow netd to operate on sockets that are passed to it. 100allow netd netdomain:{ 101 icmp_socket 102 tcp_socket 103 udp_socket 104 rawip_socket 105 tun_socket 106} { read write getattr setattr getopt setopt }; 107allow netd netdomain:fd use; 108 109# give netd permission to read and write netlink xfrm 110allow netd self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_write nlmsg_read }; 111 112# Allow netd to register as hal server. 113add_hwservice(netd, system_net_netd_hwservice) 114hwbinder_use(netd) 115 116### 117### Neverallow rules 118### 119### netd should NEVER do any of this 120 121# Block device access. 122neverallow netd dev_type:blk_file { read write }; 123 124# ptrace any other app 125neverallow netd { domain }:process ptrace; 126 127# Write to /system. 128neverallow netd system_file:dir_file_class_set write; 129 130# Write to files in /data/data or system files on /data 131neverallow netd { app_data_file_type system_data_file }:dir_file_class_set write; 132 133# only system_server, dumpstate and network stack app may find netd service 134neverallow { 135 domain 136 -system_server 137 -dumpstate 138 -network_stack 139 -netd 140 -netutils_wrapper 141} netd_service:service_manager find; 142 143# only system_server, dumpstate and network stack app may find dnsresolver service 144neverallow { 145 domain 146 -system_server 147 -dumpstate 148 -network_stack 149 -netd 150 -netutils_wrapper 151} dnsresolver_service:service_manager find; 152 153# apps may not interact with netd over binder. 154neverallow { appdomain -network_stack } netd:binder call; 155neverallow netd { appdomain -network_stack userdebug_or_eng(`-su') }:binder call; 156 157# If an already existing file is opened with O_CREATE, the kernel might generate 158# a false report of a create denial. Silence these denials and make sure that 159# inappropriate permissions are not granted. 160neverallow netd proc_net:dir no_w_dir_perms; 161dontaudit netd proc_net:dir write; 162 163neverallow netd sysfs_net:dir no_w_dir_perms; 164dontaudit netd sysfs_net:dir write; 165 166# Netd should not have SYS_ADMIN privs. 167neverallow netd self:capability sys_admin; 168dontaudit netd self:capability sys_admin; 169 170# Netd should not have SYS_MODULE privs, nor should it be requesting module loads 171# (things it requires should be built directly into the kernel) 172dontaudit netd self:capability sys_module; 173 174dontaudit netd kernel:system module_request; 175 176dontaudit netd appdomain:unix_stream_socket { read write }; 177