1type cnd, domain, vendor_executes_system_violators;
2type cnd_exec, exec_type, vendor_file_type, file_type;
3
4# cnd creates /dev/socket/nims
5file_type_auto_trans(cnd, socket_device, cnd_socket);
6allow cnd socket_device:dir remove_name;
7
8init_daemon_domain(cnd)
9net_domain(cnd)
10wakelock_use(cnd)
11
12# TODO(b/36576126): Remove this one cnd stops accessing /dev/binder
13typeattribute cnd binder_in_vendor_violators;
14
15# do not grant net_raw, net_admin, or dac_override
16allow cnd self:capability { chown fsetid setgid setuid net_bind_service};
17
18# Grant access to Qualcomm MSM Interface (QMI) radio sockets
19qmux_socket(cnd)
20
21set_prop(cnd, system_prop)
22
23allow cnd proc_meminfo:file r_file_perms;
24allow cnd self:netlink_tcpdiag_socket create_socket_perms_no_ioctl;
25allow cnd self:socket create_socket_perms;
26allowxperm cnd self:socket ioctl msm_sock_ipc_ioctls;
27
28r_dir_file(cnd, sysfs_type)
29
30userdebug_or_eng(`
31  allow cnd diag_device:chr_file rw_file_perms;
32')
33
34# use for mobile hostspot
35allow cnd shell_exec:file rx_file_perms;
36allow cnd system_file:file rx_file_perms;
37
38# TODO(b/36613996): Remove this once qcneservice no longer communicates over sockets with cnd
39# or once qcneservice becomes a vendor service
40typeattribute cnd socket_between_core_and_vendor_violators;
41