1typeattribute netutils_wrapper coredomain;
2
3r_dir_file(netutils_wrapper, system_file);
4
5# For netutils (ip, iptables, tc)
6allow netutils_wrapper self:capability net_raw;
7
8allow netutils_wrapper system_file:file { execute execute_no_trans };
9allow netutils_wrapper proc_net:file { open read getattr };
10allow netutils_wrapper self:rawip_socket create_socket_perms;
11allow netutils_wrapper self:udp_socket create_socket_perms;
12allow netutils_wrapper self:capability net_admin;
13# ip utils need everything but ioctl
14allow netutils_wrapper self:netlink_route_socket ~ioctl;
15allow netutils_wrapper self:netlink_xfrm_socket ~ioctl;
16
17# For netutils (ndc) to be able to talk to netd
18allow netutils_wrapper netd_socket:sock_file { open getattr read write append };
19allow netutils_wrapper netd:unix_stream_socket { read getattr connectto };
20
21# For /data/misc/net access to ndc and ip
22r_dir_file(netutils_wrapper, net_data_file)
23
24domain_auto_trans({
25    domain
26    -coredomain
27    -appdomain
28}, netutils_wrapper_exec, netutils_wrapper)
29