NekoSakura/android_device_mediatek_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

non_plat: Label ipsec binary and grant required permissions

Browse Source 
Signed-off-by: Aayush Gupta <aayushgupta219@gmail.com>
Change-Id: Ia0f872f152f0a651a8954aec8372b363963e0c6d
This commit is contained in:
Aayush Gupta 2021-01-18 20:44:32 +05:30
parent 84ae870bb8
commit df5aa45ca7
2 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
non_plat/file_contexts
View File

@ -709,7 +709,8 @@
# Keymaster
/dev/ut_keymaster u:object_r:ut_keymaster_device:s0
#Ipsec
# Ipsec
/(system\/vendor|vendor)/bin/ipsec u:object_r:ipsec_exec:s0
/(system\/vendor|vendor)/bin/ipsec_mon u:object_r:ipsec_mon_exec:s0
# IMS

19
non_plat/ipsec.te Normal file
View File

@ -0,0 +1,19 @@
type ipsec_exec, exec_type, file_type, vendor_file_type;
type ipsec, domain;
allow ipsec proc_net:file write;
allow ipsec { property_socket dnsproxyd_socket fwmarkd_socket }:sock_file write;
allow ipsec { node port }:{ udp_socket rawip_socket } { node_bind name_bind };
allow ipsec init:unix_stream_socket connectto;
allow ipsec epdg_wod:unix_stream_socket { read write connectto };
allow ipsec epdg_wod:fd use;
allow ipsec self:capability { kill net_bind_service net_admin };
allow ipsec self:{ netlink_route_socket netlink_xfrm_socket } { read write create bind nlmsg_read nlmsg_write };
allow ipsec self:tcp_socket { read write create getattr connect getopt };
allow ipsec self:capability2 wake_alarm;
allow ipsec devpts:chr_file { read write open };
set_prop(ipsec, mtk_wod_prop)