diff options
| author | Stephen Smalley <sds@tycho.nsa.gov> | 2014-03-07 14:46:38 -0500 |
|---|---|---|
| committer | Stephen Smalley <sds@tycho.nsa.gov> | 2014-03-07 14:46:38 -0500 |
| commit | 17859404f6a1030488a657c4c406a7b83ea9957c (patch) | |
| tree | 32a8229973562470634a02962f935076c9ca63bb /dnsmasq.te | |
| parent | d9d9d2f4170b96a674c8222287bbe4cddfc8de3a (diff) | |
| download | android_external_sepolicy-17859404f6a1030488a657c4c406a7b83ea9957c.tar.gz android_external_sepolicy-17859404f6a1030488a657c4c406a7b83ea9957c.tar.bz2 android_external_sepolicy-17859404f6a1030488a657c4c406a7b83ea9957c.zip | |
Address dnsmasq denials.
Address dnsmasq denials such as:
avc: denied { use } for pid=9145 comm="dnsmasq" path="pipe:[29234]" dev="pipefs" ino=29234 scontext=u:r:dnsmasq:s0 tcontext=u:r:netd:s0 tclass=fd
avc: denied { read } for pid=9145 comm="dnsmasq" path="pipe:[29234]" dev="pipefs" ino=29234 scontext=u:r:dnsmasq:s0 tcontext=u:r:netd:s0 tclass=fifo_file
avc: denied { read write } for pid=9145 comm="dnsmasq" path="socket:[7860]" dev="sockfs" ino=7860 scontext=u:r:dnsmasq:s0 tcontext=u:r:netd:s0 tclass=netlink_kobject_uevent_socket
avc: denied { read write } for pid=9145 comm="dnsmasq" path="socket:[8221]" dev="sockfs" ino=8221 scontext=u:r:dnsmasq:s0 tcontext=u:r:netd:s0 tclass=unix_stream_socket
avc: denied { read write } for pid=9523 comm="dnsmasq" path="socket:[7860]" dev="sockfs" ino=7860 scontext=u:r:dnsmasq:s0 tcontext=u:r:netd:s0 tclass=netlink_kobject_uevent_socket
avc: denied { read write } for pid=9523 comm="dnsmasq" path="socket:[7862]" dev="sockfs" ino=7862 scontext=u:r:dnsmasq:s0 tcontext=u:r:netd:s0 tclass=netlink_route_socket
avc: denied { net_raw } for pid=9607 comm="dnsmasq" capability=13 scontext=u:r:dnsmasq:s0 tcontext=u:r:dnsmasq:s0 tclass=capability
avc: denied { net_admin } for pid=9607 comm="dnsmasq" capability=12 scontext=u:r:dnsmasq:s0 tcontext=u:r:dnsmasq:s0 tclass=capability
Change-Id: I2bd1eaf22879f09df76a073028cc282362eebeee
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Diffstat (limited to 'dnsmasq.te')
| -rw-r--r-- | dnsmasq.te | 11 |
1 files changed, 10 insertions, 1 deletions
@@ -5,7 +5,16 @@ type dnsmasq_exec, exec_type, file_type; net_domain(dnsmasq) -allow dnsmasq self:capability { net_bind_service setgid setuid }; +allow dnsmasq self:capability { net_admin net_raw net_bind_service setgid setuid }; allow dnsmasq dhcp_data_file:dir w_dir_perms; allow dnsmasq dhcp_data_file:file create_file_perms; + +# Inherit and use open files from netd. +allow dnsmasq netd:fd use; +allow dnsmasq netd:fifo_file { read write }; +# TODO: Investigate whether these inherited sockets should be closed on exec. +allow dnsmasq netd:netlink_kobject_uevent_socket { read write }; +allow dnsmasq netd:netlink_nflog_socket { read write }; +allow dnsmasq netd:netlink_route_socket { read write }; +allow dnsmasq netd:unix_stream_socket { read write }; |