Make all domains unconfined.

This prevents denials from being generated by the base policy.
Over time, these rules will be incrementally tightened to improve
security.

Change-Id: I4be1c987a5d69ac784a56d42fc2c9063c402de11

1 files changed, 2 insertions, 32 deletions

diff --git a/netd.te b/netd.te
index 297f570..6f294ed 100644
--- a/netd.te
+++ b/netd.te
@@ -1,38 +1,8 @@
 # network manager
 type netd, domain;
-permissive netd;
 type netd_exec, exec_type, file_type;
 
+permissive netd;
+unconfined_domain(netd)
 init_daemon_domain(netd)
-typeattribute netd mlstrustedsubject;
-allow netd self:capability { net_admin net_raw sys_module kill };
-allow netd self:netlink_kobject_uevent_socket *;
-allow netd self:netlink_route_socket *;
-allow netd self:netlink_nflog_socket *;
-allow netd self:rawip_socket *;
-allow netd self:udp_socket *;
-allow netd node:udp_socket node_bind;
-allow netd port:udp_socket name_bind;
-allow netd self:unix_stream_socket *;
-allow netd shell_exec:file rx_file_perms;
-allow netd system_file:file x_file_perms;
-allow netd devpts:chr_file rw_file_perms;
-
-# For /proc/sys/net/ipv[46]/route/flush.
-# XXX Split /proc/sys/net into its own type.
-allow netd proc:file write;
-
-# For /sys/modules/bcmdhd/parameters/firmware_path
-# XXX Split into its own type.
-allow netd sysfs:file write;
-
-# Network driver loading.
-allow netd kernel:system module_request;
-
-# Set dhcp lease for PAN connection
-unix_socket_connect(netd, property, init)
-allow netd system_prop:property_service set;
-
-# Connect to PAN
 domain_auto_trans(netd, dhcp_exec, dhcp)
-allow netd dhcp:process signal;