Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ca5bfb1c authored by Bjoern Johansson's avatar Bjoern Johansson
Browse files

Update SELinux rules to support emulator WiFi 

SELinux policies have become stricter, this updates the emulator SELinux
rules to accomodate these changes. It also adds rules for the new
createns command with the accompanying execns changes that are needed
to work with an updated filesystem layout.

BUG: 74514143
Test: Compile emulator images and verify that WiFi works
Change-Id: I4b58cea681a1e41b0cb7368e1c696f74ce28f871
parent 275bdb08

target/board/generic/sepolicy/createns.te

0 → 100644
+14 −0
Original line number Diff line number Diff line 
# Network namespace creation

type createns, domain;

type createns_exec, exec_type, vendor_file_type, file_type;



init_daemon_domain(createns)



allow createns self:capability { sys_admin net_raw setuid setgid };

allow createns varrun_file:dir { add_name search write };

allow createns varrun_file:file { create mounton open read write };



#Allow createns itself to be run by init in its own domain

domain_auto_trans(goldfish_setup, createns_exec, createns);

allow createns goldfish_setup:fd use;

target/board/generic/sepolicy/execns.te

+16 −4
Original line number Diff line number Diff line
@@ -5,8 +5,9 @@ type execns_exec, exec_type, vendor_file_type, file_type; 
init_daemon_domain(execns)



allow execns varrun_file:dir search;

allow execns varrun_file:file r_file_perms;

allow execns self:capability sys_admin;

allow execns proc:file { open read };

allow execns nsfs:file { open read };



#Allow execns itself to be run by init in its own domain

domain_auto_trans(init, execns_exec, execns);
@@ -17,6 +18,17 @@ domain_auto_trans(execns, dhcpclient_exec, dhcpclient); 
# Allow dhcpserver to be run by execns in its own domain

domain_auto_trans(execns, dhcpserver_exec, dhcpserver);



# Allow hostapd to be run by execns in its own domain

domain_auto_trans(execns, hostapd_exec, hostapd);

allow hostapd execns:fd use;
 
# Rules to allow execution of hostapd and allow it to run

allow execns hal_wifi_hostapd_default_exec:file { execute_no_trans };

allow execns self:capability { net_admin net_raw };

allow execns self:netlink_generic_socket { bind create getattr read setopt write };

allow execns self:netlink_route_socket { bind create read write nlmsg_write };

allow execns execns:udp_socket { create ioctl };

allow execns self:packet_socket { create setopt };

allow execns sysfs_net:dir { search };

allowxperm execns self:udp_socket ioctl priv_sock_ioctls;



# Allow execns to read createns proc file to get the namespace file

allow execns createns:file read;

allow execns createns:dir search;

allow execns createns:lnk_file read;

target/board/generic/sepolicy/file.te

+1 −0
Original line number Diff line number Diff line 
type sysfs_writable, fs_type, sysfs_type, mlstrustedobject;

type varrun_file, file_type, data_file_type, mlstrustedobject;

type mediadrm_vendor_data_file, file_type, data_file_type;

type nsfs, fs_type;

target/board/generic/sepolicy/file_contexts

+2 −1
Original line number Diff line number Diff line
@@ -19,6 +19,7 @@ 
/vendor/bin/init\.ranchu-net\.sh u:object_r:goldfish_setup_exec:s0

/vendor/bin/init\.wifi\.sh   u:object_r:goldfish_setup_exec:s0

/vendor/bin/qemu-props       u:object_r:qemu_props_exec:s0

/vendor/bin/createns         u:object_r:createns_exec:s0

/vendor/bin/execns           u:object_r:execns_exec:s0

/vendor/bin/ipv6proxy        u:object_r:ipv6proxy_exec:s0

/vendor/bin/dhcpclient       u:object_r:dhcpclient_exec:s0
@@ -41,5 +42,5 @@ 


# data

/data/vendor/mediadrm(/.*)?            u:object_r:mediadrm_vendor_data_file:s0

/data/var/run(/.*)?                    u:object_r:varrun_file:s0

/data/vendor/var/run(/.*)?             u:object_r:varrun_file:s0

target/board/generic/sepolicy/genfs_contexts

+3 −0
Original line number Diff line number Diff line
@@ -15,3 +15,6 @@ genfscon sysfs /devices/platform/GFSH0007:00/rtc u:object_r:sysfs_rtc:s0 
genfscon sysfs /devices/pci0000:00/0000:00:08.0/virtio5/net u:object_r:sysfs_net:s0

genfscon sysfs /devices/virtual/mac80211_hwsim/hwsim0/net u:object_r:sysfs_net:s0

genfscon sysfs /devices/virtual/mac80211_hwsim/hwsim1/net u:object_r:sysfs_net:s0



# /proc/<pid>/ns

genfscon nsfs / u:object_r:nsfs:s0