From 418e2abd39a3c86c4f8c7fcac93a1a7beea7a092 Mon Sep 17 00:00:00 2001
From: Stephen Smalley <sds@tycho.nsa.gov>
Date: Wed, 29 Jan 2014 13:45:51 -0500
Subject: [PATCH] Label /data/misc/wifi/sockets with wpa_socket.
This will ensure that any sockets created in this directory
will default to wpa_socket unless a type_transition is defined.
Define a type transition for system_server to keep its separate
system_wpa_socket type assigned for its socket. Allow wpa
to create and unlink sockets in the directory. We leave the
already existing rules for wifi_data_file in place for compatibility
with existing devices that have wifi_data_file on /data/misc/wifi/sockets.
Change-Id: I9e35cc93abf89ce3594860aa3193f84a3b42ea6e
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
file_contexts | 2 ++
system_server.te | 2 ++
wpa_supplicant.te | 1 +
3 files changed, 5 insertions(+)
diff --git a/file_contexts b/file_contexts
index 06b23a629..f036094ea 100644
--- a/file_contexts
+++ b/file_contexts
@@ -186,6 +186,8 @@
/data/misc/systemkeys(/.*)? u:object_r:systemkeys_data_file:s0
/data/misc/vpn(/.*)? u:object_r:vpn_data_file:s0
/data/misc/wifi(/.*)? u:object_r:wifi_data_file:s0
+/data/misc/wifi/sockets(/.*)? u:object_r:wpa_socket:s0
+/data/misc/wifi/sockets/wpa_ctrl.* u:object_r:system_wpa_socket:s0
/data/misc/zoneinfo(/.*)? u:object_r:zoneinfo_data_file:s0
# App sandboxes
diff --git a/system_server.te b/system_server.te
index ef040d5d5..27dc52df0 100644
--- a/system_server.te
+++ b/system_server.te
@@ -173,6 +173,8 @@ allow system_server ctl_default_prop:property_service set;
# Create a socket for receiving info from wpa.
type_transition system_server wifi_data_file:sock_file system_wpa_socket;
+type_transition system_server wpa_socket:sock_file system_wpa_socket;
+allow system_server wpa_socket:dir rw_dir_perms;
allow system_server system_wpa_socket:sock_file create_file_perms;
# Remove sockets created by wpa_supplicant
diff --git a/wpa_supplicant.te b/wpa_supplicant.te
index 38c0fb06b..de1eb5ddb 100644
--- a/wpa_supplicant.te
+++ b/wpa_supplicant.te
@@ -17,4 +17,5 @@ allow wpa random_device:chr_file r_file_perms;
# Create a socket for receiving info from wpa
type_transition wpa wifi_data_file:sock_file wpa_socket;
+allow wpa wpa_socket:dir { rw_dir_perms setattr };
allow wpa wpa_socket:sock_file create_file_perms;
--
GitLab