Skip to content
Snippets Groups Projects
Commit 7ade68d7 authored by Stephen Smalley's avatar Stephen Smalley
Browse files

Ensure that /data/misc/wifi/sockets is always labeled wpa_socket.


It appears that wpa_supplicant tries to rmdir /data/misc/wifi/sockets
and re-create it at times, so make sure that it remains labeled correctly
when re-created in this manner via a name-based type transition rule.
Do the same for hostapd as it also has permissions for creating/removing
this directory.

<5>[83921.800071] type=1400 audit(1392997522.105:26): avc:  denied  { rmdir } for  pid=3055 comm="wpa_supplicant" name="sockets" dev="mmcblk0p28" ino=618957 scontext=u:r:wpa:s0 tcontext=u:object_r:wpa_socket:s0 tclass=dir

We no longer need the type_transition for sock_file as it will inherit
the type from the parent directory which is set via restorecon_recursive
/data/misc/wifi/sockets or via type_transition, so drop it.

Change-Id: Iffa61c426783eb03205ba6964c624c6ecea32630
Signed-off-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
parent b73d321a
No related branches found
No related tags found
No related merge requests found
......@@ -11,6 +11,7 @@ allow hostapd self:udp_socket { create ioctl };
allow hostapd wifi_data_file:file rw_file_perms;
allow hostapd wifi_data_file:dir create_dir_perms;
type_transition hostapd wifi_data_file:dir wpa_socket "sockets";
allow hostapd wpa_socket:dir create_dir_perms;
allow hostapd wpa_socket:sock_file create_file_perms;
allow hostapd netd:fd use;
......
......@@ -16,8 +16,8 @@ unix_socket_send(wpa, system_wpa, system_server)
allow wpa random_device:chr_file r_file_perms;
# Create a socket for receiving info from wpa
type_transition wpa wifi_data_file:sock_file wpa_socket;
allow wpa wpa_socket:dir { rw_dir_perms setattr };
type_transition wpa wifi_data_file:dir wpa_socket "sockets";
allow wpa wpa_socket:dir create_dir_perms;
allow wpa wpa_socket:sock_file create_file_perms;
# Allow wpa_cli to work. wpa_cli creates a socket in
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment