diff --git a/public/domain_deprecated.te b/public/domain_deprecated.te index a8320b51d8c2dfac0c3ea3592b589a30ce3b48d1..13b18fa255d557ad04f58a210d8e32dd7e4ce41c 100644 --- a/public/domain_deprecated.te +++ b/public/domain_deprecated.te @@ -80,7 +80,6 @@ r_dir_file(domain_deprecated, proc) r_dir_file(domain_deprecated, sysfs) r_dir_file(domain_deprecated, cgroup) allow domain_deprecated proc_meminfo:file r_file_perms; -r_dir_file(domain_deprecated, proc_net) #auditallow domain_deprecated proc:dir r_dir_perms; # r_dir_perms granted in domain auditallow { domain_deprecated -fsck -fsck_untrusted -init -priv_app -rild -system_server -vold } proc:file r_file_perms; auditallow { domain_deprecated -fsck -fsck_untrusted -init -priv_app -rild -system_server -vold } proc:lnk_file { open ioctl lock }; # getattr read granted in domain @@ -120,19 +119,6 @@ auditallow { -zygote } cgroup:{ file lnk_file } r_file_perms; auditallow { domain_deprecated -appdomain -init -priv_app -surfaceflinger -system_server -vold } proc_meminfo:file r_file_perms; -auditallow { domain_deprecated -appdomain -clatd -init -netd -system_server -vold -wpa -zygote } proc_net:dir { open getattr read ioctl lock }; # search granted in domain -auditallow { - domain_deprecated - -appdomain - -clatd - -dumpstate - -init - -netd - -system_server - -vold - -wpa - -zygote -} proc_net:{ file lnk_file } r_file_perms; # Get SELinux enforcing status. allow domain_deprecated selinuxfs:dir r_dir_perms; diff --git a/public/netd.te b/public/netd.te index dc4a1b3ee77faa1629843ad4b4278955b1f255ba..45a19525cc4e95c1b727b614cd637c7683683474 100644 --- a/public/netd.te +++ b/public/netd.te @@ -29,6 +29,7 @@ allow netd shell_exec:file rx_file_perms; allow netd system_file:file x_file_perms; allow netd devpts:chr_file rw_file_perms; +r_dir_file(netd, proc_net) # For /proc/sys/net/ipv[46]/route/flush. allow netd proc_net:file rw_file_perms; diff --git a/public/ppp.te b/public/ppp.te index 5708822ee3cca1c7394948be21fbd0036ea0fa8b..9c1b7078b3053ae70264c6eac95e2fa5b847d113 100644 --- a/public/ppp.te +++ b/public/ppp.te @@ -5,6 +5,8 @@ type ppp_exec, exec_type, file_type; net_domain(ppp) +r_dir_file(ppp, proc_net) + allow ppp mtp:socket rw_socket_perms_no_ioctl; allow ppp mtp:unix_dgram_socket rw_socket_perms; allow ppp ppp_device:chr_file rw_file_perms; diff --git a/public/rild.te b/public/rild.te index 85aa04415e4ca8ad23300fa42ea371d52592cdf9..bc6d6293d8b04d50ed6e2f477a8d2d9c2d2875ed 100644 --- a/public/rild.te +++ b/public/rild.te @@ -44,6 +44,7 @@ allow rild self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; wakelock_use(rild) r_dir_file(rild, proc) +r_dir_file(rild, proc_net) r_dir_file(rild, sysfs_type) r_dir_file(rild, system_file)