From f7a7f7d1382129b79cd5efce00554a4eeaab024e Mon Sep 17 00:00:00 2001
From: Jeff Vander Stoep <jeffv@google.com>
Date: Wed, 11 Apr 2018 10:46:30 -0700
Subject: [PATCH] Suppress spurious denial
Addresses:
avc: denied { sys_resource } for comm="ip6tables" capability=24
scontext=u:r:netutils_wrapper:s0 tcontext=u:r:netutils_wrapper:s0
tclass=capability
Bug: 77905989
Test: build and flash taimen-userdebug
Change-Id: Ic5d7c96152b96b55255eeec00b19948f38c1923c
(cherry picked from commit 443a43c98121363929f268b1f77bd229a3247d3a)
---
private/netutils_wrapper.te | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/private/netutils_wrapper.te b/private/netutils_wrapper.te
index f56e8d861..ea58814e1 100644
--- a/private/netutils_wrapper.te
+++ b/private/netutils_wrapper.te
@@ -33,3 +33,9 @@ domain_auto_trans({
-coredomain
-appdomain
}, netutils_wrapper_exec, netutils_wrapper)
+
+# suppress spurious denials
+dontaudit netutils_wrapper self:global_capability_class_set sys_resource;
+
+# netutils wrapper may only use the following capabilities.
+neverallow netutils_wrapper self:global_capability_class_set ~{ net_admin net_raw };
--
GitLab