1# Networking service app
2typeattribute network_stack coredomain;
3typeattribute network_stack mlstrustedsubject;
4typeattribute network_stack bpfdomain;
5
6app_domain(network_stack);
7net_domain(network_stack);
8
9allow network_stack self:global_capability_class_set {
10    net_admin
11    net_bind_service
12    net_broadcast
13    net_raw
14};
15
16# Allow access to net_admin ioctl, DHCP server uses SIOCSARP
17allowxperm network_stack self:udp_socket ioctl priv_sock_ioctls;
18
19# The DhcpClient uses packet_sockets
20allow network_stack self:packet_socket create_socket_perms_no_ioctl;
21
22# Monitor neighbors via netlink.
23allow network_stack self:netlink_route_socket nlmsg_write;
24
25# Use netlink uevent sockets.
26allow network_stack self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
27
28# give network_stack the same netlink permissions as netd
29allow network_stack self:netlink_nflog_socket create_socket_perms_no_ioctl;
30allow network_stack self:netlink_socket create_socket_perms_no_ioctl;
31allow network_stack self:netlink_generic_socket create_socket_perms_no_ioctl;
32
33allow network_stack app_api_service:service_manager find;
34allow network_stack dnsresolver_service:service_manager find;
35allow network_stack mdns_service:service_manager find;
36allow network_stack netd_service:service_manager find;
37allow network_stack network_watchlist_service:service_manager find;
38allow network_stack radio_service:service_manager find;
39allow network_stack system_config_service:service_manager find;
40allow network_stack radio_data_file:dir create_dir_perms;
41allow network_stack radio_data_file:file create_file_perms;
42
43binder_call(network_stack, netd);
44
45# in order to invoke side effect of close() on such a socket calling synchronize_rcu()
46# TODO: Remove this permission when 4.9 kernel is deprecated.
47allow network_stack self:key_socket create;
48# Java's Os.close() in libcore/luni/src/main/java/libcore/io/BlockGuardOs.java;l=100
49# calls if (fd.isSocket$()) if (isLingerSocket(fd)) ...
50dontaudit network_stack self:key_socket getopt;
51
52# Grant read permission of connectivity namespace system property prefix.
53get_prop(network_stack, device_config_connectivity_prop)
54
55# Create/use netlink_tcpdiag_socket to get tcp info
56allow network_stack self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read nlmsg_write };
57############### Tethering Service app - Tethering.apk ##############
58hal_client_domain(network_stack, hal_tetheroffload)
59# Create and share netlink_netfilter_sockets for tetheroffload.
60allow network_stack self:netlink_netfilter_socket create_socket_perms_no_ioctl;
61allow network_stack network_stack_service:service_manager find;
62# allow Tethering(network_stack process) to run/update/read the eBPF maps to offload tethering traffic by eBPF.
63allow network_stack { fs_bpf_net_private fs_bpf_net_shared fs_bpf_netd_readonly fs_bpf_netd_shared fs_bpf_tethering }:dir search;
64allow network_stack { fs_bpf_net_private fs_bpf_net_shared fs_bpf_netd_readonly fs_bpf_netd_shared fs_bpf_tethering }:file { getattr read write };
65allow network_stack bpfloader:bpf { map_read map_write prog_run };
66# allow Tethering(network_stack process) to read flag value in tethering_u_or_later_native namespace
67get_prop(network_stack, device_config_tethering_u_or_later_native_prop)
68
69# Use XFRM (IPsec) netlink sockets
70allow network_stack self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_write nlmsg_read };
71
72# tun device used for 3rd party vpn apps and test network manager
73allow network_stack tun_device:chr_file rw_file_perms;
74allowxperm network_stack tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF TUNSETLINK TUNSETCARRIER };
75
76############### NEVER ALLOW RULES
77# This place is as good as any for these rules,
78# and it is probably the most appropriate because
79# network_stack itself is entirely mainline code.
80
81# T+: Only the bpfloader and the network_stack should ever touch 'fs_bpf_net_private' programs/maps.
82neverallow { domain -bpfloader -network_stack } fs_bpf_net_private:dir ~getattr;
83neverallow { domain -bpfloader -network_stack } fs_bpf_net_private:file *;
84
85# T+: Only the bpfloader, network_stack and system_server should ever touch 'fs_bpf_net_shared' programs/maps.
86neverallow { domain -bpfloader -network_stack -system_server } fs_bpf_net_shared:dir ~getattr;
87neverallow { domain -bpfloader -network_stack -system_server } fs_bpf_net_shared:file *;
88
89# T+: Only the bpfloader, netd, network_stack and system_server should ever touch 'fs_bpf_netd_readonly' programs/maps.
90# netd's access should be readonly
91neverallow { domain -bpfloader -netd -network_stack -system_server } fs_bpf_netd_readonly:dir ~getattr;
92neverallow { domain -bpfloader -netd -network_stack -system_server } fs_bpf_netd_readonly:file *;
93neverallow netd fs_bpf_netd_readonly:file write;
94
95# T+: Only the bpfloader, netd, netutils_wrapper, network_stack and system_server should ever touch 'fs_bpf_netd_shared' programs/maps.
96# netutils_wrapper requires access to be able to run iptables and only needs readonly access
97neverallow { domain -bpfloader -netd -netutils_wrapper -network_stack -system_server } fs_bpf_netd_shared:dir ~getattr;
98neverallow { domain -bpfloader -netd -netutils_wrapper -network_stack -system_server } fs_bpf_netd_shared:file *;
99neverallow netutils_wrapper fs_bpf_netd_shared:file write;
100
101# S+: Only the bpfloader and the network_stack should ever touch 'fs_bpf_tethering' programs/maps.
102neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:dir ~getattr;
103neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:file *;
104