commit 4468b1b909ed385046fdb83384d0709fa2af4a55
author Jeff Vander Stoep <jeffv@google.com> Sat Sep 10 15:40:10 2016 -0700
committer Jeff Vander Stoep <jeffv@google.com> Sat Sep 10 15:40:10 2016 -0700
tree ad67908dc81429f660549d10edc9ae77d17f2733
parent 1812247ef8380b50857945a43135ba009455faaa

apmanager: whitelist packet_socket ioctls

Change-Id: If671e07a0d21c86c0a3f0ac6df0ac752a0242e8f

sepolicy/apmanager.te

diff --git a/sepolicy/apmanager.te b/sepolicy/apmanager.te
index 5b54402..bd9cc09 100644
--- a/sepolicy/apmanager.te
+++ b/sepolicy/apmanager.te
@@ -23,6 +23,7 @@
 allow apmanager self:netlink_socket { write getattr setopt read bind create };
 allow apmanager self:netlink_generic_socket create_socket_perms_no_ioctl;
 allow apmanager self:packet_socket { write ioctl setopt read bind create };
+allowxperm apmanager self:packet_socket ioctl { unpriv_sock_ioctls priv_sock_ioctls unpriv_tty_ioctls };
 allow apmanager apmanager_data_file:dir create_dir_perms;
 allow apmanager apmanager_data_file:file create_file_perms;
 allow apmanager apmanager_data_file:sock_file { create getattr unlink setattr write };