commit 3f84caf090ea81df166a358f32a3d630cbf9aba6
author Tri Vo <trong@google.com> Sat Apr 13 16:55:41 2019 -0700
committer Tri Vo <trong@google.com> Sun Apr 14 14:30:02 2019 -0700
tree 247bb29a7bf33499d5bc611b80b10bf1391ef652
parent ead9a5f944aa95ca73f7873634fc19b991507b2e

Label device-specific sysfs net nodes

avc: denied { write } for name="mtu" dev="sysfs" ino=10779
scontext=u:r:netd:s0 tcontext=u:object_r:sysfs:s0 tclass=file
permissive=0

netd hits this denial by following this symlink
qemu: /sys/class/net/rmnet0 -> /sys/devices/pci0000:00/0000:00:0a.0/virtio8/net/rmnet0
crosvm: /sys/class/net/rmnet0 -> /sys/devices/pci0000:00/0000:00:0c.0/virtio11/net/rmnet0

Bug: 129497117
Test: boot cuttlefish without above denial
Change-Id: I08508b22c4e6e3bf86f2c22b1187a3a6d40c89b5

shared/sepolicy/genfs_contexts

diff --git a/shared/sepolicy/genfs_contexts b/shared/sepolicy/genfs_contexts
index 1abaa6a..70bde10 100644
--- a/shared/sepolicy/genfs_contexts
+++ b/shared/sepolicy/genfs_contexts
@@ -1 +1,3 @@
 genfscon sysfs /devices/pnp0/00:00/rtc  u:object_r:sysfs_rtc:s0
+genfscon sysfs /devices/pci0000:00/0000:00:0a.0/virtio8/net u:object_r:sysfs_net:s0 # qemu
+genfscon sysfs /devices/pci0000:00/0000:00:0c.0/virtio11/net u:object_r:sysfs_net:s0 # crosvm