commit 5484fe4a01fd618b524ce1e02850eb5800324b0f
author Greg Hartman <ghartman@google.com> Tue Mar 12 19:27:10 2019 -0700
committer Tri Vo <trong@google.com> Wed Mar 13 22:51:15 2019 +0000
tree 2377b13aedeb00892369b97961cd29818d611e34
parent 4c656664bacda9de0ccc7ecd0d0de56bfe2d2b7d

Add missing permissions to socket_forward_proxy

Address denials:
avc: denied { write } for comm="socket_forward_" name="socket_forward"
dev="tmpfs" ino=1464 scontext=u:r:socket_forward_proxy:s0
tcontext=u:object_r:socket_forward_device:s0 tclass=chr_file permissive=1

avc: denied { net_raw } for comm="socket_forward_" capability=13
scontext=u:r:socket_forward_proxy:s0
tcontext=u:r:socket_forward_proxy:s0 tclass=capability permissive=1

Bug: 28053261
Test: launch_cvd  -guest_enforce_security true, adb shell
Change-Id: I8bf653ee0629f0a3c3d96df8416370b628acb873

shared/sepolicy/socket_forward_proxy.te

diff --git a/shared/sepolicy/socket_forward_proxy.te b/shared/sepolicy/socket_forward_proxy.te
index 00ffba7..0b7f2fc 100644
--- a/shared/sepolicy/socket_forward_proxy.te
+++ b/shared/sepolicy/socket_forward_proxy.te
@@ -3,4 +3,5 @@
 
 init_daemon_domain(socket_forward_proxy)
 
-allow socket_forward_proxy socket_forward_device:chr_file r_file_perms;
+allow socket_forward_proxy socket_forward_device:chr_file rw_file_perms;
+allow socket_forward_proxy self:capability net_raw;