commit 4218fee5d67c0c3b183437282e17e3fa602d53dc
author Nick Kralevich <nnk@google.com> Wed Jan 14 13:28:08 2015 -0800
committer Nick Kralevich <nnk@google.com> Wed Jan 14 22:06:21 2015 +0000
tree fa225eca8fa5d3b47798483ecdc94252de15504d
parent e69ac87250f97eb7a48e4cdec50dbc7ab88e295e

netmgrd: give explicit read access to /proc/net

We plan to remove /proc/net access from domain.te in a future
change. Make sure netmgrd doesn't depend on the rules in domain.te.

Bug: 9496886
Change-Id: Ic9029bfe629e7682543f1a5348c58e2b48339bb7

sepolicy/netmgrd.te

diff --git a/sepolicy/netmgrd.te b/sepolicy/netmgrd.te
index f54bf01..20f72aa 100644
--- a/sepolicy/netmgrd.te
+++ b/sepolicy/netmgrd.te
@@ -34,7 +34,8 @@
 allow netmgrd net_radio_prop:property_service set;
 
 # Access to /proc/sys/net/*
-allow netmgrd proc_net:file write;
+allow netmgrd proc_net:file rw_file_perms;
+allow netmgrd proc_net:dir r_dir_perms;
 
 # Let netmgrd access /dev/mdm node (modem driver)
 allow netmgrd radio_device:chr_file r_file_perms;