1*e4a36f41SAndroid Build Coastguard Worker# wpa supplicant macsec or equivalent 2*e4a36f41SAndroid Build Coastguard Workertype wpa_supplicant_macsec, domain; 3*e4a36f41SAndroid Build Coastguard Workertype wpa_supplicant_macsec_exec, exec_type, vendor_file_type, file_type; 4*e4a36f41SAndroid Build Coastguard Workerinit_daemon_domain(wpa_supplicant_macsec) 5*e4a36f41SAndroid Build Coastguard Worker 6*e4a36f41SAndroid Build Coastguard Workernet_domain(wpa_supplicant_macsec) 7*e4a36f41SAndroid Build Coastguard Worker 8*e4a36f41SAndroid Build Coastguard Worker# Allow wpa_supplicant to configure nl80211 9*e4a36f41SAndroid Build Coastguard Workerallow wpa_supplicant_macsec proc_net_type:file write; 10*e4a36f41SAndroid Build Coastguard Worker 11*e4a36f41SAndroid Build Coastguard Worker# in addition to ioctls allowlisted for all domains, grant wpa_supplicant_macsec priv_sock_ioctls. 12*e4a36f41SAndroid Build Coastguard Workerallowxperm wpa_supplicant_macsec self:udp_socket ioctl priv_sock_ioctls; 13*e4a36f41SAndroid Build Coastguard Worker 14*e4a36f41SAndroid Build Coastguard Workerr_dir_file(wpa_supplicant_macsec, sysfs_type) 15*e4a36f41SAndroid Build Coastguard Workerr_dir_file(wpa_supplicant_macsec, proc_net_type) 16*e4a36f41SAndroid Build Coastguard Worker 17*e4a36f41SAndroid Build Coastguard Workerallow wpa_supplicant_macsec self:global_capability_class_set { setuid net_admin setgid net_raw }; 18*e4a36f41SAndroid Build Coastguard Workerallow wpa_supplicant_macsec cgroup:dir create_dir_perms; 19*e4a36f41SAndroid Build Coastguard Workerallow wpa_supplicant_macsec cgroup_v2:dir create_dir_perms; 20*e4a36f41SAndroid Build Coastguard Workerallow wpa_supplicant_macsec self:netlink_route_socket nlmsg_write; 21*e4a36f41SAndroid Build Coastguard Workerallow wpa_supplicant_macsec self:netlink_socket create_socket_perms_no_ioctl; 22*e4a36f41SAndroid Build Coastguard Workerallow wpa_supplicant_macsec self:netlink_generic_socket create_socket_perms_no_ioctl; 23*e4a36f41SAndroid Build Coastguard Workerallow wpa_supplicant_macsec self:packet_socket create_socket_perms; 24*e4a36f41SAndroid Build Coastguard Workerallowxperm wpa_supplicant_macsec self:packet_socket ioctl { unpriv_sock_ioctls priv_sock_ioctls unpriv_tty_ioctls }; 25*e4a36f41SAndroid Build Coastguard Worker 26*e4a36f41SAndroid Build Coastguard Workerbinder_use(wpa_supplicant_macsec) 27*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(wpa_supplicant_macsec, hal_macsec) 28*e4a36f41SAndroid Build Coastguard Worker 29