diff --git a/policy/modules/services/tqftpserv.fc b/policy/modules/services/tqftpserv.fc new file mode 100644 index 0000000000..471b6dfefa --- /dev/null +++ b/policy/modules/services/tqftpserv.fc @@ -0,0 +1,4 @@ +# File contexts for Qualcomm tqftpserv TFTP service. +# Label the tqftpserv binary to trigger domain transition on exec. + +/usr/bin/tqftpserv -- gen_context(system_u:object_r:qcom_tqftpserv_exec_t,s0) diff --git a/policy/modules/services/tqftpserv.if b/policy/modules/services/tqftpserv.if new file mode 100644 index 0000000000..fa1308ba43 --- /dev/null +++ b/policy/modules/services/tqftpserv.if @@ -0,0 +1,3 @@ +## tqftpserv - Qualcomm TFTP server for modem remote filesystem access +## +## diff --git a/policy/modules/services/tqftpserv.te b/policy/modules/services/tqftpserv.te new file mode 100644 index 0000000000..7181a479fb --- /dev/null +++ b/policy/modules/services/tqftpserv.te @@ -0,0 +1,23 @@ +######################################## +# +# Declarations +# + +type qcom_tqftpserv_t; +type qcom_tqftpserv_exec_t; +init_daemon_domain(qcom_tqftpserv_t, qcom_tqftpserv_exec_t) + +######################################## +# +# qcom_tqftpserv local policy +# + +# QRTR socket for modem IPC (EFS remote filesystem protocol) +allow qcom_tqftpserv_t self:qipcrtr_socket create_socket_perms; + +# Generic socket operations +allow qcom_tqftpserv_t self:socket create_socket_perms; + +# net_admin: network socket management +# dac_read_search: read modem-requested EFS/data paths +allow qcom_tqftpserv_t self:capability { net_admin dac_read_search };