Add internet & appdebugging privilege labels & their policy

Replacing nether with Smack-based network control requires
new labels that will be associated with network.

Added also policy for system daemons.

Change-Id: Ib06ff1bed4daede5e8aeefbcf8ac9e284b5193c3

diff --git a/packaging/default-ac-domains.manifest b/packaging/default-ac-domains.manifest
index 1afa633cac492ae4862c8e3e85bbcd4d721eb469..ea0182792c6f5c5d613f92fdc4d2180f7f49846b 100644 (file)
--- a/packaging/default-ac-domains.manifest
+++ b/packaging/default-ac-domains.manifest
@@ -19,6 +19,44 @@
       <smack permit="_" to="System::Run" type="rwxat"/>
     </permit>
   </define>
+  <define>
+    <domain name="System::Privilege::Internet" policy="shared"/>
+    <request>
+      <smack request="User" type="w"/>
+      <smack request="User::Shell" type="w"/>
+      <smack request="System" type="w"/>
+      <smack request="System::Privileged" type="w"/>
+      <smack request="System::TEF" type="w"/>
+      <smack request="_" type="w"/>
+    </request>
+    <permit>
+      <smack permit="User" type="w"/>
+      <smack permit="User::Shell" type="w"/>
+      <smack permit="System" type="w"/>
+      <smack permit="System::Privileged" type="w"/>
+      <smack permit="System::TEF" type="w"/>
+      <smack permit="_" type="w"/>
+    </permit>
+  </define>
+    <define>
+    <domain name="System::Privilege::AppDebugging" policy="shared"/>
+    <request>
+      <smack request="User" type="w"/>
+      <smack request="User::Shell" type="w"/>
+      <smack request="System" type="w"/>
+      <smack request="System::Privileged" type="w"/>
+      <smack request="System::TEF" type="w"/>
+      <smack request="_" type="w"/>
+    </request>
+    <permit>
+      <smack permit="User" type="w"/>
+      <smack permit="User::Shell" type="w"/>
+      <smack permit="System" type="w"/>
+      <smack permit="System::Privileged" type="w"/>
+      <smack permit="System::TEF" type="w"/>
+      <smack permit="_" type="w"/>
+    </permit>
+  </define>
   <define>
     <domain name="System::Privileged" policy="shared"/>
     <request>