| type cros_conntrackd, domain, chromeos_domain; | |
| permissive cros_conntrackd; | |
| from_minijail_static(cros_conntrackd, cros_conntrackd_exec); | |
| log_writer(cros_conntrackd); | |
| allow cros_conntrackd self:capability { net_admin }; | |
| allow cros_conntrackd self:netlink_netfilter_socket create_socket_perms_no_ioctl; | |
| filetrans_pattern(cros_conntrackd, cros_run_lock, cros_conntrackd_lock_file, file); |