tequilaOS/platform_system_bpf
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "execute bpfloader via netbpfload" into main

Browse source
This commit is contained in:
Maciej Żenczykowski 2023-10-21 16:06:44 +00:00 committed by Gerrit Code Review
commit 6b21c10161
1 changed files with 9 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
bpfloader/bpfloader.rc
View file

@ -15,17 +15,17 @@
# considered to have booted successfully. # considered to have booted successfully.
# #
on load_bpf_programs on load_bpf_programs
exec_start netbpfload
exec_start bpfloader exec_start bpfloader
service bpfloader /system/bin/bpfloader service bpfloader /system/bin/netbpfload
capabilities CHOWN SYS_ADMIN # netbpfload will do network bpf loading, then execute /system/bin/bpfloader
capabilities CHOWN SYS_ADMIN NET_ADMIN
# The following group memberships are a workaround for lack of DAC_OVERRIDE # The following group memberships are a workaround for lack of DAC_OVERRIDE
# and allow us to open (among other things) files that we created and are # and allow us to open (among other things) files that we created and are
# no longer root owned (due to CHOWN) but still have group read access to # no longer root owned (due to CHOWN) but still have group read access to
# one of the following groups. This is not perfect, but a more correct # one of the following groups. This is not perfect, but a more correct
# solution requires significantly more effort to implement. # solution requires significantly more effort to implement.
group root graphics system group root graphics network_stack net_admin net_bw_acct net_bw_stats net_raw system
user root user root
# #
# Set RLIMIT_MEMLOCK to 1GiB for bpfloader # Set RLIMIT_MEMLOCK to 1GiB for bpfloader
@ -37,8 +37,9 @@ service bpfloader /system/bin/bpfloader
# memlock data before bpfloader even gets a chance to run, it would fail # memlock data before bpfloader even gets a chance to run, it would fail
# if its memlock rlimit is only 8MiB - since there would be none left for it. # if its memlock rlimit is only 8MiB - since there would be none left for it.
# #
# bpfloader succeeding is critical to system health: # bpfloader succeeding is critical to system health, since a failure will
# the only way to recover is a full kernel reboot. # cause netd crashloop and thus system server crashloop... and the only
# recovery is a full kernel reboot.
# #
# We've had issues where devices would sometimes (rarely) boot into # We've had issues where devices would sometimes (rarely) boot into
# a crashloop because bpfloader would occasionally lose a boot time # a crashloop because bpfloader would occasionally lose a boot time
@ -67,10 +68,10 @@ service bpfloader /system/bin/bpfloader
# 2. comment out 'reboot_on_failure reboot,bpfloader-failed' below # 2. comment out 'reboot_on_failure reboot,bpfloader-failed' below
# 3. rebuild/reflash/reboot # 3. rebuild/reflash/reboot
# 4. as the device is booting up capture bpfloader logs via: # 4. as the device is booting up capture bpfloader logs via:
# adb logcat -s 'bpfloader:*' 'LibBpfLoader:*' # adb logcat -s 'bpfloader:*' 'LibBpfLoader:*' 'NetBpfLoad:*' 'NetBpfLoader:*'
# #
# something like: # something like:
# $ adb reboot; sleep 1; adb wait-for-device; adb root; sleep 1; adb wait-for-device; adb logcat -s 'bpfloader:*' 'LibBpfLoader:*' # $ adb reboot; sleep 1; adb wait-for-device; adb root; sleep 1; adb wait-for-device; adb logcat -s 'bpfloader:*' 'LibBpfLoader:*' 'NetBpfLoad:*' 'NetBpfLoader:*'
# will take care of capturing logs as early as possible # will take care of capturing logs as early as possible
# #
# 5. look through the logs from the kernel's bpf verifier that bpfloader dumps out, # 5. look through the logs from the kernel's bpf verifier that bpfloader dumps out,
@ -83,14 +84,3 @@ service bpfloader /system/bin/bpfloader
reboot_on_failure reboot,bpfloader-failed reboot_on_failure reboot,bpfloader-failed
# we're not really updatable, but want to be able to load bpf programs shipped in apexes # we're not really updatable, but want to be able to load bpf programs shipped in apexes
updatable updatable
# Note: comments for 'bpfloader' from up above also apply here.
# Use: adb logcat -s 'NetBpfLoad:*' 'NetBpfLoader:*'
service netbpfload /system/bin/netbpfload
capabilities CHOWN SYS_ADMIN NET_ADMIN
group root network_stack net_admin net_bw_acct net_bw_stats net_raw system
user root
rlimit memlock 1073741824 1073741824
oneshot
reboot_on_failure reboot,netbpfload-failed
updatable