tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/bpfloader.te

31 lines
1.3 KiB
Text
Raw Normal View History

Add sepolicy to lock down bpf access Add a new set of sepolicy for the process that only netd use to load and run ebpf programs. It is the only process that can load eBPF programs into the kernel and is only used to do that. Add some neverallow rules regarding which processes have access to bpf objects. Test: program successfully loaded and pinned at sys/fs/bpf after device boot. No selinux violation for bpfloader Bug: 30950746 Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f
2018-01-03 00:31:18 +01:00
# bpf program loader
type bpfloader, domain;
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type bpfloader_exec, system_file_type, exec_type, file_type;
Add sepolicy to lock down bpf access Add a new set of sepolicy for the process that only netd use to load and run ebpf programs. It is the only process that can load eBPF programs into the kernel and is only used to do that. Add some neverallow rules regarding which processes have access to bpf objects. Test: program successfully loaded and pinned at sys/fs/bpf after device boot. No selinux violation for bpfloader Bug: 30950746 Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f
2018-01-03 00:31:18 +01:00
typeattribute bpfloader coredomain;
# These permission is required for pin bpf program for netd.
allow bpfloader fs_bpf:dir create_dir_perms;
allow bpfloader fs_bpf:file create_file_perms;
allow bpfloader devpts:chr_file { read write };
Use bpfloader to create bpf maps instead of netd Recent change in netd and bpfloader switched the creater of bpf maps from netd to bpfloader. Change the rules related to it to make sure it doesn't fail. Test: dumpsys netd trafficcontroller Bug: 112334572 Change-Id: I016ff68b58ef7b12bdfdebc2fd178be1d0206a62
2018-12-05 02:57:27 +01:00
# Allow bpfloader to create bpf maps and programs. The map_read and map_write permission is needed
# for retrieving a pinned map when bpfloader do a run time restart.
allow bpfloader self:bpf { prog_load prog_run map_read map_write map_create };
Add sepolicy to lock down bpf access Add a new set of sepolicy for the process that only netd use to load and run ebpf programs. It is the only process that can load eBPF programs into the kernel and is only used to do that. Add some neverallow rules regarding which processes have access to bpf objects. Test: program successfully loaded and pinned at sys/fs/bpf after device boot. No selinux violation for bpfloader Bug: 30950746 Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f
2018-01-03 00:31:18 +01:00
grant bpfloader CAP_CHOWN so that it can change the uid/gid of pinned bpf progs and maps Test: build, atest Bug: 149434314 Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I1d873c7799e1d9fa5d4bde145e89254dabb75a01
2020-01-27 16:10:40 +01:00
allow bpfloader self:capability { chown sys_admin };
Strengthen ptrace neverallow rules Add additional compile time constraints on the ability to ptrace various sensitive domains. llkd: remove some domains which llkd should never ptrace, even on debuggable builds, such as kernel threads and init. crash_dump neverallows: Remove the ptrace neverallow checks because it duplicates other neverallow assertions spread throughout the policy. Test: policy compiles and device boots Change-Id: Ia4240d1ce7143b983bb048e046bb4729d0af5a6e
2018-09-13 20:07:14 +02:00
###
### Neverallow rules
###
selinux - netd - tighten down bpf policy bpf programs/maps are now loaded by the bpfloader, not netd Test: built/installed on crosshatch which uses eBPF - no avc denials Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I1ebd82e6730d62d1966da3c4634ecd78ce703543
2019-04-09 06:34:53 +02:00
neverallow { domain -bpfloader } *:bpf { map_create prog_load };
Allow system_server to attach bpf programs to tracepoints In order to track time in state data using eBPF, system_server needs to be able to attach BPF programs to tracepoints, which involves: - calling perf_event_open and the PERF_EVENT_IOC_SET_BPF ioctl - running BPF programs - reading tracepoint ids from tracefs Grant system_server the necessary permissions for these tasks Test: modify system_server to try to attach programs; check for denials Bug: 138317993 Change-Id: I07dafd325a9c57d53767a09d4ca7b0fb2dd2d328 Signed-off-by: Connor O'Brien <connoro@google.com>
2020-01-15 00:45:55 +01:00
neverallow { domain -bpfloader -netd -netutils_wrapper -system_server } *:bpf prog_run;
Allow executing bpfloader from init and modify rules init needs to execute bpfloader as a one-shot service. Add sepolicy for the same. Also update old rules allowing init to fork/exec bpfloader and remove rules allowing netd to do so. Bug: 112334572 Change-Id: Ic242cd507731ed8af3f8e94d4fccc95819831d37 Signed-off-by: Joel Fernandes <joelaf@google.com>
2018-11-29 22:07:40 +01:00
neverallow { domain -bpfloader -init } bpfloader_exec:file { execute execute_no_trans };
Add sepolicy to lock down bpf access Add a new set of sepolicy for the process that only netd use to load and run ebpf programs. It is the only process that can load eBPF programs into the kernel and is only used to do that. Add some neverallow rules regarding which processes have access to bpf objects. Test: program successfully loaded and pinned at sys/fs/bpf after device boot. No selinux violation for bpfloader Bug: 30950746 Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f
2018-01-03 00:31:18 +01:00
neverallow bpfloader domain:{ tcp_socket udp_socket rawip_socket } *;
# only system_server, netd and bpfloader can read/write the bpf maps
Use bpfloader to create bpf maps instead of netd Recent change in netd and bpfloader switched the creater of bpf maps from netd to bpfloader. Change the rules related to it to make sure it doesn't fail. Test: dumpsys netd trafficcontroller Bug: 112334572 Change-Id: I016ff68b58ef7b12bdfdebc2fd178be1d0206a62
2018-12-05 02:57:27 +01:00
neverallow { domain -system_server -netd -bpfloader} *:bpf { map_read map_write };
Hide bpfloader sys_admin denials. Bug: 79524845 Test: Boot device and see no denials. Change-Id: I9316bfd0e3718818a7613a421aedff7da8c87108
2018-05-23 17:36:40 +02:00
Strengthen ptrace neverallow rules Add additional compile time constraints on the ability to ptrace various sensitive domains. llkd: remove some domains which llkd should never ptrace, even on debuggable builds, such as kernel threads and init. crash_dump neverallows: Remove the ptrace neverallow checks because it duplicates other neverallow assertions spread throughout the policy. Test: policy compiles and device boots Change-Id: Ia4240d1ce7143b983bb048e046bb4729d0af5a6e
2018-09-13 20:07:14 +02:00
# No domain should be allowed to ptrace bpfloader
neverallow { domain userdebug_or_eng(`-llkd') } bpfloader:process ptrace;
Add permissions for bpf.progs_loaded property Change-Id: If4e550e4186415c5a1088bb53b0755b69f92560a Signed-off-by: Joel Fernandes <joelaf@google.com>
2019-01-11 14:32:45 +01:00
set_prop(bpfloader, bpf_progs_loaded_prop)
Reference in a new issue Copy permalink