tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/bpfloader.te

41 lines
1.5 KiB
Text
Raw Normal View History

Add sepolicy to lock down bpf access Add a new set of sepolicy for the process that only netd use to load and run ebpf programs. It is the only process that can load eBPF programs into the kernel and is only used to do that. Add some neverallow rules regarding which processes have access to bpf objects. Test: program successfully loaded and pinned at sys/fs/bpf after device boot. No selinux violation for bpfloader Bug: 30950746 Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f
2018-01-03 00:31:18 +01:00
# bpf program loader
type bpfloader, domain;
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type bpfloader_exec, system_file_type, exec_type, file_type;
Add sepolicy to lock down bpf access Add a new set of sepolicy for the process that only netd use to load and run ebpf programs. It is the only process that can load eBPF programs into the kernel and is only used to do that. Add some neverallow rules regarding which processes have access to bpf objects. Test: program successfully loaded and pinned at sys/fs/bpf after device boot. No selinux violation for bpfloader Bug: 30950746 Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f
2018-01-03 00:31:18 +01:00
typeattribute bpfloader coredomain;
cut down bpf related privileges This is driven by 3 things: - netd no longer needs setattr, since this is now done by bpfloader - nothing should ever unpin maps or programs - generic cleanups and additional neverallows Test: build, atest Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I881cc8bf9fe062aaff709727406c5a51fc363c8e
2020-01-31 07:08:43 +01:00
# These permissions are required to pin ebpf maps & programs.
allow bpfloader fs_bpf:dir { search write add_name };
allow bpfloader fs_bpf:file { create setattr };
Add sepolicy to lock down bpf access Add a new set of sepolicy for the process that only netd use to load and run ebpf programs. It is the only process that can load eBPF programs into the kernel and is only used to do that. Add some neverallow rules regarding which processes have access to bpf objects. Test: program successfully loaded and pinned at sys/fs/bpf after device boot. No selinux violation for bpfloader Bug: 30950746 Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f
2018-01-03 00:31:18 +01:00
cut down bpf related privileges This is driven by 3 things: - netd no longer needs setattr, since this is now done by bpfloader - nothing should ever unpin maps or programs - generic cleanups and additional neverallows Test: build, atest Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I881cc8bf9fe062aaff709727406c5a51fc363c8e
2020-01-31 07:08:43 +01:00
# Allow bpfloader to create bpf maps and programs.
allow bpfloader self:bpf { map_create map_read map_write prog_load prog_run };
Add sepolicy to lock down bpf access Add a new set of sepolicy for the process that only netd use to load and run ebpf programs. It is the only process that can load eBPF programs into the kernel and is only used to do that. Add some neverallow rules regarding which processes have access to bpf objects. Test: program successfully loaded and pinned at sys/fs/bpf after device boot. No selinux violation for bpfloader Bug: 30950746 Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f
2018-01-03 00:31:18 +01:00
grant bpfloader CAP_CHOWN so that it can change the uid/gid of pinned bpf progs and maps Test: build, atest Bug: 149434314 Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I1d873c7799e1d9fa5d4bde145e89254dabb75a01
2020-01-27 16:10:40 +01:00
allow bpfloader self:capability { chown sys_admin };
Strengthen ptrace neverallow rules Add additional compile time constraints on the ability to ptrace various sensitive domains. llkd: remove some domains which llkd should never ptrace, even on debuggable builds, such as kernel threads and init. crash_dump neverallows: Remove the ptrace neverallow checks because it duplicates other neverallow assertions spread throughout the policy. Test: policy compiles and device boots Change-Id: Ia4240d1ce7143b983bb048e046bb4729d0af5a6e
2018-09-13 20:07:14 +02:00
###
### Neverallow rules
###
cut down bpf related privileges This is driven by 3 things: - netd no longer needs setattr, since this is now done by bpfloader - nothing should ever unpin maps or programs - generic cleanups and additional neverallows Test: build, atest Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I881cc8bf9fe062aaff709727406c5a51fc363c8e
2020-01-31 07:08:43 +01:00
# TODO: get rid of init & vendor_init
neverallow { domain -init -vendor_init } fs_bpf:dir setattr;
neverallow { domain -bpfloader } fs_bpf:dir { write add_name };
neverallow domain fs_bpf:dir { reparent rename rmdir };
# TODO: get rid of init & vendor_init
neverallow { domain -bpfloader -init -vendor_init } fs_bpf:file setattr;
neverallow { domain -bpfloader } fs_bpf:file create;
neverallow domain fs_bpf:file { rename unlink };
selinux - netd - tighten down bpf policy bpf programs/maps are now loaded by the bpfloader, not netd Test: built/installed on crosshatch which uses eBPF - no avc denials Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I1ebd82e6730d62d1966da3c4634ecd78ce703543
2019-04-09 06:34:53 +02:00
neverallow { domain -bpfloader } *:bpf { map_create prog_load };
Allow system_server to attach bpf programs to tracepoints In order to track time in state data using eBPF, system_server needs to be able to attach BPF programs to tracepoints, which involves: - calling perf_event_open and the PERF_EVENT_IOC_SET_BPF ioctl - running BPF programs - reading tracepoint ids from tracefs Grant system_server the necessary permissions for these tasks Test: modify system_server to try to attach programs; check for denials Bug: 138317993 Change-Id: I07dafd325a9c57d53767a09d4ca7b0fb2dd2d328 Signed-off-by: Connor O'Brien <connoro@google.com>
2020-01-15 00:45:55 +01:00
neverallow { domain -bpfloader -netd -netutils_wrapper -system_server } *:bpf prog_run;
cut down bpf related privileges This is driven by 3 things: - netd no longer needs setattr, since this is now done by bpfloader - nothing should ever unpin maps or programs - generic cleanups and additional neverallows Test: build, atest Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I881cc8bf9fe062aaff709727406c5a51fc363c8e
2020-01-31 07:08:43 +01:00
neverallow { domain -bpfloader -netd -system_server } *:bpf { map_read map_write };
Allow executing bpfloader from init and modify rules init needs to execute bpfloader as a one-shot service. Add sepolicy for the same. Also update old rules allowing init to fork/exec bpfloader and remove rules allowing netd to do so. Bug: 112334572 Change-Id: Ic242cd507731ed8af3f8e94d4fccc95819831d37 Signed-off-by: Joel Fernandes <joelaf@google.com>
2018-11-29 22:07:40 +01:00
neverallow { domain -bpfloader -init } bpfloader_exec:file { execute execute_no_trans };
cut down bpf related privileges This is driven by 3 things: - netd no longer needs setattr, since this is now done by bpfloader - nothing should ever unpin maps or programs - generic cleanups and additional neverallows Test: build, atest Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I881cc8bf9fe062aaff709727406c5a51fc363c8e
2020-01-31 07:08:43 +01:00
Add sepolicy to lock down bpf access Add a new set of sepolicy for the process that only netd use to load and run ebpf programs. It is the only process that can load eBPF programs into the kernel and is only used to do that. Add some neverallow rules regarding which processes have access to bpf objects. Test: program successfully loaded and pinned at sys/fs/bpf after device boot. No selinux violation for bpfloader Bug: 30950746 Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f
2018-01-03 00:31:18 +01:00
neverallow bpfloader domain:{ tcp_socket udp_socket rawip_socket } *;
Hide bpfloader sys_admin denials. Bug: 79524845 Test: Boot device and see no denials. Change-Id: I9316bfd0e3718818a7613a421aedff7da8c87108
2018-05-23 17:36:40 +02:00
Strengthen ptrace neverallow rules Add additional compile time constraints on the ability to ptrace various sensitive domains. llkd: remove some domains which llkd should never ptrace, even on debuggable builds, such as kernel threads and init. crash_dump neverallows: Remove the ptrace neverallow checks because it duplicates other neverallow assertions spread throughout the policy. Test: policy compiles and device boots Change-Id: Ia4240d1ce7143b983bb048e046bb4729d0af5a6e
2018-09-13 20:07:14 +02:00
# No domain should be allowed to ptrace bpfloader
neverallow { domain userdebug_or_eng(`-llkd') } bpfloader:process ptrace;
Add permissions for bpf.progs_loaded property Change-Id: If4e550e4186415c5a1088bb53b0755b69f92560a Signed-off-by: Joel Fernandes <joelaf@google.com>
2019-01-11 14:32:45 +01:00
set_prop(bpfloader, bpf_progs_loaded_prop)
Reference in a new issue Copy permalink