tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/bpfloader.te

31 lines
1.3 KiB
Text
Raw Normal View History

Add sepolicy to lock down bpf access Add a new set of sepolicy for the process that only netd use to load and run ebpf programs. It is the only process that can load eBPF programs into the kernel and is only used to do that. Add some neverallow rules regarding which processes have access to bpf objects. Test: program successfully loaded and pinned at sys/fs/bpf after device boot. No selinux violation for bpfloader Bug: 30950746 Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f
2018-01-03 00:31:18 +01:00
# bpf program loader
type bpfloader, domain;
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type bpfloader_exec, system_file_type, exec_type, file_type;
Add sepolicy to lock down bpf access Add a new set of sepolicy for the process that only netd use to load and run ebpf programs. It is the only process that can load eBPF programs into the kernel and is only used to do that. Add some neverallow rules regarding which processes have access to bpf objects. Test: program successfully loaded and pinned at sys/fs/bpf after device boot. No selinux violation for bpfloader Bug: 30950746 Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f
2018-01-03 00:31:18 +01:00
typeattribute bpfloader coredomain;
# These permission is required for pin bpf program for netd.
allow bpfloader fs_bpf:dir create_dir_perms;
allow bpfloader fs_bpf:file create_file_perms;
allow bpfloader devpts:chr_file { read write };
Use bpfloader to create bpf maps instead of netd Recent change in netd and bpfloader switched the creater of bpf maps from netd to bpfloader. Change the rules related to it to make sure it doesn't fail. Test: dumpsys netd trafficcontroller Bug: 112334572 Change-Id: I016ff68b58ef7b12bdfdebc2fd178be1d0206a62
2018-12-05 02:57:27 +01:00
# Allow bpfloader to create bpf maps and programs. The map_read and map_write permission is needed
# for retrieving a pinned map when bpfloader do a run time restart.
allow bpfloader self:bpf { prog_load prog_run map_read map_write map_create };
Add sepolicy to lock down bpf access Add a new set of sepolicy for the process that only netd use to load and run ebpf programs. It is the only process that can load eBPF programs into the kernel and is only used to do that. Add some neverallow rules regarding which processes have access to bpf objects. Test: program successfully loaded and pinned at sys/fs/bpf after device boot. No selinux violation for bpfloader Bug: 30950746 Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f
2018-01-03 00:31:18 +01:00
Assign bpfloader with CAP_SYS_ADMIN bpfloader needs to load bpf programs with tracepoints in them. The tracepoint programs are not activated but are just loaded and pinned. The kernel expects the process doing this to have CAP_SYS_ADMIN. Since bpfloader was intended to be a 1-shot run and exit process with security privileges, lets assign it CAP_SYS_ADMIN so that it is able to load the tracepoint programs. Bug: 112334572 Change-Id: Icf9b5d95615e69f5c28dc28f021b07f49710c97d Signed-off-by: Joel Fernandes <joelaf@google.com>
2018-11-28 20:06:49 +01:00
allow bpfloader self:global_capability_class_set sys_admin;
Strengthen ptrace neverallow rules Add additional compile time constraints on the ability to ptrace various sensitive domains. llkd: remove some domains which llkd should never ptrace, even on debuggable builds, such as kernel threads and init. crash_dump neverallows: Remove the ptrace neverallow checks because it duplicates other neverallow assertions spread throughout the policy. Test: policy compiles and device boots Change-Id: Ia4240d1ce7143b983bb048e046bb4729d0af5a6e
2018-09-13 20:07:14 +02:00
###
### Neverallow rules
###
Allow netd to setup xt_bpf iptable rules To better record the network traffic stats for each network interface. We use xt_bpf netfilter module to do the iface stats accounting instead of the cgroup bpf filter we currently use for per uid stats accounting. The xt_bpf module will take pinned eBPF program as iptables rule and run the program when packet pass through the netfilter hook. To setup the iptables rules. netd need to be able to access bpf filesystem and run the bpf program at boot time. The program used will still be created and pinned by the bpfloader process. Test: With selinux enforced, run "iptables -L -t raw" should show the xt_bpf related rule present in bw_raw_PREROUTING chain. Bug: 72111305 Change-Id: I11efe158d6bd5499df6adf15e8123a76cd67de04 (cherry picked from aosp commit 5c95c1684119604a8fccf0f264459b21ce214b9b)
2018-03-20 23:42:44 +01:00
neverallow { domain -bpfloader } *:bpf prog_load;
Allow netutils_wrapper to use pinned bpf program The netutils_wrapper is a process used by vendor code to update the iptable rules on devices. When it update the rules for a specific chain. The iptable module will reload the whole chain with the new rule. So even the netutils_wrapper do not need to add any rules related to xt_bpf module, it will still reloading the existing iptables rules about xt_bpf module and need pass through the selinux check again when the rules are reloading. So we have to grant it the permission to reuse the pinned program in fs_bpf when it modifies the corresponding iptables chain so the vendor module will not crash anymore. Test: device boot and no more denials from netutils_wrapper Bug: 72111305 Change-Id: I62bdfd922c8194c61b13e2855839aee3f1e349be (cherry picked from aosp commit 2623ebcf8e658f538a0ecf4b139bbd32dfd28b98)
2018-03-29 01:51:26 +02:00
neverallow { domain -bpfloader -netd -netutils_wrapper} *:bpf prog_run;
Allow executing bpfloader from init and modify rules init needs to execute bpfloader as a one-shot service. Add sepolicy for the same. Also update old rules allowing init to fork/exec bpfloader and remove rules allowing netd to do so. Bug: 112334572 Change-Id: Ic242cd507731ed8af3f8e94d4fccc95819831d37 Signed-off-by: Joel Fernandes <joelaf@google.com>
2018-11-29 22:07:40 +01:00
neverallow { domain -bpfloader -init } bpfloader_exec:file { execute execute_no_trans };
Add sepolicy to lock down bpf access Add a new set of sepolicy for the process that only netd use to load and run ebpf programs. It is the only process that can load eBPF programs into the kernel and is only used to do that. Add some neverallow rules regarding which processes have access to bpf objects. Test: program successfully loaded and pinned at sys/fs/bpf after device boot. No selinux violation for bpfloader Bug: 30950746 Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f
2018-01-03 00:31:18 +01:00
neverallow bpfloader domain:{ tcp_socket udp_socket rawip_socket } *;
# only system_server, netd and bpfloader can read/write the bpf maps
Use bpfloader to create bpf maps instead of netd Recent change in netd and bpfloader switched the creater of bpf maps from netd to bpfloader. Change the rules related to it to make sure it doesn't fail. Test: dumpsys netd trafficcontroller Bug: 112334572 Change-Id: I016ff68b58ef7b12bdfdebc2fd178be1d0206a62
2018-12-05 02:57:27 +01:00
neverallow { domain -system_server -netd -bpfloader} *:bpf { map_read map_write };
Hide bpfloader sys_admin denials. Bug: 79524845 Test: Boot device and see no denials. Change-Id: I9316bfd0e3718818a7613a421aedff7da8c87108
2018-05-23 17:36:40 +02:00
Strengthen ptrace neverallow rules Add additional compile time constraints on the ability to ptrace various sensitive domains. llkd: remove some domains which llkd should never ptrace, even on debuggable builds, such as kernel threads and init. crash_dump neverallows: Remove the ptrace neverallow checks because it duplicates other neverallow assertions spread throughout the policy. Test: policy compiles and device boots Change-Id: Ia4240d1ce7143b983bb048e046bb4729d0af5a6e
2018-09-13 20:07:14 +02:00
# No domain should be allowed to ptrace bpfloader
neverallow { domain userdebug_or_eng(`-llkd') } bpfloader:process ptrace;
Add permissions for bpf.progs_loaded property Change-Id: If4e550e4186415c5a1088bb53b0755b69f92560a Signed-off-by: Joel Fernandes <joelaf@google.com>
2019-01-11 14:32:45 +01:00
set_prop(bpfloader, bpf_progs_loaded_prop)
Reference in a new issue Copy permalink