tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/bpfloader.te

67 lines
3.7 KiB
Text
Raw Normal View History

Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type bpfloader_exec, system_file_type, exec_type, file_type;
Add sepolicy to lock down bpf access Add a new set of sepolicy for the process that only netd use to load and run ebpf programs. It is the only process that can load eBPF programs into the kernel and is only used to do that. Add some neverallow rules regarding which processes have access to bpf objects. Test: program successfully loaded and pinned at sys/fs/bpf after device boot. No selinux violation for bpfloader Bug: 30950746 Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f
2018-01-03 00:31:18 +01:00
bpfdomain: attribute for domain which can use BPF Require all domains which can be used for BPF to be marked as bpfdomain, and add a restriction for these domains to not be able to use net_raw or net_admin. We want to make sure the network stack has exclusive access to certain BPF attach points. Bug: 140330870 Bug: 162057235 Test: build (compile-time neverallows) Change-Id: I29100e48a757fdcf600931d5eb42988101275325
2022-02-10 01:32:44 +01:00
typeattribute bpfloader bpfdomain;
bpfloader: use kernel logs Boots early. logd no workie! Bug: 210919187 Test: see bpfloader logs Change-Id: I313f55b0a6e1164fdffeb2d07952988d5e560ae7
2022-02-08 00:15:00 +01:00
# allow bpfloader to write to the kernel log (starts early)
allow bpfloader kmsg_device:chr_file w_file_perms;
cut down bpf related privileges This is driven by 3 things: - netd no longer needs setattr, since this is now done by bpfloader - nothing should ever unpin maps or programs - generic cleanups and additional neverallows Test: build, atest Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I881cc8bf9fe062aaff709727406c5a51fc363c8e
2020-01-31 07:08:43 +01:00
# These permissions are required to pin ebpf maps & programs.
bpfloader: allow bpffs_type:dir setattr we have CAP_CHOWN but we can't use it to custom configure directory uid/gid. Test: TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I41bdab8d5b7b4cfc5cdc568909c9c6b9947e2bca
2024-03-15 00:40:54 +01:00
allow bpfloader bpffs_type:dir { add_name create remove_name search setattr write };
selinux: allow bpfloader bpffs_type:file getattr (to be able to stat() nodes in /sys/fs/bpf) Test: TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: Ic71ebea683844a8d5ac0b542da815bae2816973a
2022-07-02 03:20:01 +02:00
allow bpfloader bpffs_type:file { create getattr read rename setattr };
allow bpfloader to create symbolic links in /sys/fs/bpf (this is to allow /sys/fs/bpf/tethering -> net_shared/tethering for InProcessTethering, ie. Android Go devices) Bug: 190523685 Bug: 236925089 Test: TreeHugger, manually on aosp_cf_x86_go_phone-userdebug Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: Ifa52429f958b0af80f91af6bfb064c1cdf9cd070
2022-07-18 12:34:30 +02:00
allow bpfloader bpffs_type:lnk_file { create getattr read };
much more finegrained bpf selinux privs for networking mainline Goal is to gain a better handle on who has access to which maps and to allow (with bpfloader changes to create in one directory and move into the target directory) per-map selection of selinux context, while still having reasonable defaults for stuff pinned directly into the target location. BPFFS (ie. /sys/fs/bpf) labelling is as follows: subdirectory selinux context mainline usecase / usable by / fs_bpf no (*) core operating system (ie. platform) /net_private fs_bpf_net_private yes, T+ network_stack /net_shared fs_bpf_net_shared yes, T+ network_stack & system_server /netd_readonly fs_bpf_netd_readonly yes, T+ network_stack & system_server & r/o to netd /netd_shared fs_bpf_netd_shared yes, T+ network_stack & system_server & netd [**] /tethering fs_bpf_tethering yes, S+ network_stack /vendor fs_bpf_vendor no, T+ vendor * initial support for bpf was added back in P, but things worked differently back then with no bpfloader, and instead netd doing stuff by hand, bpfloader with pinning into /sys/fs/bpf was (I believe) added in Q (and was definitely there in R) ** additionally bpf programs are accesible to netutils_wrapper for use by iptables xt_bpf extensions 'mainline yes' currently means shipped by the com.android.tethering apex, but this is really another case of bad naming, as it's really the 'networking/connectivity/tethering' apex / mainline module. Long term the plan is to merge a few other networking mainline modules into it (and maybe give it a saner name...). The reason for splitting net_private vs tethering is that: S+ must support 4.9+ kernels and S era bpfloader v0.2+ T+ must support 4.14+ kernels and T beta3 era bpfloader v0.13+ The kernel affects the intelligence of the in-kernel bpf verifier and the available bpf helper functions. Older kernels have a tendency to reject programs that newer kernels allow. / && /vendor are not shipped via mainline, so only need to work with the bpfloader that's part of the core os. Bug: 218408035 Test: TreeHugger, manually on cuttlefish Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I674866ebe32aca4fc851818c1ffcbec12ac4f7d4 (cherry picked from commit 15715aea32b85c933778b97a46de6ccab42ca7fb)
2022-05-21 14:03:29 +02:00
allow { bpffs_type -fs_bpf } fs_bpf:filesystem associate;
Add sepolicy to lock down bpf access Add a new set of sepolicy for the process that only netd use to load and run ebpf programs. It is the only process that can load eBPF programs into the kernel and is only used to do that. Add some neverallow rules regarding which processes have access to bpf objects. Test: program successfully loaded and pinned at sys/fs/bpf after device boot. No selinux violation for bpfloader Bug: 30950746 Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f
2018-01-03 00:31:18 +01:00
cut down bpf related privileges This is driven by 3 things: - netd no longer needs setattr, since this is now done by bpfloader - nothing should ever unpin maps or programs - generic cleanups and additional neverallows Test: build, atest Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I881cc8bf9fe062aaff709727406c5a51fc363c8e
2020-01-31 07:08:43 +01:00
# Allow bpfloader to create bpf maps and programs.
allow bpfloader self:bpf { map_create map_read map_write prog_load prog_run };
Add sepolicy to lock down bpf access Add a new set of sepolicy for the process that only netd use to load and run ebpf programs. It is the only process that can load eBPF programs into the kernel and is only used to do that. Add some neverallow rules regarding which processes have access to bpf objects. Test: program successfully loaded and pinned at sys/fs/bpf after device boot. No selinux violation for bpfloader Bug: 30950746 Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f
2018-01-03 00:31:18 +01:00
grant bpfloader NET_ADMIN capability This is required for it to be able to create DEVMAP/DEVMAP_HASH maps. See kernel source code in kernel/bpf/devmap.c: static struct bpf_map *dev_map_alloc(union bpf_attr *attr) { ... if (!capable(CAP_NET_ADMIN)) return ERR_PTR(-EPERM); Test: atest, TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I2fc5b1541133859857fc9baa7564965f240c842a
2021-03-02 08:16:46 +01:00
allow bpfloader self:capability { chown sys_admin net_admin };
Strengthen ptrace neverallow rules Add additional compile time constraints on the ability to ptrace various sensitive domains. llkd: remove some domains which llkd should never ptrace, even on debuggable builds, such as kernel threads and init. crash_dump neverallows: Remove the ptrace neverallow checks because it duplicates other neverallow assertions spread throughout the policy. Test: policy compiles and device boots Change-Id: Ia4240d1ce7143b983bb048e046bb4729d0af5a6e
2018-09-13 20:07:14 +02:00
Allow bpfloader to read fuse's bpf_prog number Bug: 202785178 Test: Along with rest of topic, file /sys/fs/bpf/prog_fuse_media_fuse_media appears on boot with fuse-bpf in kernel Merged-In: Ibccdf177c75fef0314c86319be3f0b0f249ce59d Change-Id: Ibccdf177c75fef0314c86319be3f0b0f249ce59d
2021-11-12 01:53:26 +01:00
allow bpfloader sysfs_fs_fuse_bpf:file r_file_perms;
bpfloader: allowing reading proc_bpf:file (so we can check if we need to change it) Test: TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I229a772ec6ecebcd8826730af568980f578842ee
2024-03-14 11:47:30 +01:00
allow bpfloader proc_bpf:file rw_file_perms;
sepolicy - move proc bpf writes from bpfloader.rc to bpfloader binary As a reminder, per: https://source.corp.google.com/search?q=p:aosp-master%20file:sepolicy%20-file:prebuilts%20proc_bpf%20file:genfs we currently have: aosp-master system/sepolicy/private/genfs_contexts genfscon proc /sys/kernel/bpf_ u:object_r:proc_bpf:s0 genfscon proc /sys/kernel/unprivileged_bpf_ u:object_r:proc_bpf:s0 genfscon proc /sys/net/core/bpf_ u:object_r:proc_bpf:s0 So the above are the files which will no longer be writable by init. A cs/ search for p:android$ (/sys/kernel/bpf_|/sys/kernel/unprivileged_bpf_|/sys/net/core/bpf_) file:[.]rc only finds bpfloader.rc init script as actually doing these writes. Those writes are removed in: https://android-review.git.corp.google.com/c/platform/system/bpf/+/2325617 'bpfloader - move sysctl setting from rc to binary' Test: TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I19ccdf293966dd982e1d36836b0b962d99ed7275
2022-12-03 13:19:31 +01:00
apply 'fs_bpf_tethering' label to /sys/fs/bpf/tethering We want to label /sys/fs/bpf/tethering/... with a new label distinct from /sys/fs/bpf, as this will allow locking down the programs/maps tighter then is currently possible with the existing system. These programs and maps are provided via the tethering mainline module, and as such their number, names, key/value types, etc. are all prone to be changed by a tethering mainline module update. Test: atest, TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: Ifc4108d76a1106a936b941a3dda1abc5a65c05b0
2021-01-29 23:36:32 +01:00
set_prop(bpfloader, bpf_progs_loaded_prop)
Allow bpfloader to execute btfloader btfloader is a standalone binary that receives a path to a bpf .o file from bpfloader, parses & loads the BTF type info from the file, passes BTF info back to bpfloader & exits. Include it in bpfloader's domain & grant bpfloader permission to run it. Bug: 203823368 Test: build & boot, bpfloader successfully executes btfloader Signed-off-by: Connor O'Brien <connoro@google.com> Change-Id: Ia08776a90763a8477d9f3e393d5d723b88a3176f
2022-01-19 07:57:41 +01:00
allow bpfloader bpfloader_exec:file execute_no_trans;
Strengthen ptrace neverallow rules Add additional compile time constraints on the ability to ptrace various sensitive domains. llkd: remove some domains which llkd should never ptrace, even on debuggable builds, such as kernel threads and init. crash_dump neverallows: Remove the ptrace neverallow checks because it duplicates other neverallow assertions spread throughout the policy. Test: policy compiles and device boots Change-Id: Ia4240d1ce7143b983bb048e046bb4729d0af5a6e
2018-09-13 20:07:14 +02:00
###
### Neverallow rules
###
cut down bpf related privileges This is driven by 3 things: - netd no longer needs setattr, since this is now done by bpfloader - nothing should ever unpin maps or programs - generic cleanups and additional neverallows Test: build, atest Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I881cc8bf9fe062aaff709727406c5a51fc363c8e
2020-01-31 07:08:43 +01:00
remove init/vendor_init access to bpffs_type There should be no need for this and it fixes a long outstanding TODO. Test: TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: Id1764cbc713addbbda6827fe6c6689e45e8f584c
2022-12-01 15:45:35 +01:00
# Note: we don't care about getattr/mounton/search
bpfloader: allow bpffs_type:dir setattr we have CAP_CHOWN but we can't use it to custom configure directory uid/gid. Test: TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I41bdab8d5b7b4cfc5cdc568909c9c6b9947e2bca
2024-03-15 00:40:54 +01:00
neverallow { domain } bpffs_type:dir ~{ add_name create getattr mounton remove_name search setattr write };
neverallow { domain -bpfloader } bpffs_type:dir { add_name create remove_name setattr write };
cut down bpf related privileges This is driven by 3 things: - netd no longer needs setattr, since this is now done by bpfloader - nothing should ever unpin maps or programs - generic cleanups and additional neverallows Test: build, atest Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I881cc8bf9fe062aaff709727406c5a51fc363c8e
2020-01-31 07:08:43 +01:00
bpf - neverallow improvements/cleanups Test: TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I569d88bcfa0089d13d23dfeda111bf3584cad2c0
2022-12-03 10:13:05 +01:00
neverallow { domain } bpffs_type:file ~{ create getattr map open read rename setattr write };
netd/netutils_wrapper/network_stack/system_server - allow getattr on bpf progs/maps This is so that we can potentially verify that things are setup right. Test: TreeHugger Bug: 275209284 Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I59a49cbece2710345fff0b2fb98e32f4e5f3af44
2023-03-28 03:14:40 +02:00
neverallow { domain -bpfloader } bpffs_type:file { create map open rename setattr };
neverallow { domain -bpfloader -gpuservice -lmkd -mediaprovider_app -netd -netutils_wrapper -system_server } fs_bpf:file { getattr read };
neverallow { domain -bpfloader } fs_bpf_loader:file { getattr read };
neverallow { domain -bpfloader -network_stack } fs_bpf_net_private:file { getattr read };
neverallow { domain -bpfloader -network_stack -system_server } fs_bpf_net_shared:file { getattr read };
neverallow { domain -bpfloader -netd -network_stack -system_server } fs_bpf_netd_readonly:file { getattr read };
neverallow { domain -bpfloader -netd -netutils_wrapper -network_stack -system_server } fs_bpf_netd_shared:file { getattr read };
neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:file { getattr read };
Rename uprobe_private to uprobestats for BPFs. There will not be separate private/public BPF directories. All BPFs will be under a uprobestats/ directory. Bug: 296108553 Test: m selinux_policy Change-Id: I00934cb14ead44c457ccee6957763dc01370dac6
2024-01-16 23:02:59 +01:00
neverallow { domain -bpfloader -uprobestats } fs_bpf_uprobestats:file { getattr read };
lmkd: Add sepolicy rules around bpf for lmkd LMKD needs to be able to attach BPF tracepoints. It needs to be able to access tracefs, attach and run bpf programs. Test: m Test: Verified no denials with lmkd and libmemevents integration Bug: 244232958 Change-Id: I57248b729c0f011937bec139930ca9d24ba91c3b Signed-off-by: Carlos Galo <carlosgalo@google.com>
2024-03-12 21:04:41 +01:00
neverallow { domain -bpfloader -gpuservice -lmkd -netd -netutils_wrapper -network_stack -system_server -uprobestats } { bpffs_type -fs_bpf_vendor }:file write;
cut down bpf related privileges This is driven by 3 things: - netd no longer needs setattr, since this is now done by bpfloader - nothing should ever unpin maps or programs - generic cleanups and additional neverallows Test: build, atest Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I881cc8bf9fe062aaff709727406c5a51fc363c8e
2020-01-31 07:08:43 +01:00
allow bpfloader to create symbolic links in /sys/fs/bpf (this is to allow /sys/fs/bpf/tethering -> net_shared/tethering for InProcessTethering, ie. Android Go devices) Bug: 190523685 Bug: 236925089 Test: TreeHugger, manually on aosp_cf_x86_go_phone-userdebug Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: Ifa52429f958b0af80f91af6bfb064c1cdf9cd070
2022-07-18 12:34:30 +02:00
neverallow { domain -bpfloader } bpffs_type:lnk_file ~read;
neverallow { domain -bpfdomain } bpffs_type:lnk_file read;
allow non bpfloader creation of bpf maps In practice only bpf programs are critical to device security... Normally there is basically no use for creating bpf maps outside of the bpfloader, since they have to be tied directly into the bpf programs (which is only ever done by the bpfloader during the boot process) to be of any use. This means that bpf maps created after the bpfloader is done, can't actually be used by any bpf code... Hence we had this restriction. However, map-in-map support changes this: It becomes possible to define a boot-time (bpfloader loaded) bpf program which accesses an (initially empty) outer map (created by the bpfloader). This outer map can be populated with inner maps at run time by various bpf using userspace code. While it can be populated with bpfloader created 'static' maps, it also makes sense to be able to create/destroy these inner maps on demand 'dynamically'. This allows bpf map memory utilization to be driven by actual runtime device needs. For example scaling with the number of users, apps, or connected networks. Test: TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I93223c660463596c9e50065be819e2fd865da923
2023-06-14 05:44:48 +02:00
neverallow { domain -bpfloader } *:bpf prog_load;
neverallow { domain -bpfdomain } *:bpf { map_create map_read map_write prog_run };
bpf - neverallow improvements/cleanups Test: TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I569d88bcfa0089d13d23dfeda111bf3584cad2c0
2022-12-03 10:13:05 +01:00
# 'fs_bpf_loader' is for internal use of the BpfLoader oneshot boot time process.
add fs_bpf_loader selinux type To be used for things that only the bpfloader should be access. Expected use case is for programs that the bpfloader should load, pin into the filesystem, *and* attach. [ie. no need for anything else to attach the programs] Test: TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I035d3fcbf6cee523e41cdde23b8edc13311a45e8
2022-12-01 15:45:35 +01:00
neverallow { domain -bpfloader } fs_bpf_loader:bpf *;
bpf - neverallow improvements/cleanups Test: TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I569d88bcfa0089d13d23dfeda111bf3584cad2c0
2022-12-03 10:13:05 +01:00
neverallow { domain -bpfloader } fs_bpf_loader:file *;
Allow BPF programs from vendor. Who needs all those context switches? bpfloader controls which types of vendor programs can be used. Bug: 140330870 Bug: 162057235 Test: successfully load bpf programs from vendor Change-Id: I36e4f6550da33fea5bad509470dfd39f301f13c8
2019-12-14 00:18:32 +01:00
Allow executing bpfloader from init and modify rules init needs to execute bpfloader as a one-shot service. Add sepolicy for the same. Also update old rules allowing init to fork/exec bpfloader and remove rules allowing netd to do so. Bug: 112334572 Change-Id: Ic242cd507731ed8af3f8e94d4fccc95819831d37 Signed-off-by: Joel Fernandes <joelaf@google.com>
2018-11-29 22:07:40 +01:00
neverallow { domain -bpfloader -init } bpfloader_exec:file { execute execute_no_trans };
cut down bpf related privileges This is driven by 3 things: - netd no longer needs setattr, since this is now done by bpfloader - nothing should ever unpin maps or programs - generic cleanups and additional neverallows Test: build, atest Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I881cc8bf9fe062aaff709727406c5a51fc363c8e
2020-01-31 07:08:43 +01:00
sepolicy: allow netutils_wrapper access to fs_bpf_vendor This is needed to allow vendor xt_bpf programs. Test: TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I7ff8a0319bec2f3a57c7ce48939b13b2fca182de
2023-11-18 04:36:05 +01:00
neverallow { coredomain -bpfloader -netd -netutils_wrapper } fs_bpf_vendor:file *;
Allow BPF programs from vendor. Who needs all those context switches? bpfloader controls which types of vendor programs can be used. Bug: 140330870 Bug: 162057235 Test: successfully load bpf programs from vendor Change-Id: I36e4f6550da33fea5bad509470dfd39f301f13c8
2019-12-14 00:18:32 +01:00
apply 'fs_bpf_tethering' label to /sys/fs/bpf/tethering We want to label /sys/fs/bpf/tethering/... with a new label distinct from /sys/fs/bpf, as this will allow locking down the programs/maps tighter then is currently possible with the existing system. These programs and maps are provided via the tethering mainline module, and as such their number, names, key/value types, etc. are all prone to be changed by a tethering mainline module update. Test: atest, TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: Ifc4108d76a1106a936b941a3dda1abc5a65c05b0
2021-01-29 23:36:32 +01:00
neverallow bpfloader *:{ tcp_socket udp_socket rawip_socket } *;
Hide bpfloader sys_admin denials. Bug: 79524845 Test: Boot device and see no denials. Change-Id: I9316bfd0e3718818a7613a421aedff7da8c87108
2018-05-23 17:36:40 +02:00
Strengthen ptrace neverallow rules Add additional compile time constraints on the ability to ptrace various sensitive domains. llkd: remove some domains which llkd should never ptrace, even on debuggable builds, such as kernel threads and init. crash_dump neverallows: Remove the ptrace neverallow checks because it duplicates other neverallow assertions spread throughout the policy. Test: policy compiles and device boots Change-Id: Ia4240d1ce7143b983bb048e046bb4729d0af5a6e
2018-09-13 20:07:14 +02:00
# No domain should be allowed to ptrace bpfloader
neverallow { domain userdebug_or_eng(`-llkd') } bpfloader:process ptrace;
introduce new 'proc_bpf' for bpf related sysctls What to tag chosen based on output of: find /proc 2>/dev/null | egrep bpf on a 5.10 kernel. Tagged with prefixes to be more likely not require changes in the future $ adb root $ adb shell 'ls -lZ /proc/sys/net/core/bpf_* /proc/sys/kernel/*bpf*' Before: -rw-r--r-- 1 root root u:object_r:proc:s0 0 2021-11-11 02:11 /proc/sys/kernel/bpf_stats_enabled -rw-r--r-- 1 root root u:object_r:proc:s0 0 2021-11-11 02:11 /proc/sys/kernel/unprivileged_bpf_disabled -rw-r--r-- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_enable -rw------- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_harden -rw------- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_kallsyms -rw------- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_limit After: -rw-r--r-- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/kernel/bpf_stats_enabled -rw-r--r-- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/kernel/unprivileged_bpf_disabled -rw-r--r-- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_enable -rw------- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_harden -rw------- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_kallsyms -rw------- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_limit Test: TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I46ea81ff42d3b915cf7a96735dc2636d9808ead6
2021-11-11 10:51:15 +01:00
sepolicy - move proc bpf writes from bpfloader.rc to bpfloader binary As a reminder, per: https://source.corp.google.com/search?q=p:aosp-master%20file:sepolicy%20-file:prebuilts%20proc_bpf%20file:genfs we currently have: aosp-master system/sepolicy/private/genfs_contexts genfscon proc /sys/kernel/bpf_ u:object_r:proc_bpf:s0 genfscon proc /sys/kernel/unprivileged_bpf_ u:object_r:proc_bpf:s0 genfscon proc /sys/net/core/bpf_ u:object_r:proc_bpf:s0 So the above are the files which will no longer be writable by init. A cs/ search for p:android$ (/sys/kernel/bpf_|/sys/kernel/unprivileged_bpf_|/sys/net/core/bpf_) file:[.]rc only finds bpfloader.rc init script as actually doing these writes. Those writes are removed in: https://android-review.git.corp.google.com/c/platform/system/bpf/+/2325617 'bpfloader - move sysctl setting from rc to binary' Test: TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I19ccdf293966dd982e1d36836b0b962d99ed7275
2022-12-03 13:19:31 +01:00
neverallow { domain -bpfloader } proc_bpf:file write;
Reference in a new issue Copy permalink