tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/bpfloader.te

31 lines
1.3 KiB
Text
Raw Normal View History

Add sepolicy to lock down bpf access Add a new set of sepolicy for the process that only netd use to load and run ebpf programs. It is the only process that can load eBPF programs into the kernel and is only used to do that. Add some neverallow rules regarding which processes have access to bpf objects. Test: program successfully loaded and pinned at sys/fs/bpf after device boot. No selinux violation for bpfloader Bug: 30950746 Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f
2018-01-03 00:31:18 +01:00
# bpf program loader
type bpfloader, domain;
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type bpfloader_exec, system_file_type, exec_type, file_type;
Add sepolicy to lock down bpf access Add a new set of sepolicy for the process that only netd use to load and run ebpf programs. It is the only process that can load eBPF programs into the kernel and is only used to do that. Add some neverallow rules regarding which processes have access to bpf objects. Test: program successfully loaded and pinned at sys/fs/bpf after device boot. No selinux violation for bpfloader Bug: 30950746 Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f
2018-01-03 00:31:18 +01:00
typeattribute bpfloader coredomain;
# These permission is required for pin bpf program for netd.
allow bpfloader fs_bpf:dir create_dir_perms;
allow bpfloader fs_bpf:file create_file_perms;
allow bpfloader devpts:chr_file { read write };
Use bpfloader to create bpf maps instead of netd Recent change in netd and bpfloader switched the creater of bpf maps from netd to bpfloader. Change the rules related to it to make sure it doesn't fail. Test: dumpsys netd trafficcontroller Bug: 112334572 Change-Id: I016ff68b58ef7b12bdfdebc2fd178be1d0206a62
2018-12-05 02:57:27 +01:00
# Allow bpfloader to create bpf maps and programs. The map_read and map_write permission is needed
# for retrieving a pinned map when bpfloader do a run time restart.
allow bpfloader self:bpf { prog_load prog_run map_read map_write map_create };
Add sepolicy to lock down bpf access Add a new set of sepolicy for the process that only netd use to load and run ebpf programs. It is the only process that can load eBPF programs into the kernel and is only used to do that. Add some neverallow rules regarding which processes have access to bpf objects. Test: program successfully loaded and pinned at sys/fs/bpf after device boot. No selinux violation for bpfloader Bug: 30950746 Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f
2018-01-03 00:31:18 +01:00
Assign bpfloader with CAP_SYS_ADMIN bpfloader needs to load bpf programs with tracepoints in them. The tracepoint programs are not activated but are just loaded and pinned. The kernel expects the process doing this to have CAP_SYS_ADMIN. Since bpfloader was intended to be a 1-shot run and exit process with security privileges, lets assign it CAP_SYS_ADMIN so that it is able to load the tracepoint programs. Bug: 112334572 Change-Id: Icf9b5d95615e69f5c28dc28f021b07f49710c97d Signed-off-by: Joel Fernandes <joelaf@google.com>
2018-11-28 20:06:49 +01:00
allow bpfloader self:global_capability_class_set sys_admin;
Strengthen ptrace neverallow rules Add additional compile time constraints on the ability to ptrace various sensitive domains. llkd: remove some domains which llkd should never ptrace, even on debuggable builds, such as kernel threads and init. crash_dump neverallows: Remove the ptrace neverallow checks because it duplicates other neverallow assertions spread throughout the policy. Test: policy compiles and device boots Change-Id: Ia4240d1ce7143b983bb048e046bb4729d0af5a6e
2018-09-13 20:07:14 +02:00
###
### Neverallow rules
###
selinux - netd - tighten down bpf policy bpf programs/maps are now loaded by the bpfloader, not netd Test: built/installed on crosshatch which uses eBPF - no avc denials Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I1ebd82e6730d62d1966da3c4634ecd78ce703543
2019-04-09 06:34:53 +02:00
neverallow { domain -bpfloader } *:bpf { map_create prog_load };
neverallow { domain -bpfloader -netd -netutils_wrapper } *:bpf prog_run;
Allow executing bpfloader from init and modify rules init needs to execute bpfloader as a one-shot service. Add sepolicy for the same. Also update old rules allowing init to fork/exec bpfloader and remove rules allowing netd to do so. Bug: 112334572 Change-Id: Ic242cd507731ed8af3f8e94d4fccc95819831d37 Signed-off-by: Joel Fernandes <joelaf@google.com>
2018-11-29 22:07:40 +01:00
neverallow { domain -bpfloader -init } bpfloader_exec:file { execute execute_no_trans };
Add sepolicy to lock down bpf access Add a new set of sepolicy for the process that only netd use to load and run ebpf programs. It is the only process that can load eBPF programs into the kernel and is only used to do that. Add some neverallow rules regarding which processes have access to bpf objects. Test: program successfully loaded and pinned at sys/fs/bpf after device boot. No selinux violation for bpfloader Bug: 30950746 Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f
2018-01-03 00:31:18 +01:00
neverallow bpfloader domain:{ tcp_socket udp_socket rawip_socket } *;
# only system_server, netd and bpfloader can read/write the bpf maps
Use bpfloader to create bpf maps instead of netd Recent change in netd and bpfloader switched the creater of bpf maps from netd to bpfloader. Change the rules related to it to make sure it doesn't fail. Test: dumpsys netd trafficcontroller Bug: 112334572 Change-Id: I016ff68b58ef7b12bdfdebc2fd178be1d0206a62
2018-12-05 02:57:27 +01:00
neverallow { domain -system_server -netd -bpfloader} *:bpf { map_read map_write };
Hide bpfloader sys_admin denials. Bug: 79524845 Test: Boot device and see no denials. Change-Id: I9316bfd0e3718818a7613a421aedff7da8c87108
2018-05-23 17:36:40 +02:00
Strengthen ptrace neverallow rules Add additional compile time constraints on the ability to ptrace various sensitive domains. llkd: remove some domains which llkd should never ptrace, even on debuggable builds, such as kernel threads and init. crash_dump neverallows: Remove the ptrace neverallow checks because it duplicates other neverallow assertions spread throughout the policy. Test: policy compiles and device boots Change-Id: Ia4240d1ce7143b983bb048e046bb4729d0af5a6e
2018-09-13 20:07:14 +02:00
# No domain should be allowed to ptrace bpfloader
neverallow { domain userdebug_or_eng(`-llkd') } bpfloader:process ptrace;
Add permissions for bpf.progs_loaded property Change-Id: If4e550e4186415c5a1088bb53b0755b69f92560a Signed-off-by: Joel Fernandes <joelaf@google.com>
2019-01-11 14:32:45 +01:00
set_prop(bpfloader, bpf_progs_loaded_prop)
Reference in a new issue Copy permalink