tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Allow netutils_wrapper to use pinned bpf program"

Browse source
This commit is contained in:
Treehugger Robot 2018-03-30 20:03:19 +00:00 committed by Gerrit Code Review
commit 4fb1a145d1
2 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
private/bpfloader.te
View file

@ -21,7 +21,7 @@ allow bpfloader self:bpf { prog_load prog_run };
# Neverallow rules
neverallow { domain -bpfloader } *:bpf prog_load;
neverallow { domain -bpfloader -netd } *:bpf prog_run;
neverallow { domain -bpfloader -netd -netutils_wrapper} *:bpf prog_run;
neverallow { domain -netd -bpfloader } bpfloader_exec:file { execute execute_no_trans };
neverallow bpfloader domain:{ tcp_socket udp_socket rawip_socket } *;
# only system_server, netd and bpfloader can read/write the bpf maps

7
private/netutils_wrapper.te
View file

@ -18,6 +18,13 @@ allow netutils_wrapper self:netlink_xfrm_socket ~ioctl;
allow netutils_wrapper netd_socket:sock_file { open getattr read write append };
allow netutils_wrapper netd:unix_stream_socket { read getattr connectto };
# For vendor code that update the iptables rules at runtime. They need to reload
# the whole chain including the xt_bpf rules. They need to access to the pinned
# program when reloading the rule.
allow netutils_wrapper fs_bpf:dir search;
allow netutils_wrapper fs_bpf:file { read write };
allow netutils_wrapper bpfloader:bpf prog_run;
# For /data/misc/net access to ndc and ip
r_dir_file(netutils_wrapper, net_data_file)