tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Allow netd to setup xt_bpf iptable rules

Browse source 
To better record the network traffic stats for each network interface.
We use xt_bpf netfilter module to do the iface stats accounting instead
of the cgroup bpf filter we currently use for per uid stats accounting.
The xt_bpf module will take pinned eBPF program as iptables rule and run
the program when packet pass through the netfilter hook. To setup the
iptables rules. netd need to be able to access bpf filesystem and run the
bpf program at boot time. The program used will still be created and
pinned by the bpfloader process.

Test: With selinux enforced, run "iptables -L -t raw" should show the
xt_bpf related rule present in bw_raw_PREROUTING chain.
Bug: 72111305

Change-Id: I11efe158d6bd5499df6adf15e8123a76cd67de04
(cherry picked from aosp commit 5c95c16841)
This commit is contained in:
Chenbo Feng 2018-03-20 15:42:44 -07:00
parent 2867f5c3fa
commit 68ef8c070e
2 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
private/bpfloader.te
View file

@ -20,7 +20,8 @@ allow bpfloader netd:bpf { map_read map_write };
allow bpfloader self:bpf { prog_load prog_run }; allow bpfloader self:bpf { prog_load prog_run };
# Neverallow rules # Neverallow rules
neverallow { domain -bpfloader } *:bpf { prog_load prog_run }; neverallow { domain -bpfloader } *:bpf prog_load;
neverallow { domain -bpfloader -netd } *:bpf prog_run;
neverallow { domain -netd -bpfloader } bpfloader_exec:file { execute execute_no_trans }; neverallow { domain -netd -bpfloader } bpfloader_exec:file { execute execute_no_trans };
neverallow bpfloader domain:{ tcp_socket udp_socket rawip_socket } *; neverallow bpfloader domain:{ tcp_socket udp_socket rawip_socket } *;
# only system_server, netd and bpfloader can read/write the bpf maps # only system_server, netd and bpfloader can read/write the bpf maps

3
private/netd.te
View file

@ -10,3 +10,6 @@ domain_auto_trans(netd, clatd_exec, clatd)
# Allow netd to start bpfloader_exec in its own domain # Allow netd to start bpfloader_exec in its own domain
domain_auto_trans(netd, bpfloader_exec, bpfloader) domain_auto_trans(netd, bpfloader_exec, bpfloader)
# give netd permission to setup iptables rule with xt_bpf
allow netd bpfloader:bpf prog_run;