tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix sepolicy for bpf object

Browse source 
With the new patches backported to 4.9 kernels, the bpf file system now
take the same file open flag as bpf_obj_get. So system server now need
read permission only for both bpf map and fs_bpf since we do not need
system server to edit the map. Also, the netd will always pass stdin
stdout fd to the process forked by it and do allow it will cause the
fork and execev fail. We just allow it pass the fd to bpfloader for now
until we have a better option.

Test: bpfloader start successful on devices with 4.9 kernel.
      run cts -m CtsNetTestCases -t android.net.cts.TrafficStatsTest
Bug: 74096311
Bug: 30950746

Change-Id: I747a51cb05ae495c155e7625a3021fc77f921e0d
This commit is contained in:
Chenbo Feng 2018-03-05 20:43:45 -08:00
parent a6b8414b66
commit 6cd70c2f00
2 changed files with 3 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
private/bpfloader.te
View file

@ -13,8 +13,7 @@ allow bpfloader fs_bpf:dir create_dir_perms;
allow bpfloader fs_bpf:file create_file_perms;
allow bpfloader devpts:chr_file { read write };
# TODO: unknown fd pass denials, need further investigation.
dontaudit bpfloader netd:fd use;
allow bpfloader netd:fd use;
# Use pinned bpf map files from netd.
allow bpfloader netd:bpf { map_read map_write };

4
private/system_server.te
View file

@ -749,8 +749,8 @@ with_asan(`
# allow system_server to read the eBPF maps that stores the traffic stats information amd clean up
# the map after snapshot is recorded
allow system_server fs_bpf:file write;
allow system_server netd:bpf { map_read map_write };
allow system_server fs_bpf:file read;
allow system_server netd:bpf map_read;
# ART Profiles.
# Allow system_server to open profile snapshots for read.