tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

sepolicy: Allow system server to r/w the bpf maps

Browse source 
The system server is responsible for providing the network traffic
stats to Apps and services. Allow it to directly reading the eBPF maps
that stored these information can make the process of getting traffic
stats simplier.

Test: No selinux rule violation of system server reading netd bpf object
Bug: 30950746
Change-Id: I6d9438d1ed7c9bab45a708f5d2a85eb22f5e8170
This commit is contained in:
Chenbo Feng 2017-11-21 10:53:01 -08:00
parent 08f92f9c01
commit 756dd574d5
1 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
private/system_server.te
View file

@ -725,6 +725,11 @@ with_asan(`
allow system_server zygote_exec:file rx_file_perms;
')
# allow system_server to read the eBPF maps that stores the traffic stats information amd clean up
# the map after snapshot is recorded
allow system_server fs_bpf:file write;
allow system_server netd:bpf { map_read map_write };
# ART Profiles.
# Allow system_server to open profile snapshots for read.
# System server never reads the actual content. It passes the descriptor to