6598175e06
Require all domains which can be used for BPF to be marked as bpfdomain, and add a restriction for these domains to not be able to use net_raw or net_admin. We want to make sure the network stack has exclusive access to certain BPF attach points. Bug: 140330870 Bug: 162057235 Test: build (compile-time neverallows) Change-Id: I29100e48a757fdcf600931d5eb42988101275325
19 lines
476 B
Text
19 lines
476 B
Text
typeattribute lmkd coredomain;
|
|
typeattribute lmkd bpfdomain;
|
|
|
|
init_daemon_domain(lmkd)
|
|
|
|
# Set sys.lmk.* properties.
|
|
set_prop(lmkd, system_lmk_prop)
|
|
|
|
# Set lmkd.* properties.
|
|
set_prop(lmkd, lmkd_prop)
|
|
|
|
# Get persist.device_config.lmk_native.* properties.
|
|
get_prop(lmkd, device_config_lmkd_native_prop)
|
|
|
|
allow lmkd fs_bpf:dir search;
|
|
allow lmkd fs_bpf:file read;
|
|
allow lmkd bpfloader:bpf map_read;
|
|
|
|
neverallow { domain -init -lmkd -vendor_init } lmkd_prop:property_service set;
|