dscpPolicy: lock down bpf cache map
(since this map relies on percpu access semantics,
and we don't even have userspace helpers to access PERCPU_ maps)
This will also be used by the upcoming satellite egress limiting logic.
See aosp/3235142
With this change we see:
$ adbz shell ls -lZ /sys/fs/bpf/net_shared/*_dscpPolicy_*
-rw-rw---- 1 root system u:object_r:fs_bpf_net_shared:s0 0 2024-09-04 17:01 /sys/fs/bpf/net_shared/map_dscpPolicy_ipv4_dscp_policies_map
-rw-rw---- 1 root system u:object_r:fs_bpf_net_shared:s0 0 2024-09-04 17:01 /sys/fs/bpf/net_shared/map_dscpPolicy_ipv6_dscp_policies_map
---------- 1 root root u:object_r:fs_bpf_loader:s0 0 2024-09-04 17:01 /sys/fs/bpf/net_shared/map_dscpPolicy_socket_policy_cache_map
-r--r----- 1 root system u:object_r:fs_bpf_net_shared:s0 0 2024-09-04 17:01 /sys/fs/bpf/net_shared/prog_dscpPolicy_schedcls_set_dscp_ether
Test: TreeHugger, atest CtsNetTestCases:android.net.cts.DscpPolicyTest
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I50a12ca4cd5587342f8aaf9df8cb28917f555252
3 files changed