netbpfload.rc - directly exec apex netbpfload
(instead of going via platform symlink to it)
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I5ae8105525733788b62f2866fc4eedcce3f51085
diff --git a/netbpfload/Android.bp b/netbpfload/Android.bp
index 2b603fc..c39b46c 100644
--- a/netbpfload/Android.bp
+++ b/netbpfload/Android.bp
@@ -19,27 +19,15 @@
}
install_symlink {
- name: "platform_ethtool_symlink",
+ name: "mainline_tethering_platform_components",
+
symlink_target: "/apex/com.android.tethering/bin/ethtool",
// installed_location is relative to /system because that's the default partition for soong
// modules, unless we add something like `system_ext_specific: true` like in hwservicemanager.
installed_location: "bin/ethtool",
-}
-install_symlink {
- name: "platform_netbpfload_symlink",
- symlink_target: "/apex/com.android.tethering/bin/netbpfload",
- installed_location: "bin/netbpfload",
init_rc: ["netbpfload.rc"],
-}
-
-phony {
- name: "mainline_tethering_platform_components",
- required: [
- "bpfloader",
- "platform_ethtool_symlink",
- "platform_netbpfload_symlink",
- ],
+ required: ["bpfloader"],
}
cc_binary {
diff --git a/netbpfload/netbpfload.rc b/netbpfload/netbpfload.rc
index 14181dc..e1af47f 100644
--- a/netbpfload/netbpfload.rc
+++ b/netbpfload/netbpfload.rc
@@ -17,15 +17,18 @@
on load_bpf_programs
exec_start bpfloader
-service bpfloader /system/bin/netbpfload
+# Note: This will actually execute /apex/com.android.tethering/bin/netbpfload
+# by virtue of 'service bpfloader' being overridden by the apex shipped .rc
+# Warning: most of the below settings are irrelevant unless the apex is missing.
+service bpfloader /system/bin/false
# netbpfload will do network bpf loading, then execute /system/bin/bpfloader
- capabilities CHOWN SYS_ADMIN NET_ADMIN
+ #! capabilities CHOWN SYS_ADMIN NET_ADMIN
# The following group memberships are a workaround for lack of DAC_OVERRIDE
# and allow us to open (among other things) files that we created and are
# no longer root owned (due to CHOWN) but still have group read access to
# one of the following groups. This is not perfect, but a more correct
# solution requires significantly more effort to implement.
- group root graphics network_stack net_admin net_bw_acct net_bw_stats net_raw system
+ #! group root graphics network_stack net_admin net_bw_acct net_bw_stats net_raw system
user root
#
# Set RLIMIT_MEMLOCK to 1GiB for bpfloader
@@ -55,7 +58,7 @@
#
# As such we simply use 1GiB as a reasonable approximation of infinity.
#
- rlimit memlock 1073741824 1073741824
+ #! rlimit memlock 1073741824 1073741824
oneshot
#
# How to debug bootloops caused by 'bpfloader-failed'.
@@ -81,6 +84,5 @@
# 'cannot prove return value is 0 or 1' or 'unsupported / unknown operation / helper',
# 'invalid bpf_context access', etc.
#
- reboot_on_failure reboot,bpfloader-failed
- # we're not really updatable, but want to be able to load bpf programs shipped in apexes
+ reboot_on_failure reboot,netbpfload-missing
updatable