tree f268b2f7063d6ad38650df8f80773ebe9acd0413
parent 21ce721bc087d679686acedd06ec7d2b19cad164
author Maciej Żenczykowski <maze@google.com> 1655168166 -0700
committer Maciej Żenczykowski <maze@google.com> 1655174346 -0700

netd.c - reduce privs on maps

Before:
  $ adb shell ls -l /sys/fs/bpf/netd_shared/map_netd_*
  -rw-rw---- 1 root net_bw_acct 0 2022-06-11 08:17 /sys/fs/bpf/netd_shared/map_netd_app_uid_stats_map
  -rw-rw---- 1 root net_bw_acct 0 2022-06-11 08:17 /sys/fs/bpf/netd_shared/map_netd_configuration_map
  -rw-rw---- 1 root net_bw_acct 0 2022-06-11 08:17 /sys/fs/bpf/netd_shared/map_netd_cookie_tag_map
  -rw-rw---- 1 root net_bw_acct 0 2022-06-11 08:17 /sys/fs/bpf/netd_shared/map_netd_iface_index_name_map
  -rw-rw---- 1 root net_bw_acct 0 2022-06-11 08:17 /sys/fs/bpf/netd_shared/map_netd_iface_stats_map
  -rw-rw---- 1 root net_bw_acct 0 2022-06-11 08:17 /sys/fs/bpf/netd_shared/map_netd_stats_map_A
  -rw-rw---- 1 root net_bw_acct 0 2022-06-11 08:17 /sys/fs/bpf/netd_shared/map_netd_stats_map_B
  -rw-rw---- 1 root net_bw_acct 0 2022-06-11 08:17 /sys/fs/bpf/netd_shared/map_netd_uid_counterset_map
  -rw-rw---- 1 root net_bw_acct 0 2022-06-11 08:17 /sys/fs/bpf/netd_shared/map_netd_uid_owner_map
  -rw-rw---- 1 root net_bw_acct 0 2022-06-11 08:17 /sys/fs/bpf/netd_shared/map_netd_uid_permission_map

After:
  $ adb shell ls -l /sys/fs/bpf/netd_shared/map_netd_*
  ----rw---- 1 root net_bw_acct 0 2022-06-13 18:17 /sys/fs/bpf/netd_shared/map_netd_app_uid_stats_map
  -rw-rw---- 1 root net_bw_acct 0 2022-06-13 18:17 /sys/fs/bpf/netd_shared/map_netd_configuration_map
  -rw-rw---- 1 root net_bw_acct 0 2022-06-13 18:17 /sys/fs/bpf/netd_shared/map_netd_cookie_tag_map
  ----rw---- 1 root net_bw_acct 0 2022-06-13 18:17 /sys/fs/bpf/netd_shared/map_netd_iface_index_name_map
  ----rw---- 1 root net_bw_acct 0 2022-06-13 18:17 /sys/fs/bpf/netd_shared/map_netd_iface_stats_map
  -rw-rw---- 1 root net_bw_acct 0 2022-06-13 18:17 /sys/fs/bpf/netd_shared/map_netd_stats_map_A
  -r--rw---- 1 root net_bw_acct 0 2022-06-13 18:17 /sys/fs/bpf/netd_shared/map_netd_stats_map_B
  ----rw---- 1 root net_bw_acct 0 2022-06-13 18:17 /sys/fs/bpf/netd_shared/map_netd_uid_counterset_map
  ----rw---- 1 root net_bw_acct 0 2022-06-13 18:17 /sys/fs/bpf/netd_shared/map_netd_uid_owner_map
  -rw-rw---- 1 root net_bw_acct 0 2022-06-13 18:17 /sys/fs/bpf/netd_shared/map_netd_uid_permission_map

Access required is based on list of maps at netd/BpfHandler.h:62
  BpfMap<uint64_t, UidTagValue> mCookieTagMap;
  BpfMap<StatsKey, StatsValue> mStatsMapA;
  BpfMap<StatsKey, StatsValue> mStatsMapB;
  BpfMap<uint32_t, uint32_t> mConfigurationMap;
  BpfMap<uint32_t, uint8_t> mUidPermissionMap;

Note that this is still just a first stab at things.
The only one which should really be writable is mCookieTagMap,
but that's for follow ups as it gets real difficult to switch
due to the tests and BpfMap vs BpfMapRO inheritance inversion.

Additionally due to netd being root with CAP_DAC_OVERRIDE,
this change is really a no-op, and will be until we add
proper per map selinux contexts.  So it is in a sense only
a documentation of intent change...

Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I86f3028251818c2025503839c7225d07a2943ed0