introduce new 'proc_bpf' for bpf related sysctls
What to tag chosen based on output of:
find /proc 2>/dev/null | egrep bpf
on a 5.10 kernel.
Tagged with prefixes to be more likely not require changes in the future
$ adb root
$ adb shell 'ls -lZ /proc/sys/net/core/bpf_* /proc/sys/kernel/*bpf*'
Before:
-rw-r--r-- 1 root root u:object_r:proc:s0 0 2021-11-11 02:11 /proc/sys/kernel/bpf_stats_enabled
-rw-r--r-- 1 root root u:object_r:proc:s0 0 2021-11-11 02:11 /proc/sys/kernel/unprivileged_bpf_disabled
-rw-r--r-- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_enable
-rw------- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_harden
-rw------- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_kallsyms
-rw------- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_limit
After:
-rw-r--r-- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/kernel/bpf_stats_enabled
-rw-r--r-- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/kernel/unprivileged_bpf_disabled
-rw-r--r-- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_enable
-rw------- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_harden
-rw------- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_kallsyms
-rw------- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_limit
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I46ea81ff42d3b915cf7a96735dc2636d9808ead6
diff --git a/private/bpfloader.te b/private/bpfloader.te
index 343ec7a..25cfda4 100644
--- a/private/bpfloader.te
+++ b/private/bpfloader.te
@@ -41,3 +41,7 @@
# No domain should be allowed to ptrace bpfloader
neverallow { domain userdebug_or_eng(`-llkd') } bpfloader:process ptrace;
+
+# Currently only bpfloader.rc (which runs as init) can do bpf sysctl setup
+# this should perhaps be moved to the bpfloader binary itself. Allow both.
+neverallow { domain -bpfloader -init } proc_bpf:file write;