commit 4b63ce9dd0f4401f0a431f022e40835431dd2a79
author Yiwei Zhang <zzyiwei@google.com> Tue Feb 18 22:58:26 2020 -0800
committer Yiwei Zhang <zzyiwei@google.com> Wed Jun 03 11:23:16 2020 -0700
tree 57e41a69084f951dd60f6badfbde622dcac00b6c
parent 85d87cfa6eb808b424f89f41269a3d63586df707

GPU Memory: add sepolicy rules around bpf for gpuservice

1. Allow gpuservice to access tracepoint id
2. Allow gpuservice to access bpf program
3. Allow gpuservice to attach bpf program to tracepoint
4. Allow gpuservice to access bpf filesystem
5. Allow gpuservice to run bpf program and read map through bpfloader
6. Allow gpuservice to check a property to ensure bpf program loaded

Bug: 136023082
Test: adb shell dumpsys gpu --gpumem
Change-Id: Ic808a7e452b71c54908cdff806f41f51ab66ffd8

private/bpfloader.te

diff --git a/private/bpfloader.te b/private/bpfloader.te
index 249f3df..b31fe18 100644
--- a/private/bpfloader.te
+++ b/private/bpfloader.te
@@ -27,8 +27,8 @@
 neverallow domain fs_bpf:file { rename unlink };
 
 neverallow { domain -bpfloader } *:bpf { map_create prog_load };
-neverallow { domain -bpfloader -netd -netutils_wrapper -system_server } *:bpf prog_run;
-neverallow { domain -bpfloader -netd -system_server } *:bpf { map_read map_write };
+neverallow { domain -bpfloader -gpuservice -netd -netutils_wrapper -system_server } *:bpf prog_run;
+neverallow { domain -bpfloader -gpuservice -netd -system_server } *:bpf { map_read map_write };
 
 neverallow { domain -bpfloader -init } bpfloader_exec:file { execute execute_no_trans };
 

private/coredomain.te

diff --git a/private/coredomain.te b/private/coredomain.te
index 32a1e3f..c20cce4 100644
--- a/private/coredomain.te
+++ b/private/coredomain.te
@@ -131,6 +131,7 @@
     coredomain
     -atrace
     -dumpstate
+    -gpuservice
     -init
     -traced_probes
     -shell

private/genfs_contexts

diff --git a/private/genfs_contexts b/private/genfs_contexts
index d4d7fff..de1edd9 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -246,6 +246,7 @@
 genfscon tracefs /events/task/task_rename/                               u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/task/task_newtask/                              u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/ftrace/print/                                   u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/gpu_mem/gpu_mem_total                           u:object_r:debugfs_tracing:s0
 
 genfscon debugfs /tracing/trace_clock                                            u:object_r:debugfs_tracing:s0
 genfscon debugfs /tracing/buffer_size_kb                                         u:object_r:debugfs_tracing:s0

private/gpuservice.te

diff --git a/private/gpuservice.te b/private/gpuservice.te
index a4d84ea..31ad788 100644
--- a/private/gpuservice.te
+++ b/private/gpuservice.te
@@ -42,6 +42,21 @@
 # TODO(b/146461633): remove this once native pullers talk to StatsManagerService
 binder_call(gpuservice, statsd);
 
+# Needed for reading tracepoint ids in order to attach bpf programs.
+allow gpuservice debugfs_tracing:file r_file_perms;
+allow gpuservice self:perf_event { cpu kernel open write };
+neverallow gpuservice self:perf_event ~{ cpu kernel open write };
+
+# Needed for interact with bpf fs.
+allow gpuservice fs_bpf:dir search;
+allow gpuservice fs_bpf:file read;
+
+# Needed for enable the bpf program and read the map.
+allow gpuservice bpfloader:bpf { map_read prog_run };
+
+# Needed for getting a prop to ensure bpf programs loaded.
+get_prop(gpuservice, bpf_progs_loaded_prop)
+
 add_service(gpuservice, gpu_service)
 
 # Only uncomment below line when in development