Adjust sepolicy for memevents with lmkd and system_server
Test: Verified memevents integration with LMKD works
Test: Verified memevents integration with AMS works
Bug: 330396528
Change-Id: Id40d427114074d23264a13ad6edbd643f39cdb14
Signed-off-by: Carlos Galo <carlosgalo@google.com>
diff --git a/private/compat/202404/202404.ignore.cil b/private/compat/202404/202404.ignore.cil
index 2b3adc0..dd690bf 100644
--- a/private/compat/202404/202404.ignore.cil
+++ b/private/compat/202404/202404.ignore.cil
@@ -6,8 +6,6 @@
(typeattributeset new_objects
( new_objects
profcollectd_etr_prop
- fs_bpf_lmkd_memevents_rb
- fs_bpf_lmkd_memevents_prog
fstype_prop
binderfs_logs_transactions
binderfs_logs_transaction_history
diff --git a/private/file.te b/private/file.te
index 038e899..aa4298f 100644
--- a/private/file.te
+++ b/private/file.te
@@ -9,6 +9,7 @@
type fs_bpf_netd_shared, fs_type, bpffs_type;
type fs_bpf_loader, fs_type, bpffs_type;
type fs_bpf_uprobestats, fs_type, bpffs_type;
+type fs_bpf_memevents, fs_type, bpffs_type;
# /data/misc/storaged
type storaged_data_file, file_type, data_file_type, core_data_file_type;
diff --git a/private/genfs_contexts b/private/genfs_contexts
index de2b139..d5314b7 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -331,13 +331,11 @@
genfscon bpf / u:object_r:fs_bpf:s0
genfscon bpf /loader u:object_r:fs_bpf_loader:s0
-genfscon bpf /map_bpfMemEvents_lmkd_rb u:object_r:fs_bpf_lmkd_memevents_rb:s0
+genfscon bpf /memevents u:object_r:fs_bpf_memevents:s0
genfscon bpf /net_private u:object_r:fs_bpf_net_private:s0
genfscon bpf /net_shared u:object_r:fs_bpf_net_shared:s0
genfscon bpf /netd_readonly u:object_r:fs_bpf_netd_readonly:s0
genfscon bpf /netd_shared u:object_r:fs_bpf_netd_shared:s0
-genfscon bpf /prog_bpfMemEvents_tracepoint_vmscan_mm_vmscan_direct_reclaim_begin_lmkd u:object_r:fs_bpf_lmkd_memevents_prog:s0
-genfscon bpf /prog_bpfMemEvents_tracepoint_vmscan_mm_vmscan_direct_reclaim_end_lmkd u:object_r:fs_bpf_lmkd_memevents_prog:s0
genfscon bpf /tethering u:object_r:fs_bpf_tethering:s0
genfscon bpf /vendor u:object_r:fs_bpf_vendor:s0
genfscon bpf /uprobestats u:object_r:fs_bpf_uprobestats:s0
diff --git a/private/lmkd.te b/private/lmkd.te
index 5369c79..7eb3899 100644
--- a/private/lmkd.te
+++ b/private/lmkd.te
@@ -19,9 +19,9 @@
allow lmkd fs_bpf:file read;
allow lmkd bpfloader:bpf { map_read map_write prog_run };
-# Needed for polling directly from the bpf ring buffer's fd
-allow lmkd fs_bpf_lmkd_memevents_rb:file { read write };
-allow lmkd fs_bpf_lmkd_memevents_prog:file read;
+# Needed to interact with memevents-eBPF and receive notifications for memory events
+allow lmkd fs_bpf_memevents:file { read write };
+allow lmkd fs_bpf_memevents:dir search;
allow lmkd self:global_capability_class_set { dac_override dac_read_search sys_resource kill };
diff --git a/private/system_server.te b/private/system_server.te
index 0385df3..ac20527 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -1236,6 +1236,10 @@
# calls if (fd.isSocket$()) if (isLingerSocket(fd)) ...
dontaudit system_server self:key_socket getopt;
+# Needed to interact with memevents-eBPF and receive notifications for memory events
+allow system_server fs_bpf_memevents:dir search;
+allow system_server fs_bpf_memevents:file { read write };
+
# Allow system_server to start clatd in its own domain and kill it.
domain_auto_trans(system_server, clatd_exec, clatd)
allow system_server clatd:process { sigkill signal };