Move pf_key socket creation permission to netd
Allow netd to trigger the kernel synchronize rcu with open and close
pf_key socket. This action was previously done by system_server but now
it need to be done by netd instead because there might be race issue
when netd is operating on a map that is cleaned up by system server.
Bug: 126620214
Test: android.app.usage.cts.NetworkUsageStatsTest
android.net.cts.TrafficStatsTest
Change-Id: Id5ca86aa4610e37a2752709ed9cfd4536ea3bfaf
diff --git a/private/netd.te b/private/netd.te
index a00cb69..4c129b7 100644
--- a/private/netd.te
+++ b/private/netd.te
@@ -12,6 +12,10 @@
# the map created by bpfloader
allow netd bpfloader:bpf { prog_run map_read map_write };
+# in order to invoke side effect of close() on such a socket calling synchronize_rcu()
+# TODO: Remove this permission when 4.9 kernel is deprecated.
+allow netd self:key_socket create;
+
get_prop(netd, bpf_progs_loaded_prop)
# Allow netd to write to statsd.
diff --git a/private/system_server.te b/private/system_server.te
index 9b986b1..68a8f55 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -879,10 +879,6 @@
allow system_server fs_bpf:dir search;
allow system_server fs_bpf:file { read write };
allow system_server bpfloader:bpf { map_read map_write };
-# in order to invoke side effect of close() on such a socket calling synchronize_rcu()
-# TODO: Remove this permission when 4.9 kernel is deprecated.
-allow system_server self:key_socket create;
-
# ART Profiles.
# Allow system_server to open profile snapshots for read.