commit 9a76805ac371eee1ce102f8292b730aa5b6c49a0
author Maciej Żenczykowski <maze@google.com> Sat Dec 03 09:13:05 2022 +0000
committer Maciej Żenczykowski <maze@google.com> Sat Dec 03 12:33:33 2022 +0000
tree 984db237188b3a55b0197c83a52ffa80d12385aa
parent e14e69a947a473ce81f220bae3caea122f5bca97

bpf - neverallow improvements/cleanups

Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I569d88bcfa0089d13d23dfeda111bf3584cad2c0

private/bpfloader.te

diff --git a/private/bpfloader.te b/private/bpfloader.te
index 28c1464..a0a5cfa 100644
--- a/private/bpfloader.te
+++ b/private/bpfloader.te
@@ -27,12 +27,11 @@
 ###
 
 # Note: we don't care about getattr/mounton/search
-neverallow { domain } bpffs_type:dir { open read setattr };
+neverallow { domain            } bpffs_type:dir ~{ add_name create getattr mounton remove_name search write };
 neverallow { domain -bpfloader } bpffs_type:dir { add_name create remove_name write };
-neverallow domain bpffs_type:dir ~{ add_name create getattr mounton open read remove_name search setattr write };
 
-neverallow { domain -bpfloader } bpffs_type:file { map open setattr };
-neverallow { domain -bpfloader } bpffs_type:file { create getattr rename };
+neverallow { domain            } bpffs_type:file ~{ create getattr map open read rename setattr write };
+neverallow { domain -bpfloader } bpffs_type:file { create getattr map open rename setattr };
 neverallow { domain -bpfloader -gpuservice -lmkd -mediaprovider_app -netd -netutils_wrapper                -system_server } fs_bpf:file               read;
 neverallow { domain -bpfloader                                                                                            } fs_bpf_loader:file        read;
 neverallow { domain -bpfloader                                                              -network_stack                } fs_bpf_net_private:file   read;
@@ -41,14 +40,15 @@
 neverallow { domain -bpfloader                                      -netd -netutils_wrapper -network_stack -system_server } fs_bpf_netd_shared:file   read;
 neverallow { domain -bpfloader                                                              -network_stack                } fs_bpf_tethering:file     read;
 neverallow { domain -bpfloader -gpuservice                          -netd -netutils_wrapper -network_stack -system_server } { bpffs_type -fs_bpf_vendor }:file write;
-neverallow domain bpffs_type:file ~{ create getattr map open read rename setattr write };
 
 neverallow { domain -bpfloader } bpffs_type:lnk_file ~read;
 neverallow { domain -bpfdomain } bpffs_type:lnk_file read;
 
 neverallow { domain -bpfloader } *:bpf { map_create prog_load };
+
+# 'fs_bpf_loader' is for internal use of the BpfLoader oneshot boot time process.
 neverallow { domain -bpfloader } fs_bpf_loader:bpf *;
-neverallow { domain -bpfloader } fs_bpf_loader:file open;
+neverallow { domain -bpfloader } fs_bpf_loader:file *;
 
 neverallow {
   domain