| Chenbo Feng | 566411e | 2018-01-02 15:31:18 -0800 | [diff] [blame] | 1 | # bpf program loader |
| 2 | type bpfloader, domain; |
| Nick Kralevich | 5e37271 | 2018-09-27 10:21:37 -0700 | [diff] [blame] | 3 | type bpfloader_exec, system_file_type, exec_type, file_type; |
| Chenbo Feng | 566411e | 2018-01-02 15:31:18 -0800 | [diff] [blame] | 4 | typeattribute bpfloader coredomain; |
| 5 | |
| Chenbo Feng | 566411e | 2018-01-02 15:31:18 -0800 | [diff] [blame] | 6 | # These permission is required for pin bpf program for netd. |
| 7 | allow bpfloader fs_bpf:dir create_dir_perms; |
| 8 | allow bpfloader fs_bpf:file create_file_perms; |
| 9 | allow bpfloader devpts:chr_file { read write }; |
| 10 | |
| Chenbo Feng | 7b57104 | 2018-12-04 17:57:27 -0800 | [diff] [blame] | 11 | # Allow bpfloader to create bpf maps and programs. The map_read and map_write permission is needed |
| 12 | # for retrieving a pinned map when bpfloader do a run time restart. |
| 13 | allow bpfloader self:bpf { prog_load prog_run map_read map_write map_create }; |
| Chenbo Feng | 566411e | 2018-01-02 15:31:18 -0800 | [diff] [blame] | 14 | |
| Maciej Żenczykowski | 1189fac | 2020-01-27 07:10:40 -0800 | [diff] [blame] | 15 | allow bpfloader self:capability { chown sys_admin }; |
| Nick Kralevich | 095fbea | 2018-09-13 11:07:14 -0700 | [diff] [blame] | 16 | |
| 17 | ### |
| 18 | ### Neverallow rules |
| 19 | ### |
| Maciej Żenczykowski | 487fcb8 | 2019-04-08 21:34:53 -0700 | [diff] [blame] | 20 | neverallow { domain -bpfloader } *:bpf { map_create prog_load }; |
| Connor O'Brien | e3f0b2c | 2020-01-14 15:45:55 -0800 | [diff] [blame] | 21 | neverallow { domain -bpfloader -netd -netutils_wrapper -system_server } *:bpf prog_run; |
| Joel Fernandes | 147cf64 | 2018-11-29 13:07:40 -0800 | [diff] [blame] | 22 | neverallow { domain -bpfloader -init } bpfloader_exec:file { execute execute_no_trans }; |
| Chenbo Feng | 566411e | 2018-01-02 15:31:18 -0800 | [diff] [blame] | 23 | neverallow bpfloader domain:{ tcp_socket udp_socket rawip_socket } *; |
| 24 | # only system_server, netd and bpfloader can read/write the bpf maps |
| Chenbo Feng | 7b57104 | 2018-12-04 17:57:27 -0800 | [diff] [blame] | 25 | neverallow { domain -system_server -netd -bpfloader} *:bpf { map_read map_write }; |
| Joel Galenson | d65f26f | 2018-05-23 08:36:40 -0700 | [diff] [blame] | 26 | |
| Nick Kralevich | 095fbea | 2018-09-13 11:07:14 -0700 | [diff] [blame] | 27 | # No domain should be allowed to ptrace bpfloader |
| 28 | neverallow { domain userdebug_or_eng(`-llkd') } bpfloader:process ptrace; |
| Joel Fernandes | b76a639 | 2019-01-11 08:32:45 -0500 | [diff] [blame] | 29 | |
| 30 | set_prop(bpfloader, bpf_progs_loaded_prop) |