Gitiles
Code Review Sign In
gerrit.omnirom.org / android_system_sepolicy / 4a960869e088a35068acc82fb6bf25436455abfb / . / private / bpfloader.te
blob: b5865bdb91d5fd73846b779b84076c371b4e1547 [file] [log] [blame]
Nick Kralevich5e372712018-09-27 10:21:37 -0700[diff] [blame]1type bpfloader_exec, system_file_type, exec_type, file_type;
Chenbo Feng566411e2018-01-02 15:31:18 -0800[diff] [blame]2
Steven Moreland65981752022-02-10 00:32:44 +0000[diff] [blame]3typeattribute bpfloader bpfdomain;
4
Steven Moreland233d4aa2022-02-07 23:15:00 +0000[diff] [blame]5# allow bpfloader to write to the kernel log (starts early)
6allow bpfloader kmsg_device:chr_file w_file_perms;
7
Maciej Żenczykowski49c73b02020-01-30 22:08:43 -0800[diff] [blame]8# These permissions are required to pin ebpf maps & programs.
Maciej Żenczykowskib13921c2022-05-21 05:03:29 -0700[diff] [blame]9allow bpfloader bpffs_type:dir { add_name create remove_name search write };
Maciej Żenczykowski1fcf7c82022-07-01 18:20:01 -0700[diff] [blame]10allow bpfloader bpffs_type:file { create getattr read rename setattr };
Maciej Żenczykowskid5098f92022-07-18 03:34:30 -0700[diff] [blame]11allow bpfloader bpffs_type:lnk_file { create getattr read };
Maciej Żenczykowskib13921c2022-05-21 05:03:29 -0700[diff] [blame]12allow { bpffs_type -fs_bpf } fs_bpf:filesystem associate;
Chenbo Feng566411e2018-01-02 15:31:18 -0800[diff] [blame]13
Maciej Żenczykowski49c73b02020-01-30 22:08:43 -0800[diff] [blame]14# Allow bpfloader to create bpf maps and programs.
15allow bpfloader self:bpf { map_create map_read map_write prog_load prog_run };
Chenbo Feng566411e2018-01-02 15:31:18 -0800[diff] [blame]16
Maciej Żenczykowski94c30682021-03-01 23:16:46 -0800[diff] [blame]17allow bpfloader self:capability { chown sys_admin net_admin };
Nick Kralevich095fbea2018-09-13 11:07:14 -0700[diff] [blame]18
Paul Lawrencee3e26b72021-11-12 00:53:26 +0000[diff] [blame]19allow bpfloader sysfs_fs_fuse_bpf:file r_file_perms;
20
Maciej Żenczykowski4a960862022-12-03 12:19:31 +0000[diff] [blame^]21allow bpfloader proc_bpf:file w_file_perms;
22
Maciej Żenczykowskid68cb482021-01-29 14:36:32 -0800[diff] [blame]23set_prop(bpfloader, bpf_progs_loaded_prop)
24
Connor O'Briendbe26842022-01-18 22:57:41 -0800[diff] [blame]25allow bpfloader bpfloader_exec:file execute_no_trans;
26
Nick Kralevich095fbea2018-09-13 11:07:14 -0700[diff] [blame]27###
28### Neverallow rules
29###
Maciej Żenczykowski49c73b02020-01-30 22:08:43 -0800[diff] [blame]30
Maciej Żenczykowskiebb45f92022-12-01 14:45:35 +0000[diff] [blame]31# Note: we don't care about getattr/mounton/search
32neverallow { domain } bpffs_type:dir { open read setattr };
Maciej Żenczykowskib13921c2022-05-21 05:03:29 -0700[diff] [blame]33neverallow { domain -bpfloader } bpffs_type:dir { add_name create remove_name write };
34neverallow domain bpffs_type:dir ~{ add_name create getattr mounton open read remove_name search setattr write };
Maciej Żenczykowski49c73b02020-01-30 22:08:43 -0800[diff] [blame]35
Maciej Żenczykowskiebb45f92022-12-01 14:45:35 +0000[diff] [blame]36neverallow { domain -bpfloader } bpffs_type:file { map open setattr };
Maciej Żenczykowski1fcf7c82022-07-01 18:20:01 -0700[diff] [blame]37neverallow { domain -bpfloader } bpffs_type:file { create getattr rename };
Maciej Żenczykowskiebb45f92022-12-01 14:45:35 +0000[diff] [blame]38neverallow { domain -bpfloader -gpuservice -lmkd -mediaprovider_app -netd -netutils_wrapper -system_server } fs_bpf:file read;
Maciej Żenczykowskie14e69a2022-12-01 14:45:35 +0000[diff] [blame]39neverallow { domain -bpfloader } fs_bpf_loader:file read;
Maciej Żenczykowskiebb45f92022-12-01 14:45:35 +0000[diff] [blame]40neverallow { domain -bpfloader -network_stack } fs_bpf_net_private:file read;
41neverallow { domain -bpfloader -network_stack -system_server } fs_bpf_net_shared:file read;
42neverallow { domain -bpfloader -netd -network_stack -system_server } fs_bpf_netd_readonly:file read;
43neverallow { domain -bpfloader -netd -netutils_wrapper -network_stack -system_server } fs_bpf_netd_shared:file read;
44neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:file read;
45neverallow { domain -bpfloader -gpuservice -netd -netutils_wrapper -network_stack -system_server } { bpffs_type -fs_bpf_vendor }:file write;
Maciej Żenczykowski1fcf7c82022-07-01 18:20:01 -0700[diff] [blame]46neverallow domain bpffs_type:file ~{ create getattr map open read rename setattr write };
Maciej Żenczykowski49c73b02020-01-30 22:08:43 -0800[diff] [blame]47
Maciej Żenczykowskid5098f92022-07-18 03:34:30 -0700[diff] [blame]48neverallow { domain -bpfloader } bpffs_type:lnk_file ~read;
49neverallow { domain -bpfdomain } bpffs_type:lnk_file read;
50
Maciej Żenczykowski487fcb82019-04-08 21:34:53 -0700[diff] [blame]51neverallow { domain -bpfloader } *:bpf { map_create prog_load };
Maciej Żenczykowskie14e69a2022-12-01 14:45:35 +0000[diff] [blame]52neverallow { domain -bpfloader } fs_bpf_loader:bpf *;
53neverallow { domain -bpfloader } fs_bpf_loader:file open;
Steven Morelandc27d24c2019-12-13 15:18:32 -0800[diff] [blame]54
Stephane Lee52862a32022-03-08 14:56:27 -0800[diff] [blame]55neverallow {
56 domain
57 -bpfloader
58 -gpuservice
59 -hal_health_server
60 -mediaprovider_app
61 -netd
62 -netutils_wrapper
63 -network_stack
64 -system_server
65} *:bpf prog_run;
Alessio Balsinifd3e9d82021-11-11 18:42:11 +0000[diff] [blame]66neverallow { domain -bpfloader -gpuservice -lmkd -mediaprovider_app -netd -network_stack -system_server } *:bpf { map_read map_write };
Joel Fernandes147cf642018-11-29 13:07:40 -0800[diff] [blame]67neverallow { domain -bpfloader -init } bpfloader_exec:file { execute execute_no_trans };
Maciej Żenczykowski49c73b02020-01-30 22:08:43 -0800[diff] [blame]68
Maciej Żenczykowskiebb45f92022-12-01 14:45:35 +0000[diff] [blame]69neverallow { coredomain -bpfloader } fs_bpf_vendor:file *;
Steven Morelandc27d24c2019-12-13 15:18:32 -0800[diff] [blame]70
Maciej Żenczykowskid68cb482021-01-29 14:36:32 -0800[diff] [blame]71neverallow bpfloader *:{ tcp_socket udp_socket rawip_socket } *;
Joel Galensond65f26f2018-05-23 08:36:40 -0700[diff] [blame]72
Nick Kralevich095fbea2018-09-13 11:07:14 -0700[diff] [blame]73# No domain should be allowed to ptrace bpfloader
74neverallow { domain userdebug_or_eng(`-llkd') } bpfloader:process ptrace;
Maciej Żenczykowski3702f332021-11-11 01:51:15 -0800[diff] [blame]75
Maciej Żenczykowski4a960862022-12-03 12:19:31 +0000[diff] [blame^]76neverallow { domain -bpfloader } proc_bpf:file write;