Gitiles
Code Review Sign In
gerrit.omnirom.org / android_system_sepolicy / 52c8a2ebd5bb2403b86823b12aedebd62c2ab32b / . / private / bpfloader.te
blob: eecda30d62523e640951decdf3250237b63c6b3d [file] [log] [blame]
Nick Kralevich5e372712018-09-27 10:21:37 -0700[diff] [blame]1type bpfloader_exec, system_file_type, exec_type, file_type;
Chenbo Feng566411e2018-01-02 15:31:18 -0800[diff] [blame]2
Steven Moreland65981752022-02-10 00:32:44 +0000[diff] [blame]3typeattribute bpfloader bpfdomain;
4
Steven Moreland233d4aa2022-02-07 23:15:00 +0000[diff] [blame]5# allow bpfloader to write to the kernel log (starts early)
6allow bpfloader kmsg_device:chr_file w_file_perms;
7
Maciej Żenczykowski49c73b02020-01-30 22:08:43 -0800[diff] [blame]8# These permissions are required to pin ebpf maps & programs.
Maciej Żenczykowskib13921c2022-05-21 05:03:29 -0700[diff] [blame]9allow bpfloader bpffs_type:dir { add_name create remove_name search write };
Maciej Żenczykowski1fcf7c82022-07-01 18:20:01 -0700[diff] [blame]10allow bpfloader bpffs_type:file { create getattr read rename setattr };
Maciej Żenczykowskid5098f92022-07-18 03:34:30 -0700[diff] [blame]11allow bpfloader bpffs_type:lnk_file { create getattr read };
Maciej Żenczykowskib13921c2022-05-21 05:03:29 -0700[diff] [blame]12allow { bpffs_type -fs_bpf } fs_bpf:filesystem associate;
Chenbo Feng566411e2018-01-02 15:31:18 -0800[diff] [blame]13
Maciej Żenczykowski49c73b02020-01-30 22:08:43 -0800[diff] [blame]14# Allow bpfloader to create bpf maps and programs.
15allow bpfloader self:bpf { map_create map_read map_write prog_load prog_run };
Chenbo Feng566411e2018-01-02 15:31:18 -0800[diff] [blame]16
Maciej Żenczykowski94c30682021-03-01 23:16:46 -0800[diff] [blame]17allow bpfloader self:capability { chown sys_admin net_admin };
Nick Kralevich095fbea2018-09-13 11:07:14 -0700[diff] [blame]18
Paul Lawrencee3e26b72021-11-12 00:53:26 +0000[diff] [blame]19allow bpfloader sysfs_fs_fuse_bpf:file r_file_perms;
20
Maciej Żenczykowski4a960862022-12-03 12:19:31 +0000[diff] [blame]21allow bpfloader proc_bpf:file w_file_perms;
22
Maciej Żenczykowskid68cb482021-01-29 14:36:32 -0800[diff] [blame]23set_prop(bpfloader, bpf_progs_loaded_prop)
24
Connor O'Briendbe26842022-01-18 22:57:41 -0800[diff] [blame]25allow bpfloader bpfloader_exec:file execute_no_trans;
26
Nick Kralevich095fbea2018-09-13 11:07:14 -0700[diff] [blame]27###
28### Neverallow rules
29###
Maciej Żenczykowski49c73b02020-01-30 22:08:43 -0800[diff] [blame]30
Maciej Żenczykowskiebb45f92022-12-01 14:45:35 +0000[diff] [blame]31# Note: we don't care about getattr/mounton/search
Maciej Żenczykowski9a768052022-12-03 09:13:05 +0000[diff] [blame]32neverallow { domain } bpffs_type:dir ~{ add_name create getattr mounton remove_name search write };
Maciej Żenczykowskib13921c2022-05-21 05:03:29 -0700[diff] [blame]33neverallow { domain -bpfloader } bpffs_type:dir { add_name create remove_name write };
Maciej Żenczykowski49c73b02020-01-30 22:08:43 -0800[diff] [blame]34
Maciej Żenczykowski9a768052022-12-03 09:13:05 +0000[diff] [blame]35neverallow { domain } bpffs_type:file ~{ create getattr map open read rename setattr write };
Maciej Żenczykowski52c8a2e2023-03-27 18:14:40 -0700[diff] [blame^]36neverallow { domain -bpfloader } bpffs_type:file { create map open rename setattr };
37neverallow { domain -bpfloader -gpuservice -lmkd -mediaprovider_app -netd -netutils_wrapper -system_server } fs_bpf:file { getattr read };
38neverallow { domain -bpfloader } fs_bpf_loader:file { getattr read };
39neverallow { domain -bpfloader -network_stack } fs_bpf_net_private:file { getattr read };
40neverallow { domain -bpfloader -network_stack -system_server } fs_bpf_net_shared:file { getattr read };
41neverallow { domain -bpfloader -netd -network_stack -system_server } fs_bpf_netd_readonly:file { getattr read };
42neverallow { domain -bpfloader -netd -netutils_wrapper -network_stack -system_server } fs_bpf_netd_shared:file { getattr read };
43neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:file { getattr read };
Maciej Żenczykowskiebb45f92022-12-01 14:45:35 +0000[diff] [blame]44neverallow { domain -bpfloader -gpuservice -netd -netutils_wrapper -network_stack -system_server } { bpffs_type -fs_bpf_vendor }:file write;
Maciej Żenczykowski49c73b02020-01-30 22:08:43 -0800[diff] [blame]45
Maciej Żenczykowskid5098f92022-07-18 03:34:30 -0700[diff] [blame]46neverallow { domain -bpfloader } bpffs_type:lnk_file ~read;
47neverallow { domain -bpfdomain } bpffs_type:lnk_file read;
48
Maciej Żenczykowski487fcb82019-04-08 21:34:53 -0700[diff] [blame]49neverallow { domain -bpfloader } *:bpf { map_create prog_load };
Maciej Żenczykowski9a768052022-12-03 09:13:05 +0000[diff] [blame]50
51# 'fs_bpf_loader' is for internal use of the BpfLoader oneshot boot time process.
Maciej Żenczykowskie14e69a2022-12-01 14:45:35 +0000[diff] [blame]52neverallow { domain -bpfloader } fs_bpf_loader:bpf *;
Maciej Żenczykowski9a768052022-12-03 09:13:05 +0000[diff] [blame]53neverallow { domain -bpfloader } fs_bpf_loader:file *;
Steven Morelandc27d24c2019-12-13 15:18:32 -0800[diff] [blame]54
Stephane Lee52862a32022-03-08 14:56:27 -0800[diff] [blame]55neverallow {
56 domain
57 -bpfloader
58 -gpuservice
59 -hal_health_server
60 -mediaprovider_app
61 -netd
62 -netutils_wrapper
63 -network_stack
64 -system_server
65} *:bpf prog_run;
Alessio Balsinifd3e9d82021-11-11 18:42:11 +0000[diff] [blame]66neverallow { domain -bpfloader -gpuservice -lmkd -mediaprovider_app -netd -network_stack -system_server } *:bpf { map_read map_write };
Joel Fernandes147cf642018-11-29 13:07:40 -0800[diff] [blame]67neverallow { domain -bpfloader -init } bpfloader_exec:file { execute execute_no_trans };
Maciej Żenczykowski49c73b02020-01-30 22:08:43 -0800[diff] [blame]68
Maciej Żenczykowskiebb45f92022-12-01 14:45:35 +0000[diff] [blame]69neverallow { coredomain -bpfloader } fs_bpf_vendor:file *;
Steven Morelandc27d24c2019-12-13 15:18:32 -0800[diff] [blame]70
Maciej Żenczykowskid68cb482021-01-29 14:36:32 -0800[diff] [blame]71neverallow bpfloader *:{ tcp_socket udp_socket rawip_socket } *;
Joel Galensond65f26f2018-05-23 08:36:40 -0700[diff] [blame]72
Nick Kralevich095fbea2018-09-13 11:07:14 -0700[diff] [blame]73# No domain should be allowed to ptrace bpfloader
74neverallow { domain userdebug_or_eng(`-llkd') } bpfloader:process ptrace;
Maciej Żenczykowski3702f332021-11-11 01:51:15 -0800[diff] [blame]75
Maciej Żenczykowski4a960862022-12-03 12:19:31 +0000[diff] [blame]76neverallow { domain -bpfloader } proc_bpf:file write;