| Chenbo Feng | 566411e | 2018-01-02 15:31:18 -0800 | [diff] [blame] | 1 | # bpf program loader |
| 2 | type bpfloader, domain; |
| Nick Kralevich | 5e37271 | 2018-09-27 10:21:37 -0700 | [diff] [blame] | 3 | type bpfloader_exec, system_file_type, exec_type, file_type; |
| Chenbo Feng | 566411e | 2018-01-02 15:31:18 -0800 | [diff] [blame] | 4 | typeattribute bpfloader coredomain; |
| 5 | |
| Maciej Żenczykowski | 49c73b0 | 2020-01-30 22:08:43 -0800 | [diff] [blame] | 6 | # These permissions are required to pin ebpf maps & programs. |
| Maciej Żenczykowski | 8c11cc3 | 2021-01-15 20:42:20 -0800 | [diff] [blame^] | 7 | allow bpfloader fs_bpf:dir { create search write add_name }; |
| Maciej Żenczykowski | ef76c53 | 2020-06-16 21:50:44 -0700 | [diff] [blame] | 8 | allow bpfloader fs_bpf:file { create setattr read }; |
| Chenbo Feng | 566411e | 2018-01-02 15:31:18 -0800 | [diff] [blame] | 9 | |
| Maciej Żenczykowski | 49c73b0 | 2020-01-30 22:08:43 -0800 | [diff] [blame] | 10 | # Allow bpfloader to create bpf maps and programs. |
| 11 | allow bpfloader self:bpf { map_create map_read map_write prog_load prog_run }; |
| Chenbo Feng | 566411e | 2018-01-02 15:31:18 -0800 | [diff] [blame] | 12 | |
| Maciej Żenczykowski | 1189fac | 2020-01-27 07:10:40 -0800 | [diff] [blame] | 13 | allow bpfloader self:capability { chown sys_admin }; |
| Nick Kralevich | 095fbea | 2018-09-13 11:07:14 -0700 | [diff] [blame] | 14 | |
| 15 | ### |
| 16 | ### Neverallow rules |
| 17 | ### |
| Maciej Żenczykowski | 49c73b0 | 2020-01-30 22:08:43 -0800 | [diff] [blame] | 18 | |
| 19 | # TODO: get rid of init & vendor_init |
| 20 | neverallow { domain -init -vendor_init } fs_bpf:dir setattr; |
| Maciej Żenczykowski | 8c11cc3 | 2021-01-15 20:42:20 -0800 | [diff] [blame^] | 21 | neverallow { domain -bpfloader } fs_bpf:dir { create write add_name }; |
| Maciej Żenczykowski | 49c73b0 | 2020-01-30 22:08:43 -0800 | [diff] [blame] | 22 | neverallow domain fs_bpf:dir { reparent rename rmdir }; |
| 23 | |
| 24 | # TODO: get rid of init & vendor_init |
| 25 | neverallow { domain -bpfloader -init -vendor_init } fs_bpf:file setattr; |
| 26 | neverallow { domain -bpfloader } fs_bpf:file create; |
| 27 | neverallow domain fs_bpf:file { rename unlink }; |
| 28 | |
| Maciej Żenczykowski | 487fcb8 | 2019-04-08 21:34:53 -0700 | [diff] [blame] | 29 | neverallow { domain -bpfloader } *:bpf { map_create prog_load }; |
| markchien | 48c600f | 2020-11-26 09:55:56 +0800 | [diff] [blame] | 30 | neverallow { domain -bpfloader -gpuservice -netd -netutils_wrapper -network_stack -system_server } *:bpf prog_run; |
| 31 | neverallow { domain -bpfloader -gpuservice -netd -network_stack -system_server } *:bpf { map_read map_write }; |
| Maciej Żenczykowski | 49c73b0 | 2020-01-30 22:08:43 -0800 | [diff] [blame] | 32 | |
| Joel Fernandes | 147cf64 | 2018-11-29 13:07:40 -0800 | [diff] [blame] | 33 | neverallow { domain -bpfloader -init } bpfloader_exec:file { execute execute_no_trans }; |
| Maciej Żenczykowski | 49c73b0 | 2020-01-30 22:08:43 -0800 | [diff] [blame] | 34 | |
| Chenbo Feng | 566411e | 2018-01-02 15:31:18 -0800 | [diff] [blame] | 35 | neverallow bpfloader domain:{ tcp_socket udp_socket rawip_socket } *; |
| Joel Galenson | d65f26f | 2018-05-23 08:36:40 -0700 | [diff] [blame] | 36 | |
| Nick Kralevich | 095fbea | 2018-09-13 11:07:14 -0700 | [diff] [blame] | 37 | # No domain should be allowed to ptrace bpfloader |
| 38 | neverallow { domain userdebug_or_eng(`-llkd') } bpfloader:process ptrace; |
| Joel Fernandes | b76a639 | 2019-01-11 08:32:45 -0500 | [diff] [blame] | 39 | |
| 40 | set_prop(bpfloader, bpf_progs_loaded_prop) |