Gitiles
Code Review Sign In
gerrit.omnirom.org / android_system_sepolicy / 9a76805ac371eee1ce102f8292b730aa5b6c49a0 / . / private / bpfloader.te
blob: a0a5cfa66f74df24688152f9ee6f36b2de2d8463 [file] [log] [blame]
Nick Kralevich5e372712018-09-27 10:21:37 -0700[diff] [blame]1type bpfloader_exec, system_file_type, exec_type, file_type;
Chenbo Feng566411e2018-01-02 15:31:18 -0800[diff] [blame]2
Steven Moreland65981752022-02-10 00:32:44 +0000[diff] [blame]3typeattribute bpfloader bpfdomain;
4
Steven Moreland233d4aa2022-02-07 23:15:00 +0000[diff] [blame]5# allow bpfloader to write to the kernel log (starts early)
6allow bpfloader kmsg_device:chr_file w_file_perms;
7
Maciej Żenczykowski49c73b02020-01-30 22:08:43 -0800[diff] [blame]8# These permissions are required to pin ebpf maps & programs.
Maciej Żenczykowskib13921c2022-05-21 05:03:29 -0700[diff] [blame]9allow bpfloader bpffs_type:dir { add_name create remove_name search write };
Maciej Żenczykowski1fcf7c82022-07-01 18:20:01 -0700[diff] [blame]10allow bpfloader bpffs_type:file { create getattr read rename setattr };
Maciej Żenczykowskid5098f92022-07-18 03:34:30 -0700[diff] [blame]11allow bpfloader bpffs_type:lnk_file { create getattr read };
Maciej Żenczykowskib13921c2022-05-21 05:03:29 -0700[diff] [blame]12allow { bpffs_type -fs_bpf } fs_bpf:filesystem associate;
Chenbo Feng566411e2018-01-02 15:31:18 -0800[diff] [blame]13
Maciej Żenczykowski49c73b02020-01-30 22:08:43 -0800[diff] [blame]14# Allow bpfloader to create bpf maps and programs.
15allow bpfloader self:bpf { map_create map_read map_write prog_load prog_run };
Chenbo Feng566411e2018-01-02 15:31:18 -0800[diff] [blame]16
Maciej Żenczykowski94c30682021-03-01 23:16:46 -0800[diff] [blame]17allow bpfloader self:capability { chown sys_admin net_admin };
Nick Kralevich095fbea2018-09-13 11:07:14 -0700[diff] [blame]18
Paul Lawrencee3e26b72021-11-12 00:53:26 +0000[diff] [blame]19allow bpfloader sysfs_fs_fuse_bpf:file r_file_perms;
20
Maciej Żenczykowskid68cb482021-01-29 14:36:32 -0800[diff] [blame]21set_prop(bpfloader, bpf_progs_loaded_prop)
22
Connor O'Briendbe26842022-01-18 22:57:41 -0800[diff] [blame]23allow bpfloader bpfloader_exec:file execute_no_trans;
24
Nick Kralevich095fbea2018-09-13 11:07:14 -0700[diff] [blame]25###
26### Neverallow rules
27###
Maciej Żenczykowski49c73b02020-01-30 22:08:43 -0800[diff] [blame]28
Maciej Żenczykowskiebb45f92022-12-01 14:45:35 +0000[diff] [blame]29# Note: we don't care about getattr/mounton/search
Maciej Żenczykowski9a768052022-12-03 09:13:05 +0000[diff] [blame^]30neverallow { domain } bpffs_type:dir ~{ add_name create getattr mounton remove_name search write };
Maciej Żenczykowskib13921c2022-05-21 05:03:29 -0700[diff] [blame]31neverallow { domain -bpfloader } bpffs_type:dir { add_name create remove_name write };
Maciej Żenczykowski49c73b02020-01-30 22:08:43 -0800[diff] [blame]32
Maciej Żenczykowski9a768052022-12-03 09:13:05 +0000[diff] [blame^]33neverallow { domain } bpffs_type:file ~{ create getattr map open read rename setattr write };
34neverallow { domain -bpfloader } bpffs_type:file { create getattr map open rename setattr };
Maciej Żenczykowskiebb45f92022-12-01 14:45:35 +0000[diff] [blame]35neverallow { domain -bpfloader -gpuservice -lmkd -mediaprovider_app -netd -netutils_wrapper -system_server } fs_bpf:file read;
Maciej Żenczykowskie14e69a2022-12-01 14:45:35 +0000[diff] [blame]36neverallow { domain -bpfloader } fs_bpf_loader:file read;
Maciej Żenczykowskiebb45f92022-12-01 14:45:35 +0000[diff] [blame]37neverallow { domain -bpfloader -network_stack } fs_bpf_net_private:file read;
38neverallow { domain -bpfloader -network_stack -system_server } fs_bpf_net_shared:file read;
39neverallow { domain -bpfloader -netd -network_stack -system_server } fs_bpf_netd_readonly:file read;
40neverallow { domain -bpfloader -netd -netutils_wrapper -network_stack -system_server } fs_bpf_netd_shared:file read;
41neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:file read;
42neverallow { domain -bpfloader -gpuservice -netd -netutils_wrapper -network_stack -system_server } { bpffs_type -fs_bpf_vendor }:file write;
Maciej Żenczykowski49c73b02020-01-30 22:08:43 -0800[diff] [blame]43
Maciej Żenczykowskid5098f92022-07-18 03:34:30 -0700[diff] [blame]44neverallow { domain -bpfloader } bpffs_type:lnk_file ~read;
45neverallow { domain -bpfdomain } bpffs_type:lnk_file read;
46
Maciej Żenczykowski487fcb82019-04-08 21:34:53 -0700[diff] [blame]47neverallow { domain -bpfloader } *:bpf { map_create prog_load };
Maciej Żenczykowski9a768052022-12-03 09:13:05 +0000[diff] [blame^]48
49# 'fs_bpf_loader' is for internal use of the BpfLoader oneshot boot time process.
Maciej Żenczykowskie14e69a2022-12-01 14:45:35 +0000[diff] [blame]50neverallow { domain -bpfloader } fs_bpf_loader:bpf *;
Maciej Żenczykowski9a768052022-12-03 09:13:05 +0000[diff] [blame^]51neverallow { domain -bpfloader } fs_bpf_loader:file *;
Steven Morelandc27d24c2019-12-13 15:18:32 -0800[diff] [blame]52
Stephane Lee52862a32022-03-08 14:56:27 -0800[diff] [blame]53neverallow {
54 domain
55 -bpfloader
56 -gpuservice
57 -hal_health_server
58 -mediaprovider_app
59 -netd
60 -netutils_wrapper
61 -network_stack
62 -system_server
63} *:bpf prog_run;
Alessio Balsinifd3e9d82021-11-11 18:42:11 +0000[diff] [blame]64neverallow { domain -bpfloader -gpuservice -lmkd -mediaprovider_app -netd -network_stack -system_server } *:bpf { map_read map_write };
Joel Fernandes147cf642018-11-29 13:07:40 -0800[diff] [blame]65neverallow { domain -bpfloader -init } bpfloader_exec:file { execute execute_no_trans };
Maciej Żenczykowski49c73b02020-01-30 22:08:43 -0800[diff] [blame]66
Maciej Żenczykowskiebb45f92022-12-01 14:45:35 +0000[diff] [blame]67neverallow { coredomain -bpfloader } fs_bpf_vendor:file *;
Steven Morelandc27d24c2019-12-13 15:18:32 -0800[diff] [blame]68
Maciej Żenczykowskid68cb482021-01-29 14:36:32 -0800[diff] [blame]69neverallow bpfloader *:{ tcp_socket udp_socket rawip_socket } *;
Joel Galensond65f26f2018-05-23 08:36:40 -0700[diff] [blame]70
Nick Kralevich095fbea2018-09-13 11:07:14 -0700[diff] [blame]71# No domain should be allowed to ptrace bpfloader
72neverallow { domain userdebug_or_eng(`-llkd') } bpfloader:process ptrace;
Maciej Żenczykowski3702f332021-11-11 01:51:15 -0800[diff] [blame]73
74# Currently only bpfloader.rc (which runs as init) can do bpf sysctl setup
75# this should perhaps be moved to the bpfloader binary itself. Allow both.
76neverallow { domain -bpfloader -init } proc_bpf:file write;