From 0e4802df200e2d66fc2e7f2007600f190891163c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= Date: Mon, 2 Oct 2023 19:38:12 -0700 Subject: [PATCH] netbpfload: remove support for 'platform' MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Test: N/A Signed-off-by: Maciej Żenczykowski Change-Id: Ia0c1f55aa78435737699e0dec0bfddbd977e7392 --- netbpfload/NetBpfLoad.cpp | 20 -------------------- netbpfload/loader.cpp | 2 -- netbpfload/loader.h | 2 -- 3 files changed, 24 deletions(-) diff --git a/netbpfload/NetBpfLoad.cpp b/netbpfload/NetBpfLoad.cpp index 99a2ab4be1..499f8338ff 100644 --- a/netbpfload/NetBpfLoad.cpp +++ b/netbpfload/NetBpfLoad.cpp @@ -93,18 +93,6 @@ constexpr bpf_prog_type kTetheringApexAllowedProgTypes[] = { BPF_PROG_TYPE_XDP, }; -// Networking-related program types are limited to the Tethering Apex -// to prevent things from breaking due to conflicts on mainline updates -// (exception made for socket filters, ie. xt_bpf for potential use in iptables, -// or for attaching to sockets directly) -constexpr bpf_prog_type kPlatformAllowedProgTypes[] = { - BPF_PROG_TYPE_KPROBE, - BPF_PROG_TYPE_PERF_EVENT, - BPF_PROG_TYPE_SOCKET_FILTER, - BPF_PROG_TYPE_TRACEPOINT, - BPF_PROG_TYPE_UNSPEC, // Will be replaced with fuse bpf program type -}; - // see b/162057235. For arbitrary program types, the concern is that due to the lack of // SELinux access controls over BPF program attachpoints, we have no way to control the // attachment of programs to shared resources (or to detect when a shared resource @@ -157,14 +145,6 @@ const android::bpf::Location locations[] = { .allowedProgTypes = kTetheringApexAllowedProgTypes, .allowedProgTypesLength = arraysize(kTetheringApexAllowedProgTypes), }, - // Core operating system - { - .dir = "/system/etc/bpf/", - .prefix = "", - .allowedDomainBitmask = domainToBitmask(domain::platform), - .allowedProgTypes = kPlatformAllowedProgTypes, - .allowedProgTypesLength = arraysize(kPlatformAllowedProgTypes), - }, // Vendor operating system { .dir = "/vendor/etc/bpf/", diff --git a/netbpfload/loader.cpp b/netbpfload/loader.cpp index d817614523..a8944f289f 100644 --- a/netbpfload/loader.cpp +++ b/netbpfload/loader.cpp @@ -98,7 +98,6 @@ static unsigned int page_size = static_cast(getpagesize()); constexpr const char* lookupSelinuxContext(const domain d, const char* const unspecified = "") { switch (d) { case domain::unspecified: return unspecified; - case domain::platform: return "fs_bpf"; case domain::tethering: return "fs_bpf_tethering"; case domain::net_private: return "fs_bpf_net_private"; case domain::net_shared: return "fs_bpf_net_shared"; @@ -130,7 +129,6 @@ domain getDomainFromSelinuxContext(const char s[BPF_SELINUX_CONTEXT_CHAR_ARRAY_S constexpr const char* lookupPinSubdir(const domain d, const char* const unspecified = "") { switch (d) { case domain::unspecified: return unspecified; - case domain::platform: return "/"; case domain::tethering: return "tethering/"; case domain::net_private: return "net_private/"; case domain::net_shared: return "net_shared/"; diff --git a/netbpfload/loader.h b/netbpfload/loader.h index cc8a94243c..6791523f6c 100644 --- a/netbpfload/loader.h +++ b/netbpfload/loader.h @@ -39,7 +39,6 @@ namespace bpf { enum class domain : int { unrecognized = -1, // invalid for this version of the bpfloader unspecified = 0, // means just use the default for that specific pin location - platform, // fs_bpf /sys/fs/bpf tethering, // (S+) fs_bpf_tethering /sys/fs/bpf/tethering net_private, // (T+) fs_bpf_net_private /sys/fs/bpf/net_private net_shared, // (T+) fs_bpf_net_shared /sys/fs/bpf/net_shared @@ -52,7 +51,6 @@ enum class domain : int { // Note: this does not include domain::unrecognized, but does include domain::unspecified static constexpr domain AllDomains[] = { domain::unspecified, - domain::platform, domain::tethering, domain::net_private, domain::net_shared,