From 1ec8d7df583aff4a32fc7a5aa4b938da96546f17 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= Date: Wed, 4 Sep 2024 16:44:04 -0700 Subject: [PATCH] dscpPolicy: lock down bpf cache map MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit (since this map relies on percpu access semantics, and we don't even have userspace helpers to access PERCPU_ maps) This will also be used by the upcoming satellite egress limiting logic. See aosp/3235142 With this change we see: $ adbz shell ls -lZ /sys/fs/bpf/net_shared/*_dscpPolicy_* -rw-rw---- 1 root system u:object_r:fs_bpf_net_shared:s0 0 2024-09-04 17:01 /sys/fs/bpf/net_shared/map_dscpPolicy_ipv4_dscp_policies_map -rw-rw---- 1 root system u:object_r:fs_bpf_net_shared:s0 0 2024-09-04 17:01 /sys/fs/bpf/net_shared/map_dscpPolicy_ipv6_dscp_policies_map ---------- 1 root root u:object_r:fs_bpf_loader:s0 0 2024-09-04 17:01 /sys/fs/bpf/net_shared/map_dscpPolicy_socket_policy_cache_map -r--r----- 1 root system u:object_r:fs_bpf_net_shared:s0 0 2024-09-04 17:01 /sys/fs/bpf/net_shared/prog_dscpPolicy_schedcls_set_dscp_ether Test: TreeHugger, atest CtsNetTestCases:android.net.cts.DscpPolicyTest Signed-off-by: Maciej Żenczykowski Change-Id: I50a12ca4cd5587342f8aaf9df8cb28917f555252 --- bpf/headers/include/bpf_helpers.h | 16 +++++++++++----- bpf/loader/NetBpfLoad.cpp | 5 +++++ bpf/progs/dscpPolicy.c | 4 ++-- 3 files changed, 18 insertions(+), 7 deletions(-) diff --git a/bpf/headers/include/bpf_helpers.h b/bpf/headers/include/bpf_helpers.h index 1a9fd31aad..d3793579b6 100644 --- a/bpf/headers/include/bpf_helpers.h +++ b/bpf/headers/include/bpf_helpers.h @@ -349,11 +349,17 @@ static void (*bpf_ringbuf_submit_unsafe)(const void* data, __u64 flags) = (void* #error "Bpf Map UID must be left at default of AID_ROOT for BpfLoader prior to v0.28" #endif -#define DEFINE_BPF_MAP_UGM(the_map, TYPE, KeyType, ValueType, num_entries, usr, grp, md) \ - DEFINE_BPF_MAP_EXT(the_map, TYPE, KeyType, ValueType, num_entries, usr, grp, md, \ - DEFAULT_BPF_MAP_SELINUX_CONTEXT, DEFAULT_BPF_MAP_PIN_SUBDIR, PRIVATE, \ - BPFLOADER_MIN_VER, BPFLOADER_MAX_VER, LOAD_ON_ENG, \ - LOAD_ON_USER, LOAD_ON_USERDEBUG) +// for maps not meant to be accessed from userspace +#define DEFINE_BPF_MAP_KERNEL_INTERNAL(the_map, TYPE, KeyType, ValueType, num_entries) \ + DEFINE_BPF_MAP_EXT(the_map, TYPE, KeyType, ValueType, num_entries, AID_ROOT, AID_ROOT, \ + 0000, "fs_bpf_loader", "", PRIVATE, BPFLOADER_MIN_VER, BPFLOADER_MAX_VER, \ + LOAD_ON_ENG, LOAD_ON_USER, LOAD_ON_USERDEBUG) + +#define DEFINE_BPF_MAP_UGM(the_map, TYPE, KeyType, ValueType, num_entries, usr, grp, md) \ + DEFINE_BPF_MAP_EXT(the_map, TYPE, KeyType, ValueType, num_entries, usr, grp, md, \ + DEFAULT_BPF_MAP_SELINUX_CONTEXT, DEFAULT_BPF_MAP_PIN_SUBDIR, \ + PRIVATE, BPFLOADER_MIN_VER, BPFLOADER_MAX_VER, \ + LOAD_ON_ENG, LOAD_ON_USER, LOAD_ON_USERDEBUG) #define DEFINE_BPF_MAP(the_map, TYPE, KeyType, ValueType, num_entries) \ DEFINE_BPF_MAP_UGM(the_map, TYPE, KeyType, ValueType, num_entries, \ diff --git a/bpf/loader/NetBpfLoad.cpp b/bpf/loader/NetBpfLoad.cpp index 5d4cd42580..4767dfafba 100644 --- a/bpf/loader/NetBpfLoad.cpp +++ b/bpf/loader/NetBpfLoad.cpp @@ -97,6 +97,8 @@ enum class domain : int { net_shared, // (T+) fs_bpf_net_shared /sys/fs/bpf/net_shared netd_readonly, // (T+) fs_bpf_netd_readonly /sys/fs/bpf/netd_readonly netd_shared, // (T+) fs_bpf_netd_shared /sys/fs/bpf/netd_shared + loader, // (U+) fs_bpf_loader /sys/fs/bpf/loader + // on T due to lack of sepolicy/genfscon rules it behaves simply as 'fs_bpf' }; static constexpr domain AllDomains[] = { @@ -106,6 +108,7 @@ static constexpr domain AllDomains[] = { domain::net_shared, domain::netd_readonly, domain::netd_shared, + domain::loader, }; static constexpr bool specified(domain d) { @@ -151,6 +154,7 @@ constexpr const char* lookupSelinuxContext(const domain d) { case domain::net_shared: return "fs_bpf_net_shared"; case domain::netd_readonly: return "fs_bpf_netd_readonly"; case domain::netd_shared: return "fs_bpf_netd_shared"; + case domain::loader: return "fs_bpf_loader"; } } @@ -174,6 +178,7 @@ constexpr const char* lookupPinSubdir(const domain d, const char* const unspecif case domain::net_shared: return "net_shared/"; case domain::netd_readonly: return "netd_readonly/"; case domain::netd_shared: return "netd_shared/"; + case domain::loader: return "loader/"; } }; diff --git a/bpf/progs/dscpPolicy.c b/bpf/progs/dscpPolicy.c index 39f2961968..0842aaa148 100644 --- a/bpf/progs/dscpPolicy.c +++ b/bpf/progs/dscpPolicy.c @@ -25,8 +25,8 @@ // The cache is never read nor written by userspace and is indexed by socket cookie % CACHE_MAP_SIZE #define CACHE_MAP_SIZE 32 // should be a power of two so we can % cheaply -DEFINE_BPF_MAP_GRO(socket_policy_cache_map, PERCPU_ARRAY, uint32_t, RuleEntry, CACHE_MAP_SIZE, - AID_SYSTEM) +DEFINE_BPF_MAP_KERNEL_INTERNAL(socket_policy_cache_map, PERCPU_ARRAY, uint32_t, RuleEntry, + CACHE_MAP_SIZE) DEFINE_BPF_MAP_GRW(ipv4_dscp_policies_map, ARRAY, uint32_t, DscpPolicy, MAX_POLICIES, AID_SYSTEM) DEFINE_BPF_MAP_GRW(ipv6_dscp_policies_map, ARRAY, uint32_t, DscpPolicy, MAX_POLICIES, AID_SYSTEM)