joy/android_packages_modules_Connectivity
Watch
1
Fork
You've already forked android_packages_modules_Connectivity
 0
Code Issues Pull requests Projects Releases Wiki Activity

dscpPolicy: lock down bpf cache map

Browse source 
(since this map relies on percpu access semantics,
 and we don't even have userspace helpers to access PERCPU_ maps)

This will also be used by the upcoming satellite egress limiting logic.
See aosp/3235142

With this change we see:
  $ adbz shell ls -lZ /sys/fs/bpf/net_shared/*_dscpPolicy_*
  -rw-rw---- 1 root system u:object_r:fs_bpf_net_shared:s0  0 2024-09-04 17:01 /sys/fs/bpf/net_shared/map_dscpPolicy_ipv4_dscp_policies_map
  -rw-rw---- 1 root system u:object_r:fs_bpf_net_shared:s0  0 2024-09-04 17:01 /sys/fs/bpf/net_shared/map_dscpPolicy_ipv6_dscp_policies_map
  ---------- 1 root root   u:object_r:fs_bpf_loader:s0      0 2024-09-04 17:01 /sys/fs/bpf/net_shared/map_dscpPolicy_socket_policy_cache_map
  -r--r----- 1 root system u:object_r:fs_bpf_net_shared:s0  0 2024-09-04 17:01 /sys/fs/bpf/net_shared/prog_dscpPolicy_schedcls_set_dscp_ether

Test: TreeHugger, atest CtsNetTestCases:android.net.cts.DscpPolicyTest
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I50a12ca4cd5587342f8aaf9df8cb28917f555252
This commit is contained in:
Maciej Żenczykowski 2024-09-04 16:44:04 -07:00
commit 1ec8d7df58
1 changed files with 18 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

5
bpf/loader/NetBpfLoad.cpp
View file

@ -97,6 +97,8 @@ enum class domain : int {
net_shared, // (T+) fs_bpf_net_shared /sys/fs/bpf/net_shared
netd_readonly, // (T+) fs_bpf_netd_readonly /sys/fs/bpf/netd_readonly
netd_shared, // (T+) fs_bpf_netd_shared /sys/fs/bpf/netd_shared
loader, // (U+) fs_bpf_loader /sys/fs/bpf/loader
// on T due to lack of sepolicy/genfscon rules it behaves simply as 'fs_bpf'
};
static constexpr domain AllDomains[] = {
@ -106,6 +108,7 @@ static constexpr domain AllDomains[] = {
domain::net_shared,
domain::netd_readonly,
domain::netd_shared,
domain::loader,
};
static constexpr bool specified(domain d) {
@ -151,6 +154,7 @@ constexpr const char* lookupSelinuxContext(const domain d) {
case domain::net_shared: return "fs_bpf_net_shared";
case domain::netd_readonly: return "fs_bpf_netd_readonly";
case domain::netd_shared: return "fs_bpf_netd_shared";
case domain::loader: return "fs_bpf_loader";
}
}
@ -174,6 +178,7 @@ constexpr const char* lookupPinSubdir(const domain d, const char* const unspecif
case domain::net_shared: return "net_shared/";
case domain::netd_readonly: return "netd_readonly/";
case domain::netd_shared: return "netd_shared/";
case domain::loader: return "loader/";
}
};