From ae6c74e56afd4809feb4e425b7cb3d399f7322f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= Date: Tue, 5 Aug 2025 15:04:50 -0700 Subject: [PATCH] bpf: remove uid = AID_ROOT from bpf program specifications MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It's superfluous - we never use any other value, and it's unlikely we ever will. We only run code in: - NetBpfLoad/netd/dnsresolver which all run as uid AID_ROOT, - System Server which runs as uid AID_SYSTEM, - Network Stack which runs as uid AID_NETWORK_STACK, so any other values would seem wrong. However, groups serve the purpose better (hence why the programs are group readable), and we have pre-existing groups to cover the combinations we care about. Furthermore we already have sepolicy labels in place as well... Tested: TreeHugger Flag: EXEMPT mainline Signed-off-by: Maciej Żenczykowski Change-Id: I9535eac7eb365735fb3a9769c47ffa7067854dad --- bpf/progs/clatd.c | 10 ++--- bpf/progs/dscpPolicy.c | 2 +- bpf/progs/include/bpf_helpers.h | 31 +++++++------- bpf/progs/netd.c | 2 +- bpf/progs/offload.c | 72 +++++++++++++++------------------ 5 files changed, 54 insertions(+), 63 deletions(-) diff --git a/bpf/progs/clatd.c b/bpf/progs/clatd.c index 7f128dbde6..1ed9788fdc 100644 --- a/bpf/progs/clatd.c +++ b/bpf/progs/clatd.c @@ -247,29 +247,29 @@ static inline __always_inline int nat64(struct __sk_buff* skb, return TC_ACT_PIPE; } -DEFINE_BPF_PROG_KVER(schedcls, ingress6_clat_ether, 4_14, AID_ROOT, AID_SYSTEM, KVER_4_14) +DEFINE_BPF_PROG_KVER(schedcls, ingress6_clat_ether, 4_14, AID_SYSTEM, KVER_4_14) (struct __sk_buff* skb) { return nat64(skb, ETHER, KVER_4_14); } -DEFINE_BPF_PROG_KVER_RANGE(schedcls, ingress6_clat_ether, 4_9, AID_ROOT, AID_SYSTEM, KVER_NONE, KVER_4_14) +DEFINE_BPF_PROG_KVER_RANGE(schedcls, ingress6_clat_ether, 4_9, AID_SYSTEM, KVER_NONE, KVER_4_14) (struct __sk_buff* skb) { return nat64(skb, ETHER, KVER_NONE); } -DEFINE_BPF_PROG_KVER(schedcls, ingress6_clat_rawip, 4_14, AID_ROOT, AID_SYSTEM, KVER_4_14) +DEFINE_BPF_PROG_KVER(schedcls, ingress6_clat_rawip, 4_14, AID_SYSTEM, KVER_4_14) (struct __sk_buff* skb) { return nat64(skb, RAWIP, KVER_4_14); } -DEFINE_BPF_PROG_KVER_RANGE(schedcls, ingress6_clat_rawip, 4_9, AID_ROOT, AID_SYSTEM, KVER_NONE, KVER_4_14) +DEFINE_BPF_PROG_KVER_RANGE(schedcls, ingress6_clat_rawip, 4_9, AID_SYSTEM, KVER_NONE, KVER_4_14) (struct __sk_buff* skb) { return nat64(skb, RAWIP, KVER_NONE); } DEFINE_BPF_MAP_GRW(clat_egress4_map, HASH, ClatEgress4Key, ClatEgress4Value, 16, AID_SYSTEM) -DEFINE_BPF_PROG(schedcls, egress4_clat_rawip, , AID_ROOT, AID_SYSTEM) +DEFINE_BPF_PROG(schedcls, egress4_clat_rawip, , AID_SYSTEM) (struct __sk_buff* skb) { // Must be meta-ethernet IPv4 frame if (skb->protocol != htons(ETH_P_IP)) return TC_ACT_PIPE; diff --git a/bpf/progs/dscpPolicy.c b/bpf/progs/dscpPolicy.c index 2b11e5c12a..8ae29dd5d9 100644 --- a/bpf/progs/dscpPolicy.c +++ b/bpf/progs/dscpPolicy.c @@ -264,7 +264,7 @@ static inline __always_inline void match_policy(struct __sk_buff* skb, const boo return; } -DEFINE_BPF_PROG_KVER(schedcls, set_dscp_ether, , AID_ROOT, AID_SYSTEM, KVER_5_15) +DEFINE_BPF_PROG_KVER(schedcls, set_dscp_ether, , AID_SYSTEM, KVER_5_15) (struct __sk_buff* skb) { if (skb->pkt_type != PACKET_HOST) return TC_ACT_PIPE; diff --git a/bpf/progs/include/bpf_helpers.h b/bpf/progs/include/bpf_helpers.h index ab405c2006..75da3afbe8 100644 --- a/bpf/progs/include/bpf_helpers.h +++ b/bpf/progs/include/bpf_helpers.h @@ -552,10 +552,9 @@ static long (*bpf_trace_printk)(const char* fmt, int fmt_size, ...) = (void*) BP SECTION(#TYPE "/" #NAME "$" #VER) \ long TYPE##_##NAME##_##VER -#define DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_uid, prog_gid, min_kv, max_kv, \ - opt) \ - DEFINE_BPF_PROG_EXT(TYPE, NAME, VER, prog_uid, prog_gid, min_kv, max_kv, \ - BPFLOADER_MIN_VER, BPFLOADER_MAX_VER, opt, \ +#define DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_gid, min_kv, max_kv, opt) \ + DEFINE_BPF_PROG_EXT(TYPE, NAME, VER, AID_ROOT, prog_gid, min_kv, max_kv, \ + BPFLOADER_MIN_VER, BPFLOADER_MAX_VER, opt, \ DEFAULT_BPF_MAP_SELINUX_CONTEXT, DEFAULT_BPF_PIN_SUBDIR) // Programs (here used in the sense of functions/sections) marked optional are allowed to fail @@ -570,25 +569,25 @@ static long (*bpf_trace_printk)(const char* fmt, int fmt_size, ...) = (void*) BP // ie. a non-optional program in a critical .o is mandatory for kernels matching the min/max kver. // programs requiring a kernel version >= min_kv && < max_kv -#define DEFINE_BPF_PROG_KVER_RANGE(TYPE, NAME, VER, prog_uid, prog_gid, min_kv, max_kv) \ - DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_uid, prog_gid, min_kv, max_kv, \ +#define DEFINE_BPF_PROG_KVER_RANGE(TYPE, NAME, VER, prog_gid, min_kv, max_kv) \ + DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_gid, min_kv, max_kv, \ MANDATORY) -#define DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(TYPE, NAME, VER, prog_uid, prog_gid, min_kv, max_kv) \ - DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_uid, prog_gid, min_kv, max_kv, \ +#define DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(TYPE, NAME, VER, prog_gid, min_kv, max_kv) \ + DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_gid, min_kv, max_kv, \ OPTIONAL) // programs requiring a kernel version >= min_kv -#define DEFINE_BPF_PROG_KVER(TYPE, NAME, VER, prog_uid, prog_gid, min_kv) \ - DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_uid, prog_gid, min_kv, KVER_INF, \ +#define DEFINE_BPF_PROG_KVER(TYPE, NAME, VER, prog_gid, min_kv) \ + DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_gid, min_kv, KVER_INF, \ MANDATORY) -#define DEFINE_OPTIONAL_BPF_PROG_KVER(TYPE, NAME, VER, prog_uid, prog_gid, min_kv) \ - DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_uid, prog_gid, min_kv, KVER_INF, \ +#define DEFINE_OPTIONAL_BPF_PROG_KVER(TYPE, NAME, VER, prog_gid, min_kv) \ + DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_gid, min_kv, KVER_INF, \ OPTIONAL) // programs with no kernel version requirements -#define DEFINE_BPF_PROG(TYPE, NAME, VER, prog_uid, prog_gid) \ - DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_uid, prog_gid, KVER_NONE, KVER_INF, \ +#define DEFINE_BPF_PROG(TYPE, NAME, VER, prog_gid) \ + DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_gid, KVER_NONE, KVER_INF, \ MANDATORY) -#define DEFINE_OPTIONAL_BPF_PROG(TYPE, NAME, VER, prog_uid, prog_gid) \ - DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_uid, prog_gid, KVER_NONE, KVER_INF, \ +#define DEFINE_OPTIONAL_BPF_PROG(TYPE, NAME, VER, prog_gid) \ + DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_gid, KVER_NONE, KVER_INF, \ OPTIONAL) diff --git a/bpf/progs/netd.c b/bpf/progs/netd.c index 9c300654b8..bbf0a7fe4e 100644 --- a/bpf/progs/netd.c +++ b/bpf/progs/netd.c @@ -114,7 +114,7 @@ DEFINE_BPF_MAP_EXT(local_net_blocked_uid_map, HASH, uint32_t, bool, -1000, // the kernel acting on behalf of it) must be able to retrieve the pinned program // for the reload to succeed #define DEFINE_XTBPF_PROG(TYPE, NAME, VER) \ - DEFINE_BPF_PROG(TYPE, NAME, VER, AID_ROOT, AID_NET_ADMIN) + DEFINE_BPF_PROG(TYPE, NAME, VER, AID_NET_ADMIN) // programs that need to be usable by netd, but not by netutils_wrappers // (this is because these are currently attached by the mainline provided libnetd_updatable .so diff --git a/bpf/progs/offload.c b/bpf/progs/offload.c index 51221064d1..883065e5fa 100644 --- a/bpf/progs/offload.c +++ b/bpf/progs/offload.c @@ -257,26 +257,24 @@ static inline __always_inline int do_forward6(struct __sk_buff* skb, } // implementation for 5.4+ (can use skb->gso_{segs,size}) -DEFINE_BPF_PROG_KVER(schedcls, tether_downstream6_ether, 5_4, AID_ROOT, AID_NETWORK_STACK, - KVER_5_4) +DEFINE_BPF_PROG_KVER(schedcls, tether_downstream6_ether, 5_4, AID_NETWORK_STACK, KVER_5_4) (struct __sk_buff* skb) { return do_forward6(skb, ETHER, DOWNSTREAM, KVER_5_4); } -DEFINE_BPF_PROG_KVER(schedcls, tether_upstream6_ether, 5_4, AID_ROOT, AID_NETWORK_STACK, - KVER_5_4) +DEFINE_BPF_PROG_KVER(schedcls, tether_upstream6_ether, 5_4, AID_NETWORK_STACK, KVER_5_4) (struct __sk_buff* skb) { return do_forward6(skb, ETHER, UPSTREAM, KVER_5_4); } // implementation for 4.9/4.14/4.19 -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream6_ether, , AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream6_ether, , AID_NETWORK_STACK, KVER_NONE, KVER_5_4) (struct __sk_buff* skb) { return do_forward6(skb, ETHER, DOWNSTREAM, KVER_NONE); } -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream6_ether, , AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream6_ether, , AID_NETWORK_STACK, KVER_NONE, KVER_5_4) (struct __sk_buff* skb) { return do_forward6(skb, ETHER, UPSTREAM, KVER_NONE); @@ -296,39 +294,37 @@ DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream6_ether, , AID_ROOT, AID_NET // and in system/netd/tests/binder_test.cpp NetdBinderTest TetherOffloadForwarding. // // Hence, these mandatory (must load successfully) implementations for 5.4+ kernels: -DEFINE_BPF_PROG_KVER(schedcls, tether_downstream6_rawip, 5_4, AID_ROOT, AID_NETWORK_STACK, - KVER_5_4) +DEFINE_BPF_PROG_KVER(schedcls, tether_downstream6_rawip, 5_4, AID_NETWORK_STACK, KVER_5_4) (struct __sk_buff* skb) { return do_forward6(skb, RAWIP, DOWNSTREAM, KVER_5_4); } -DEFINE_BPF_PROG_KVER(schedcls, tether_upstream6_rawip, 5_4, AID_ROOT, AID_NETWORK_STACK, - KVER_5_4) +DEFINE_BPF_PROG_KVER(schedcls, tether_upstream6_rawip, 5_4, AID_NETWORK_STACK, KVER_5_4) (struct __sk_buff* skb) { return do_forward6(skb, RAWIP, UPSTREAM, KVER_5_4); } // and for 4.14/4.19 kernels -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream6_rawip, 4_14, AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream6_rawip, 4_14, AID_NETWORK_STACK, KVER_4_14, KVER_5_4) (struct __sk_buff* skb) { return do_forward6(skb, RAWIP, DOWNSTREAM, KVER_4_14); } -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream6_rawip, 4_14, AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream6_rawip, 4_14, AID_NETWORK_STACK, KVER_4_14, KVER_5_4) (struct __sk_buff* skb) { return do_forward6(skb, RAWIP, UPSTREAM, KVER_4_14); } // and define no-op stubs for pre-4.14 kernels. -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream6_rawip, stub, AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream6_rawip, stub, AID_NETWORK_STACK, KVER_NONE, KVER_4_14) (__unused struct __sk_buff* skb) { return TC_ACT_PIPE; } -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream6_rawip, stub, AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream6_rawip, stub, AID_NETWORK_STACK, KVER_NONE, KVER_4_14) (__unused struct __sk_buff* skb) { return TC_ACT_PIPE; @@ -644,26 +640,22 @@ static inline __always_inline int do_forward4(struct __sk_buff* skb, // Full featured (required) implementations for 5.10+ kernels (these are S+ by definition) -DEFINE_BPF_PROG_KVER(schedcls, tether_downstream4_rawip, 5_10, AID_ROOT, AID_NETWORK_STACK, - KVER_5_10) +DEFINE_BPF_PROG_KVER(schedcls, tether_downstream4_rawip, 5_10, AID_NETWORK_STACK, KVER_5_10) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, DOWNSTREAM, UPDATETIME, KVER_5_10); } -DEFINE_BPF_PROG_KVER(schedcls, tether_upstream4_rawip, 5_10, AID_ROOT, AID_NETWORK_STACK, - KVER_5_10) +DEFINE_BPF_PROG_KVER(schedcls, tether_upstream4_rawip, 5_10, AID_NETWORK_STACK, KVER_5_10) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, UPSTREAM, UPDATETIME, KVER_5_10); } -DEFINE_BPF_PROG_KVER(schedcls, tether_downstream4_ether, 5_10, AID_ROOT, AID_NETWORK_STACK, - KVER_5_10) +DEFINE_BPF_PROG_KVER(schedcls, tether_downstream4_ether, 5_10, AID_NETWORK_STACK, KVER_5_10) (struct __sk_buff* skb) { return do_forward4(skb, ETHER, DOWNSTREAM, UPDATETIME, KVER_5_10); } -DEFINE_BPF_PROG_KVER(schedcls, tether_upstream4_ether, 5_10, AID_ROOT, AID_NETWORK_STACK, - KVER_5_10) +DEFINE_BPF_PROG_KVER(schedcls, tether_upstream4_ether, 5_10, AID_NETWORK_STACK, KVER_5_10) (struct __sk_buff* skb) { return do_forward4(skb, ETHER, UPSTREAM, UPDATETIME, KVER_5_10); } @@ -672,25 +664,25 @@ DEFINE_BPF_PROG_KVER(schedcls, tether_upstream4_ether, 5_10, AID_ROOT, AID_NETWO // (optional, because we need to be able to fallback for 5.4 pre-S kernels) DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_rawip, opt54, - AID_ROOT, AID_NETWORK_STACK, KVER_5_4, KVER_5_10) + AID_NETWORK_STACK, KVER_5_4, KVER_5_10) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, DOWNSTREAM, UPDATETIME, KVER_5_4); } DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_rawip, opt54, - AID_ROOT, AID_NETWORK_STACK, KVER_5_4, KVER_5_10) + AID_NETWORK_STACK, KVER_5_4, KVER_5_10) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, UPSTREAM, UPDATETIME, KVER_5_4); } DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_ether, opt54, - AID_ROOT, AID_NETWORK_STACK, KVER_5_4, KVER_5_10) + AID_NETWORK_STACK, KVER_5_4, KVER_5_10) (struct __sk_buff* skb) { return do_forward4(skb, ETHER, DOWNSTREAM, UPDATETIME, KVER_5_4); } DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_ether, opt54, - AID_ROOT, AID_NETWORK_STACK, KVER_5_4, KVER_5_10) + AID_NETWORK_STACK, KVER_5_4, KVER_5_10) (struct __sk_buff* skb) { return do_forward4(skb, ETHER, UPSTREAM, UPDATETIME, KVER_5_4); } @@ -699,25 +691,25 @@ DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_ether, opt54, // (optional, because we need to be able to fallback for 4.14/4.19 pre-S kernels) DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_rawip, opt, - AID_ROOT, AID_NETWORK_STACK, KVER_4_14, KVER_5_4) + AID_NETWORK_STACK, KVER_4_14, KVER_5_4) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, DOWNSTREAM, UPDATETIME, KVER_4_14); } DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_rawip, opt, - AID_ROOT, AID_NETWORK_STACK, KVER_4_14, KVER_5_4) + AID_NETWORK_STACK, KVER_4_14, KVER_5_4) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, UPSTREAM, UPDATETIME, KVER_4_14); } DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_ether, opt, - AID_ROOT, AID_NETWORK_STACK, KVER_4_14, KVER_5_4) + AID_NETWORK_STACK, KVER_4_14, KVER_5_4) (struct __sk_buff* skb) { return do_forward4(skb, ETHER, DOWNSTREAM, UPDATETIME, KVER_4_14); } DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_ether, opt, - AID_ROOT, AID_NETWORK_STACK, KVER_4_14, KVER_5_4) + AID_NETWORK_STACK, KVER_4_14, KVER_5_4) (struct __sk_buff* skb) { return do_forward4(skb, ETHER, UPSTREAM, UPDATETIME, KVER_4_14); } @@ -736,13 +728,13 @@ DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_ether, opt, // RAWIP: Required for 5.4-R kernels -- which always support bpf_skb_change_head(). -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_rawip, 5_4, AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_rawip, 5_4, AID_NETWORK_STACK, KVER_5_4, KVER_5_10) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, DOWNSTREAM, NO_UPDATETIME, KVER_5_4); } -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_rawip, 5_4, AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_rawip, 5_4, AID_NETWORK_STACK, KVER_5_4, KVER_5_10) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, UPSTREAM, NO_UPDATETIME, KVER_5_4); @@ -752,26 +744,26 @@ DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_rawip, 5_4, AID_ROOT, AID_ // [Note: fallback for 4.14/4.19 (P/Q) kernels is below in stub section] DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_rawip, 4_14, - AID_ROOT, AID_NETWORK_STACK, KVER_4_14, KVER_5_4) + AID_NETWORK_STACK, KVER_4_14, KVER_5_4) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, DOWNSTREAM, NO_UPDATETIME, KVER_4_14); } DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_rawip, 4_14, - AID_ROOT, AID_NETWORK_STACK, KVER_4_14, KVER_5_4) + AID_NETWORK_STACK, KVER_4_14, KVER_5_4) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, UPSTREAM, NO_UPDATETIME, KVER_4_14); } // ETHER: Required for 4.14-Q/R, 4.19-Q/R & 5.4-R kernels. -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_ether, 4_14, AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_ether, 4_14, AID_NETWORK_STACK, KVER_4_14, KVER_5_10) (struct __sk_buff* skb) { return do_forward4(skb, ETHER, DOWNSTREAM, NO_UPDATETIME, KVER_4_14); } -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_ether, 4_14, AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_ether, 4_14, AID_NETWORK_STACK, KVER_4_14, KVER_5_10) (struct __sk_buff* skb) { return do_forward4(skb, ETHER, UPSTREAM, NO_UPDATETIME, KVER_4_14); @@ -781,13 +773,13 @@ DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_ether, 4_14, AID_ROOT, AID // RAWIP: 4.9-P/Q, 4.14-P/Q & 4.19-Q kernels -- without bpf_skb_change_head() for tc programs -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_rawip, stub, AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_rawip, stub, AID_NETWORK_STACK, KVER_NONE, KVER_5_4) (__unused struct __sk_buff* skb) { return TC_ACT_PIPE; } -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_rawip, stub, AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_rawip, stub, AID_NETWORK_STACK, KVER_NONE, KVER_5_4) (__unused struct __sk_buff* skb) { return TC_ACT_PIPE; @@ -795,13 +787,13 @@ DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_rawip, stub, AID_ROOT, AID // ETHER: 4.9-P/Q kernel -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_ether, stub, AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_ether, stub, AID_NETWORK_STACK, KVER_NONE, KVER_4_14) (__unused struct __sk_buff* skb) { return TC_ACT_PIPE; } -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_ether, stub, AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_ether, stub, AID_NETWORK_STACK, KVER_NONE, KVER_4_14) (__unused struct __sk_buff* skb) { return TC_ACT_PIPE;