On at least some kernel versions sufficient memlock
is needed for some [types? larger? preallocated?]
bpf map creation requests to succeed.
(the kernel's bpf subsys ignores CAP_IPC_LOCK)
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ia6975e854e6398ee9c56ce836b278b570e17a0f9
Maciej Żenczykowskicommited 2025-03-20 11:54:00 -07:00
Possible since inet_sock_release hook is now enabled on T+ 5.10+
and that will perform map cleanup for us without reliance on
netlink notifications (which aren't available for other types).
Test: atest netd_updatable_unit_test TagSocketTest, adbz_cookies
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I141b1f98ae8e4ce80813194a66a26755925b6683
Maciej Żenczykowskicommited 2025-03-05 14:19:48 -08:00
We already log on init start, and we log all failures,
we don't need an extra log in the middle of init.
I NetdUpdatable: libnetd_updatable_init: Initializing
I NetdUpdatable: initMaps successfully
E NetdUpdatable: libnetd_updatable_init: Failed: (1) [Operation not permitted] : Failed to change RLIMIT_MEMLOCK to 2 GiB
while success looks like:
I netd : netd 1.0 starting
I netd : Pid file removed
I netd : SIGPIPE is blocked
I netd : setCloseOnExec(dnsproxyd)
I netd : setCloseOnExec(fwmarkd)
I NetdUpdatable: libnetd_updatable_init: Initializing
I NetdUpdatable: BPF programs are loaded
I NetdUpdatable: initMaps successfully
I netd : libnetd_updatable_init success
I netd : NetlinkManager instanced
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I8bca9b59363c1f31ecf3de80b9d280a28cce4a14
Maciej Żenczykowskicommited 2025-02-11 14:27:03 -08:00
(it's a bit to pointlessly repetitive)
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Idc84890401c480a562f433a547b5ba6d2ffdc111
Maciej Żenczykowskicommited 2025-02-04 13:54:38 -08:00
most of these are spammy and/or not useful.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Iab101ce7de076ef025a046d5e3e9007e091b271f
Maciej Żenczykowskicommited 2025-01-31 12:53:11 -08:00
Adding this to make sure we have 'unprivileged_bpf_disabled = 0'
This is currently set by NetBpfLoad, but if we remove that things currently work.
However with this change the device then fails to boot:
$ adbz logcat -s -d *:* | egrep -i -C10 bpf
I NetdUpdatable: libnetd_updatable_init: Initializing
I NetdUpdatable: BPF programs are loaded
I NetdUpdatable: initMaps successfully
E NetdUpdatable: libnetd_updatable_init: Failed: (1) [Operation not permitted] : map create failed
This is because even though system/netd/server/netd.rc has:
service netd /system/bin/netd
class main
capabilities CHOWN DAC_OVERRIDE DAC_READ_SEARCH FOWNER IPC_LOCK KILL NET_ADMIN NET_BIND_SERVICE NET_RAW SETUID SETGID
user root
group root net_admin
and we thus run as root/root with CAP_NET_ADMIN, but we do *NOT* have CAP_BPF nor CAP_SYS_ADMIN.
This means netd is considered 'unprivileged' from the point of view of that sysctl.
Creating maps from outside the bpfloader (ie. netd/system server/network stack)
is required for map-in-map.
While the sepolicy for netd.te map_create is in V, there is no real
need for this test on V atm, doing this to prevent *future* regressions.
A rollout purely to the not yet existing 25Q2+ is safer.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ia39c74cfb1707e88b0aa534ddf42139b1698d5d6
Maciej Żenczykowskicommited 2025-01-30 14:58:07 -08:00
V requires 4.19+ and 25Q2+ requires 5.4+
(while 25Q4 will presumably further bump to 5.10+)
On aosp/main we currently have:
ro.build.version.sdk=35
- which is returned by android_get_device_api_level()
ro.build.version.codename=Baklava
- which is looked at by IsAtLeastPreReleaseCodename/GetCodename
This is because we're already past the aosp/main automerge into 25Q1 cutoff.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I909d63406151fbafc15fa248133b9d1a5dc37bdb
Maciej Żenczykowskicommited 2025-01-13 14:37:56 -08:00
Same as the netd change prior, but this is just to make it easier for
AOSP forks to work on legacy devices not meeting V requirements.
Change-Id: I2ebb479b6c9d3d82ee300bb6bf978184bb6c802b
netd is after synchronous start of bpfloader,
so we don't actually need to wait for it at all.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ia1bcf8ac7d6756be44a1382581e6f2b5188bcb58
Maciej Żenczykowskicommited 2024-10-02 22:53:03 +00:00
will land in M-2025-01
should fix some long standing cookie_tag_map full issues
(due to the userspace socket destroy listener code failing to run - likely due to buffer overflow)
Bug: 364365891
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: If78c335488eadf605a54f20005d9b14fdadb6473
Maciej Żenczykowskicommited 2024-09-23 20:21:40 +00:00
Since this is just a special case of a bpf cgroup hook,
it really should be in netd.o with all other such hooks.
Besides moving/renaming the map & programs this should be a no-op.
Test: TreeHugger, atest bpf_existence_test
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I4a2aedaf77f89a9c0a96fa1c369d80659535eabe
Maciej Żenczykowskicommited 2024-09-19 00:40:53 +00:00
Another step towards moving all bpf related stuff into a common directory.
In practice netd_updatable is only actually used for bpf...
The upcoming netbpfload UML test should be checking netd_updatable's
initialization succeeds (useful since that opens a bunch of maps
fetches some programs, and attaches them to a bunch of cgroup hooks).
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I65a0fbbf18bf0aa87938df691c0a9ebcca9a084c
Maciej Żenczykowskicommited 2024-08-29 22:25:51 +00:00
Maciej Żenczykowski
commited 
LuK1337
commited