joy/android_system_bpf
Watch
1
Fork
You've already forked android_system_bpf
 0
Code Issues Pull requests Projects Releases Wiki Activity

Revert "Grant IPC_LOCK capability to bpfloader"

Browse source 
This reverts commit 77494d2b70.

This doesn't apparently work...

Kernel doesn't actually test capabilities, just blindly charges
against user's memlock limit:

//kernel/bpf/syscall.c:

static int bpf_charge_memlock(struct user_struct *user, u32 pages) {
  unsigned long memlock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;

  if (atomic_long_add_return(pages, &user->locked_vm) > memlock_limit) {
    atomic_long_sub(pages, &user->locked_vm);
    return -EPERM;
  }
  return 0;
}

Test: N/A, revert
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Icf6d6e8a36e4b9f3771a5ce80e25ef3644ff4e83
This commit is contained in:
Maciej Żenczykowski 2020-01-27 15:32:45 +00:00
commit 3c057e6b7b
1 changed files with 6 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

7
bpfloader/bpfloader.rc
View file

@ -1,4 +1,9 @@
service bpfloader /system/bin/bpfloader
class main
capabilities SYS_ADMIN IPC_LOCK
capabilities SYS_ADMIN
# Set RLIMIT_MEMLOCK to 64MB for bpfloader
# Actually only 8MB is needed, but since bpfloader runs as root, it shares
# the global rlimit. Once bpfloader is running as its own user in the
# future, it will have dedicated rlimit to itself and this can be 8MB.
rlimit memlock 67108864 67108864
oneshot