joy/android_system_bpf
Watch
1
Fork
You've already forked android_system_bpf
 0
Code Issues Pull requests Projects Releases Wiki Activity

Add cgroup socket bpf kernel program support

Browse source 
Add support for cgroup socket filter program loading in bpfloader,
and create a uid permission map to store the uids that have INTERNET
permission.

Bug: 111560570
Bug: 111560739
Test: dumpsys netd trafficcontroller

Change-Id: I658f533d302cb594d7b36d4a3a2a70e394874c33
This commit is contained in:
Chenbo Feng 2018-12-26 16:14:05 -08:00
commit 5aee2f14a5
3 changed files with 18 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

13
libbpf_android/Loader.cpp
View file

@ -63,14 +63,15 @@ typedef struct {
* is the name of the program, and tracepoint is the type.
*/
sectionType sectionNameTypes[] = {
{ "kprobe", BPF_PROG_TYPE_KPROBE },
{ "tracepoint", BPF_PROG_TYPE_TRACEPOINT },
{ "skfilter", BPF_PROG_TYPE_SOCKET_FILTER },
{ "cgroupskb", BPF_PROG_TYPE_CGROUP_SKB },
{ "schedcls", BPF_PROG_TYPE_SCHED_CLS },
{"kprobe", BPF_PROG_TYPE_KPROBE},
{"tracepoint", BPF_PROG_TYPE_TRACEPOINT},
{"skfilter", BPF_PROG_TYPE_SOCKET_FILTER},
{"cgroupskb", BPF_PROG_TYPE_CGROUP_SKB},
{"schedcls", BPF_PROG_TYPE_SCHED_CLS},
{"cgroupsock", BPF_PROG_TYPE_CGROUP_SOCK},
/* End of table */
{ "END", BPF_PROG_TYPE_UNSPEC },
{"END", BPF_PROG_TYPE_UNSPEC},
};
typedef struct {

5
progs/Android.bp
View file

@ -24,5 +24,8 @@ bpf {
"-Wall",
"-Werror",
],
include_dirs: ["system/netd/libnetdbpf/include"],
include_dirs: [
"system/netd/libnetdbpf/include",
"system/netd/libnetdutils/include",
],
}

7
progs/netd.c
View file

@ -58,4 +58,11 @@ int xt_bpf_blacklist_prog(struct __sk_buff* skb) {
return BPF_NOMATCH;
}
struct bpf_map_def SEC("maps") uid_permission_map = {
.type = BPF_MAP_TYPE_HASH,
.key_size = sizeof(uint32_t),
.value_size = sizeof(uint8_t),
.max_entries = UID_OWNER_MAP_SIZE,
};
char _license[] SEC("license") = "Apache 2.0";