netbpfload: remove support for 'platform'
Test: N/A Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: Ia0c1f55aa78435737699e0dec0bfddbd977e7392
This commit is contained in:
@@ -93,18 +93,6 @@ constexpr bpf_prog_type kTetheringApexAllowedProgTypes[] = {
|
||||
BPF_PROG_TYPE_XDP,
|
||||
};
|
||||
|
||||
// Networking-related program types are limited to the Tethering Apex
|
||||
// to prevent things from breaking due to conflicts on mainline updates
|
||||
// (exception made for socket filters, ie. xt_bpf for potential use in iptables,
|
||||
// or for attaching to sockets directly)
|
||||
constexpr bpf_prog_type kPlatformAllowedProgTypes[] = {
|
||||
BPF_PROG_TYPE_KPROBE,
|
||||
BPF_PROG_TYPE_PERF_EVENT,
|
||||
BPF_PROG_TYPE_SOCKET_FILTER,
|
||||
BPF_PROG_TYPE_TRACEPOINT,
|
||||
BPF_PROG_TYPE_UNSPEC, // Will be replaced with fuse bpf program type
|
||||
};
|
||||
|
||||
// see b/162057235. For arbitrary program types, the concern is that due to the lack of
|
||||
// SELinux access controls over BPF program attachpoints, we have no way to control the
|
||||
// attachment of programs to shared resources (or to detect when a shared resource
|
||||
@@ -157,14 +145,6 @@ const android::bpf::Location locations[] = {
|
||||
.allowedProgTypes = kTetheringApexAllowedProgTypes,
|
||||
.allowedProgTypesLength = arraysize(kTetheringApexAllowedProgTypes),
|
||||
},
|
||||
// Core operating system
|
||||
{
|
||||
.dir = "/system/etc/bpf/",
|
||||
.prefix = "",
|
||||
.allowedDomainBitmask = domainToBitmask(domain::platform),
|
||||
.allowedProgTypes = kPlatformAllowedProgTypes,
|
||||
.allowedProgTypesLength = arraysize(kPlatformAllowedProgTypes),
|
||||
},
|
||||
// Vendor operating system
|
||||
{
|
||||
.dir = "/vendor/etc/bpf/",
|
||||
|
||||
Reference in New Issue
Block a user