LineageOS/android_packages_modules_Connectivity
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

netd.c: factor out get_app_permissions()

Browse Source 
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: If33414eccefb35e6aefbd4ec0c24b208e564ca7e
This commit is contained in:
Maciej Żenczykowski
2023-10-07 19:33:39 +00:00
parent 901c71051e
commit f060849988
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
bpf_progs/netd.c
View File

@@ -637,9 +637,7 @@ DEFINE_XTBPF_PROG("skfilter/denylist/xtbpf", AID_ROOT, AID_NET_ADMIN, xt_bpf_den
return BPF_NOMATCH; return BPF_NOMATCH;
} }
DEFINE_NETD_BPF_PROG_KVER("cgroupsock/inet/create", AID_ROOT, AID_ROOT, inet_socket_create, static __always_inline inline uint8_t get_app_permissions() {
KVER_4_14)
(struct bpf_sock* sk) {
uint64_t gid_uid = bpf_get_current_uid_gid(); uint64_t gid_uid = bpf_get_current_uid_gid();
/* /*
* A given app is guaranteed to have the same app ID in all the profiles in * A given app is guaranteed to have the same app ID in all the profiles in
@@ -649,13 +647,15 @@ DEFINE_NETD_BPF_PROG_KVER("cgroupsock/inet/create", AID_ROOT, AID_ROOT, inet_soc
*/ */
uint32_t appId = (gid_uid & 0xffffffff) % AID_USER_OFFSET; // == PER_USER_RANGE == 100000 uint32_t appId = (gid_uid & 0xffffffff) % AID_USER_OFFSET; // == PER_USER_RANGE == 100000
uint8_t* permissions = bpf_uid_permission_map_lookup_elem(&appId); uint8_t* permissions = bpf_uid_permission_map_lookup_elem(&appId);
if (!permissions) { // if UID not in map, then default to just INTERNET permission.
// UID not in map. Default to just INTERNET permission. return permissions ? *permissions : BPF_PERMISSION_INTERNET;
return 1; }
}
DEFINE_NETD_BPF_PROG_KVER("cgroupsock/inet/create", AID_ROOT, AID_ROOT, inet_socket_create,
KVER_4_14)
(struct bpf_sock* sk) {
// A return value of 1 means allow, everything else means deny. // A return value of 1 means allow, everything else means deny.
return (*permissions & BPF_PERMISSION_INTERNET) == BPF_PERMISSION_INTERNET; return (get_app_permissions() & BPF_PERMISSION_INTERNET) ? 1 : 0;
} }
LICENSE("Apache 2.0"); LICENSE("Apache 2.0");