PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

grant bpfloader CAP_CHOWN

Browse Source 
so that it can change the uid/gid of pinned bpf progs and maps

Test: build, atest
Bug: 149434314
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I1d873c7799e1d9fa5d4bde145e89254dabb75a01
This commit is contained in:
Maciej Żenczykowski 2020-01-27 07:10:40 -08:00
parent d9b78b4c84
commit 1189fac418
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
private/bpfloader.te
View File

@ -12,7 +12,7 @@ allow bpfloader devpts:chr_file { read write };
# for retrieving a pinned map when bpfloader do a run time restart.
allow bpfloader self:bpf { prog_load prog_run map_read map_write map_create };
allow bpfloader self:global_capability_class_set sys_admin;
allow bpfloader self:capability { chown sys_admin };
###
### Neverallow rules