5c95c16841
To better record the network traffic stats for each network interface. We use xt_bpf netfilter module to do the iface stats accounting instead of the cgroup bpf filter we currently use for per uid stats accounting. The xt_bpf module will take pinned eBPF program as iptables rule and run the program when packet pass through the netfilter hook. To setup the iptables rules. netd need to be able to access bpf filesystem and run the bpf program at boot time. The program used will still be created and pinned by the bpfloader process. Test: With selinux enforced, run "iptables -L -t raw" should show the xt_bpf related rule present in bw_raw_PREROUTING chain. Bug: 72111305 Change-Id: I11efe158d6bd5499df6adf15e8123a76cd67de04
16 lines
445 B
Plaintext
16 lines
445 B
Plaintext
typeattribute netd coredomain;
|
|
|
|
init_daemon_domain(netd)
|
|
|
|
# Allow netd to spawn dnsmasq in it's own domain
|
|
domain_auto_trans(netd, dnsmasq_exec, dnsmasq)
|
|
|
|
# Allow netd to start clatd in its own domain
|
|
domain_auto_trans(netd, clatd_exec, clatd)
|
|
|
|
# Allow netd to start bpfloader_exec in its own domain
|
|
domain_auto_trans(netd, bpfloader_exec, bpfloader)
|
|
|
|
# give netd permission to setup iptables rule with xt_bpf
|
|
allow netd bpfloader:bpf prog_run;
|