tree 1a5a3a17136bb3ee34f226a5efda823099c145d0
parent 8b049d5b6f44f7e51109814bc3bdd9d2ee7faf2a
author Chenbo Feng <fengc@google.com> 1514935878 -0800
committer Chenbo Feng <fengc@google.com> 1516231170 +0000

Add sepolicy to lock down bpf access

Add a new set of sepolicy for the process that only netd use to load
and run ebpf programs. It is the only process that can load eBPF
programs into the kernel and is only used to do that. Add some
neverallow rules regarding which processes have access to bpf objects.

Test: program successfully loaded and pinned at sys/fs/bpf after device
boot. No selinux violation for bpfloader
Bug: 30950746

Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f