commit 707918a67bc93309c2cbe42ed056af115008a3d0
author Hungming Chen <nuccachen@google.com> Sun Jan 16 17:40:51 2022 +0800
committer Hungming Chen <nuccachen@google.com> Tue Jan 18 17:09:05 2022 +0800
tree f60a15d291524069a450054640e261851b0be0d4
parent 99aeade0a39a50c72143a9ef8e352190778b5c2c

Change gid of clat progs and maps to AID_SYSTEM

Since clat progs and maps are accessed by system server,
update the group id to system.

Bug: 212345928
Test: ping 8.8.8.8 under ipv6-only network
Change-Id: I58682c9db98592a0521230b663ec8fb63c1b4aff

bpf_progs/clatd.c

diff --git a/bpf_progs/clatd.c b/bpf_progs/clatd.c
index 5a8a853..dc646c3 100644
--- a/bpf_progs/clatd.c
+++ b/bpf_progs/clatd.c
@@ -37,7 +37,7 @@
 // From kernel:include/net/ip.h
 #define IP_DF 0x4000  // Flag: "Don't Fragment"
 
-DEFINE_BPF_MAP(clat_ingress6_map, HASH, ClatIngress6Key, ClatIngress6Value, 16)
+DEFINE_BPF_MAP_GRW(clat_ingress6_map, HASH, ClatIngress6Key, ClatIngress6Value, 16, AID_SYSTEM)
 
 static inline __always_inline int nat64(struct __sk_buff* skb, bool is_ethernet) {
     const int l2_header_size = is_ethernet ? sizeof(struct ethhdr) : 0;
@@ -179,24 +179,24 @@
     return TC_ACT_PIPE;
 }
 
-DEFINE_BPF_PROG("schedcls/ingress6/clat_ether", AID_ROOT, AID_ROOT, sched_cls_ingress6_clat_ether)
+DEFINE_BPF_PROG("schedcls/ingress6/clat_ether", AID_ROOT, AID_SYSTEM, sched_cls_ingress6_clat_ether)
 (struct __sk_buff* skb) {
     return nat64(skb, true);
 }
 
-DEFINE_BPF_PROG("schedcls/ingress6/clat_rawip", AID_ROOT, AID_ROOT, sched_cls_ingress6_clat_rawip)
+DEFINE_BPF_PROG("schedcls/ingress6/clat_rawip", AID_ROOT, AID_SYSTEM, sched_cls_ingress6_clat_rawip)
 (struct __sk_buff* skb) {
     return nat64(skb, false);
 }
 
-DEFINE_BPF_MAP(clat_egress4_map, HASH, ClatEgress4Key, ClatEgress4Value, 16)
+DEFINE_BPF_MAP_GRW(clat_egress4_map, HASH, ClatEgress4Key, ClatEgress4Value, 16, AID_SYSTEM)
 
-DEFINE_BPF_PROG("schedcls/egress4/clat_ether", AID_ROOT, AID_ROOT, sched_cls_egress4_clat_ether)
+DEFINE_BPF_PROG("schedcls/egress4/clat_ether", AID_ROOT, AID_SYSTEM, sched_cls_egress4_clat_ether)
 (struct __sk_buff* skb) {
     return TC_ACT_PIPE;
 }
 
-DEFINE_BPF_PROG("schedcls/egress4/clat_rawip", AID_ROOT, AID_ROOT, sched_cls_egress4_clat_rawip)
+DEFINE_BPF_PROG("schedcls/egress4/clat_rawip", AID_ROOT, AID_SYSTEM, sched_cls_egress4_clat_rawip)
 (struct __sk_buff* skb) {
     void* data = (void*)(long)skb->data;
     const void* data_end = (void*)(long)skb->data_end;