Change group owner and permission of tethering eBPF map for network stack
The default tethering eBPF map was only allowed to be accessed by
processes with root. But network stack process doesn't run with
root so it is not able to access the map.
So the group owner and permission of the map need to be changed to
NETWORK_STACK and allow network stack process to read/write the map.
Test: build and check that both group owner and the group permission of
the maps are as expected, network_stack and group read/write.
$ adb shell ls -l /sys/fs/bpf | egrep -e "offload(.*)map"
-rw-rw---- 1 root network_stack [..] map_offload_tether_ingress_map
Change-Id: I6627d01a5e2998a298dbd40215d45e3b6e776276
diff --git a/server/TrafficController.cpp b/server/TrafficController.cpp
index 7e3b005..d6ec6c0 100644
--- a/server/TrafficController.cpp
+++ b/server/TrafficController.cpp
@@ -234,6 +234,9 @@
RETURN_IF_NOT_OK(mUidOwnerMap.clear());
RETURN_IF_NOT_OK(mUidPermissionMap.init(UID_PERMISSION_MAP_PATH));
+ RETURN_IF_NOT_OK(changeOwnerAndMode(TETHER_INGRESS_MAP_PATH, AID_NETWORK_STACK,
+ "TetherIngressMap", S_IRGRP | S_IWGRP));
+
// The programs must be readable to process that modify iptables rules
RETURN_IF_NOT_OK(changeOwnerAndMode(XT_BPF_EGRESS_PROG_PATH, AID_NET_ADMIN,
"XtFilterEgressProgram", S_IRGRP));
