tree 040dce440152a2c85ca56e1aabbd25c5dd17081b
parent 8e0b882cd6851c15ca16b805560833758e5d9a31
author Chenbo Feng <fengc@google.com> 1521585764 -0700
committer Chenbo Feng <fengc@google.com> 1521655563 -0700

Allow netd to setup xt_bpf iptable rules

To better record the network traffic stats for each network interface.
We use xt_bpf netfilter module to do the iface stats accounting instead
of the cgroup bpf filter we currently use for per uid stats accounting.
The xt_bpf module will take pinned eBPF program as iptables rule and run
the program when packet pass through the netfilter hook. To setup the
iptables rules. netd need to be able to access bpf filesystem and run the
bpf program at boot time. The program used will still be created and
pinned by the bpfloader process.

Test: With selinux enforced, run "iptables -L -t raw" should show the
xt_bpf related rule present in bw_raw_PREROUTING chain.
Bug: 72111305

Change-Id: I11efe158d6bd5499df6adf15e8123a76cd67de04