Conversation

Daniel Micay
@DanielMicay
twitter.com/GrapheneOS/sta We haven't been able to fix the issues we identified with the Android 11 and later eBPF-based INTERNET permission yet. For now, we've added back the simpler traditional approach as an additional layer. It's only 6 lines of code so we might just keep it...
Quote Tweet
GrapheneOS
@GrapheneOS
GrapheneOS 2021.04.22.20 release: grapheneos.org/releases#2021.. See the linked release notes for an overview of the changes since the previous release.
1
9
Daniel Micay
@DanielMicay
They switched to eBPF to work around not being able to land that kind of functionality upstream. There's something to be said for being able to define those policies in userspace rather than hard-wiring them in the kernel but the code to manage it is complicated and has bugs...
1
6
Daniel Micay
@DanielMicay
Android restricts BPF to only being usable by a bpfloader domain and only a few very privileged processes can make use of that domain. Issue isn't attack surface but rather that the userspace code for managing it is complex. It has issues and solving them is proving difficult.
1
3
Daniel Micay
@DanielMicay
Even once we resolve the issues, we'll probably keep the redundant kernel code around. AOSP is meant to fully work with mainline kernels, so what they did makes sense. However, that's irrelevant to us, and keeping around 6 lines of code to avoid trusting 15k LOC makes sense.
1
4