ID:
BPF_MAP_ACCESSIBLECategory: Routes and network stack Status in RKNHardering 2.10.0: Active check Role in the verdict: High
This page describes the actual implementation in RKNHardering 2.10.0. It distinguishes what can be done without root, what requires root, and where a mitigation only reduces one signal without hiding the VPN as a whole.
The legacy probe attempts to open three paths read-only: /sys/fs/bpf/map_netd_iface_index_name_map, /sys/fs/bpf/netd_shared/map_netd_iface_index_name_map, and /sys/fs/bpf/netd_iface_index_name_map. A successful open emits bpf_map_accessible; the legacy policy classifies it as high confidence.
An ordinary app process can open one of the fixed BPF pin paths.
Access is normally restricted on stock Android. If available, the map may expose an ifindex-to-name mapping and bypass superficial hiding.
How the line affects the report: The line sets detected=true and is treated as a high-confidence local indicator.
The probe only tests whether the path can be opened; it does not read the map or confirm that a VPN entry exists. Path layouts vary across Android versions.
This line must be evaluated together with neighboring signals. A clean result from a single API does not simultaneously cover Java Binder, libc, raw netlink/syscalls, procfs/sysfs, local sockets, and server-side indicators.
Do not weaken SELinux or BPF filesystem permissions on a production ROM. If access is exposed by a custom ROM, the cleanest option is a stock enforcing build.
Apply the smallest policy fix: the target UID should not be able to read netd maps. Do not disable BPF or netd globally. VPNHide Next claims eBPF filtering, but this is a high-risk kernel-level experiment.
adb shell ls -l /sys/fs/bpf 2>/dev/null | head -80
adb shell 'for p in /sys/fs/bpf/map_netd_iface_index_name_map /sys/fs/bpf/netd_shared/map_netd_iface_index_name_map /sys/fs/bpf/netd_iface_index_name_map; do [ -r "$p" ] && echo readable:$p; done'
Shell access is not equivalent to access from the app UID.
After any change, force-stop both RKNHardering and the VPN client, start them again, and repeat the full scan. Zygisk, Xposed, and kernel modules usually require a reboot. Compare not only this line but also neighboring signals: a partial hook often creates inconsistencies between APIs.
The probe itself runs with ordinary app permissions and does not request root. The ADB commands below are for orientation only: adb shell runs under a different UID and may see either more or less than the app process. The decisive test is to run the check again after a force-stop.
Changing netd BPF maps or policy can break traffic accounting, the firewall, and networking. Do not delete pinned maps.
Revert the sepolicy or module change and restart netd or the device; if the system is unstable, restore the boot image.
High. Verified against the three paths; classified as legacy high confidence.
The status of a third-party solution does not automatically carry over to this device. A module developer’s claim is only the initial hypothesis; confirmation requires a reproducible RKNHardering result on the specific Android version, firmware, and kernel.
native_signs_probe.cpp — native probe implementation.NativeSignsChecker.kt — main native/legacy verdict logic.NativeSignalId.kt — complete ID registry.NativeSignalCatalog.kt — category, slug, and line mapping.Related signals: deep-bpf-map-accessible, ifindexname-vpn.