pa-fazil
/
android_packages_modules_Virtualization
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Explicitly specify capabilities of root services in microdroid 

This is a semi-automatic change to simply specify the capabilities that
these services have according to the sepolicy.

List of capabilities for each service was obtained by running:
`sesearch --allow -c capability,capability2 /tmp/microdroid-policy`

The policy specifies that all processes have CAP_AUDIT_CONTROL, but it
doesn't seem to be actually required, so it's omitted from the service
definitions.

Also switch tombstone_transmit to run as system user.

Test: presubmit
Test: atest --test-mapping packages/modules/Virtualization:avf-presubmit
Test: run demo app and verify capabilities of microdroid_launcher
Test: atest com.android.microdroid.test.MicrodroidTestCase#testTombstonesAreGeneratedUponCrash
Bug: 243633980
Bug: 249796710
Change-Id: I19b0cefb07fc7480b3f9dc05cb708a899489fe65
This commit is contained in:
Nikita Ioffe 2022-09-30 18:40:05 +01:00
parent 7710a6dd54
commit 7c6b2705e9
2 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
microdroid/init.rc
View File

@ -177,7 +177,7 @@ on post-fs-data
mkdir /data/local/tmp 0771 shell shell mkdir /data/local/tmp 0771 shell shell
service tombstone_transmit /system/bin/tombstone_transmit.microdroid -cid 2 -port 2000 -remove_tombstones_after_transmitting service tombstone_transmit /system/bin/tombstone_transmit.microdroid -cid 2 -port 2000 -remove_tombstones_after_transmitting
user root user system
group system group system
shutdown critical shutdown critical
@ -186,12 +186,14 @@ service apexd-vm /system/bin/apexd --vm
group system group system
oneshot oneshot
disabled disabled
capabilities CHOWN DAC_OVERRIDE DAC_READ_SEARCH FOWNER SYS_ADMIN
service ueventd /system/bin/ueventd service ueventd /system/bin/ueventd
class core class core
critical critical
seclabel u:r:ueventd:s0 seclabel u:r:ueventd:s0
shutdown critical shutdown critical
capabilities CHOWN DAC_OVERRIDE DAC_READ_SEARCH FOWNER FSETID MKNOD NET_ADMIN SETGID SETUID SYS_MODULE SYS_RAWIO
service console /system/bin/sh service console /system/bin/sh
class core class core

2
microdroid_manager/microdroid_manager.rc
View File

@ -4,3 +4,5 @@ service microdroid_manager /system/bin/microdroid_manager
setenv RUST_LOG info setenv RUST_LOG info
# TODO(jooyung) remove this when microdroid_manager becomes a daemon # TODO(jooyung) remove this when microdroid_manager becomes a daemon
oneshot oneshot
# SYS_BOOT is required to exec kexecload from microdroid_manager
capabilities AUDIT_CONTROL SYS_ADMIN SYS_BOOT