Solve one more issue where privilege is required to open a file and
we do not want to grant such to the service. This is the client side
of the picture, init is the server. The file's descriptor was placed
into the environment as "ANDROID_FILE_<path>" where non-alpha and
non-numeric characters in the <path> are replaced with _ and this
function picks the file descriptor up.
Added definition ANDROID_FILE_ENV_PREFIX ("ANDROID_FILE_") and
android_get_control_file() prototype in a new include <cutils/files.h>
android_get_control_file() checks if the resulting file descriptor is
valid, open and matches the name reference, which on purpose will fail
if a symbolic link is in the path rather than using a fully qualified
path. Add gTest unit test for both.
Test: gTest libcutils_test --gtest_filter=FileTest.android_get_control_file
Bug: 32450474
Change-Id: I2d0310a1727f1e393a00d9fc7e6cf5d028f27905
android_get_control_socket() checks if the resulting file descriptor
is valid, open and matches the socket bound name reference, which on
purpose will fail if a symbolic link is in the path rather than using
a fully qualified path. If there are any non-alpha and non-numeric
characters in the name, they are replaced with _. Add unit test.
Test: gTest libcutils_test --gtest_filter=SocketTest.android_get_control_socket
Bug: 32450474
Change-Id: I27a6419012033ef8bd6ca04f3e479d01264d8c49
NB: bionic stdio is broken when providing appropriate errno value(s)
on failure so libc.__pstore_append will not report pmsg
misconfigured correctly on android for now.
Test: misconfigured kernel, watch for this message in liblog-unit-tests
Change-Id: Ifb1b550c7d3a3888000459c2f68c392cc23c379f
Do not allow anyone to see logd memory.
Test: gTest logd-unit-tests, liblog-unit-tests and logcat-unit-tests
Bug: 32450474
Change-Id: Ic7377efcb7e1d3cd91b50741061037a0fb589045
In zygote wrapping mode, ZygoteConnection does a check to see if the pid
reported by the wrapped process is either child process that was
forked, or a decendent of it. This requires read access to other
processes /proc files. Grant zygote AID_READPROC to allow this access.
Bug: 32610632
Test: manual inspection of /proc files to verify group.
Test: manual inspection of zygote's children to make sure they do not
inherit AID_READPROC
Change-Id: I3619a9ae33c8077e068e8024f7c7d44cfca6fb76
Ambient capabilities are inherited in a straightforward way across
execve(2):
"
If you are nonroot but you have a capability, you can add it to pA.
If you do so, your children get that capability in pA, pP, and pE.
For example, you can set pA = CAP_NET_BIND_SERVICE, and your
children can automatically bind low-numbered ports.
"
This will allow us to get rid of the special meaning for AID_NET_ADMIN
and AID_NET_RAW, and if desired, to reduce the use of file capabilities
(which grant capabilities to any process that can execute the file). An
additional benefit of the latter is that a single .rc file can specify
all properties for a service, without having to rely on a separate file
for file capabilities.
Ambient capabilities are supported starting with kernel 4.3 and have
been backported to all Android common kernels back to 3.10.
I chose to not use Minijail here (though I'm still using libcap) for
two reasons:
1-The Minijail code is designed to work in situations where the process
is holding any set of capabilities, so it's more complex. The situation
when forking from init allows for simpler code.
2-The way Minijail is structured right now, we would not be able to
make the required SELinux calls between UID/GID dropping and other priv
dropping code. In the future, it will make sense to add some sort of
"hook" to Minijail so that it can be used in situations where we want
to do other operations between some of the privilege-dropping
operations carried out by Minijail.
Bug: 32438163
Test: Use sample service.
Change-Id: I3226cc95769d1beacbae619cb6c6e6a5425890fb
This function is always called by the frameworks in order to
initialize vulkan layer path. For NB apps returning nullptr
disables vulkan layer library lookup as expected.
Bug: http://b/32542970
Test: mm
Change-Id: I426b2b9f5ea7227b00f063ed6040f37bb2b4f21f
The webview_zygote is a non-root zygote process that creates isolated_app
children for rendering web content. It needs:
- CAP_SETUID and CAP_SETGID to change the UID of the new child process.
- CAP_SETPCAP to clear the capability bounding set after forking.
Test: m
Test: angler boots
Bug: 21643067
Change-Id: I986fa04be54e812f5dd2afa14e5d2d3e474e2b10
bootcharts currently only show root's processes, which isn't very
useful. To investigate and track boot duration issues, we need a way for
init to see all the pids. Add init to GID 3009 (aka AID_READPROC)
Ensure that init's children don't inherit this GID by always clearing
supplementary group IDs on fork.
Bug: 32506197
Test: Device boots and /proc/1/status says init is in gid 3009
Test: zygote starts and the Group: line in /proc/ZYGOTEPID/status is empty
Change-Id: Iba90717aaa591f1d6030a379a272aee003600c0a
Not-Tested: bootchart actually works. Speculative fix.
Add a command to reconnect offline/unauthorized devices, mainly for use
with the inotify-monitoring of vendor key directories added by 2e671202.
Bug: http://b/29273531
Test: manually tested with a sailfish + copying vendor keys
Change-Id: If34cccee4ae553ada65d128b57d03cba8c0d7c46
The CL adds FuseBridgeLoop class to libappfuse, which is used in the
system service to proxy fuse commands to applications.
Bug: 29970149
Test: libappfuse_test
Change-Id: I0708f608b3868721ab16ba4028fd2c17a6735af7
The CL adds utility functions to framework to parse FUSE messages
from the kernel. The library will be used from framework JNI and service
JNI.
Bug: 32260320
Test: libappfuse_test
Change-Id: Ib89b26d34789e6c26a3288beceb3ea145c1ae780
But not for Windows, because even dealing with environment variables is
too hard there (and no Windows user has complained yet).
Bug: http://b/30184452
Test: manual
Change-Id: I2d60049ed0049a9532414a7cdecbd0687e06aba7
Services implementing HIDL HALs must be named the same as the HIDL
package, e.g. android.hardware.nfc@1.0. Allow init to accept names
containing '.' and '@'.
Also combined logic for legal property names and legal service names.
Bug: 31458381
Bug: 32109611
Test: Tested creating service nfc@1.0-service which creates property
'init.svc.nfc@1.0-service' with and without this change. This service
successfully started only with this change.
Change-Id: Ie7a4310742bc03498d774d37b3b5fafa7c6068cc
Signed-off-by: Iliyan Malchev <malchev@google.com>
Bug: http://b/31320715
Test: No regression in 32-bit and 64-bit backtrace_test on host and
angler.
Change-Id: Ic5c5511e89ca7707ed9c13d5ba0539e09310dfe3
getTag() becomes invalid when entry is dropped because mMsg
disappears to save space; but the per-tag spam filter depends on it
still being valid. Conserve space in LogBufferElement by optimizing
the size of the fields, then add a new mTag field that is set in the
object constructor. Add an isBinary() method.
SideEffects: save 12 bytes/log message overhead on 64-bit.
Test: define DEBUG_CHECK_FOR_STALE_ENTRIES and look for stale entries
Bug: 32247044
Change-Id: Iaa5f416718a92c9e0e6ffd56bd5260d8b908d5c0
Mark Salyzyn
Treehugger Robot
Jin Qian
Nick Kralevich
Steven Moreland
Jorge Lucangeli Obes
Dimitry Ivanov
Josh Gao
Robert Sesek
Wei Wang
Elliott Hughes
Keun-young Park
Daichi Hirono
Pirama Arumuga Nainar
Iliyan Malchev
Roshan Pius