Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Fix seccomp filter set up in zygote"

Browse Source
This commit is contained in:
Victor Hsieh
2018-03-29 20:37:33 +00:00
committed by Gerrit Code Review
parent b57de56276 fa046a1c9e
commit 29d32fb55b
1 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
core/jni/com_android_internal_os_Zygote.cpp
View File

@@ -260,7 +260,7 @@ static void SetUpSeccompFilter(uid_t uid) {
} }
// Apply system or app filter based on uid. // Apply system or app filter based on uid.
if (getuid() >= AID_APP_START) { if (uid >= AID_APP_START) {
set_app_seccomp_filter(); set_app_seccomp_filter();
} else { } else {
set_system_seccomp_filter(); set_system_seccomp_filter();
@@ -619,11 +619,6 @@ static pid_t ForkAndSpecializeCommon(JNIEnv* env, uid_t uid, gid_t gid, jintArra
fail_fn(CREATE_ERROR("sigprocmask(SIG_SETMASK, { SIGCHLD }) failed: %s", strerror(errno))); fail_fn(CREATE_ERROR("sigprocmask(SIG_SETMASK, { SIGCHLD }) failed: %s", strerror(errno)));
} }
// Must be called when the new process still has CAP_SYS_ADMIN. The other alternative is to
// call prctl(PR_SET_NO_NEW_PRIVS, 1) afterward, but that breaks SELinux domain transition (see
// b/71859146).
SetUpSeccompFilter(uid);
// Keep capabilities across UID change, unless we're staying root. // Keep capabilities across UID change, unless we're staying root.
if (uid != 0) { if (uid != 0) {
if (!EnableKeepCapabilities(&error_msg)) { if (!EnableKeepCapabilities(&error_msg)) {
@@ -697,6 +692,13 @@ static pid_t ForkAndSpecializeCommon(JNIEnv* env, uid_t uid, gid_t gid, jintArra
fail_fn(CREATE_ERROR("setresgid(%d) failed: %s", gid, strerror(errno))); fail_fn(CREATE_ERROR("setresgid(%d) failed: %s", gid, strerror(errno)));
} }
// Must be called when the new process still has CAP_SYS_ADMIN, in this case, before changing
// uid from 0, which clears capabilities. The other alternative is to call
// prctl(PR_SET_NO_NEW_PRIVS, 1) afterward, but that breaks SELinux domain transition (see
// b/71859146). As the result, privileged syscalls used below still need to be accessible in
// app process.
SetUpSeccompFilter(uid);
rc = setresuid(uid, uid, uid); rc = setresuid(uid, uid, uid);
if (rc == -1) { if (rc == -1) {
fail_fn(CREATE_ERROR("setresuid(%d) failed: %s", uid, strerror(errno))); fail_fn(CREATE_ERROR("setresuid(%d) failed: %s", uid, strerror(errno)));