Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Avoid hardcoded paths to specific APEX jars in the fd allow list."

Browse Source
This commit is contained in:
Treehugger Robot
2020-11-10 16:06:04 +00:00
committed by Gerrit Code Review
parent 181885c868 11a661359e
commit 3e2cfa7b3d
1 changed files with 6 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
core/jni/fd_utils.cpp
View File

@@ -33,16 +33,6 @@
// Static whitelist of open paths that the zygote is allowed to keep open.
static const char* kPathWhitelist[] = {
"/apex/com.android.conscrypt/javalib/conscrypt.jar",
"/apex/com.android.ipsec/javalib/ike.jar",
"/apex/com.android.i18n/javalib/core-icu4j.jar",
"/apex/com.android.media/javalib/updatable-media.jar",
"/apex/com.android.mediaprovider/javalib/framework-mediaprovider.jar",
"/apex/com.android.os.statsd/javalib/framework-statsd.jar",
"/apex/com.android.permission/javalib/framework-permission.jar",
"/apex/com.android.sdkext/javalib/framework-sdkextensions.jar",
"/apex/com.android.wifi/javalib/framework-wifi.jar",
"/apex/com.android.tethering/javalib/framework-tethering.jar",
"/dev/null",
"/dev/socket/zygote",
"/dev/socket/zygote_secondary",
@@ -100,11 +90,12 @@ bool FileDescriptorWhitelist::IsAllowed(const std::string& path) const {
}
}
// Jars from the ART APEX are allowed.
static const char* kArtApexPrefix = "/apex/com.android.art/javalib/";
if (android::base::StartsWith(path, kArtApexPrefix)
&& android::base::EndsWith(path, kJarSuffix)) {
return true;
// Jars from APEXes are allowed. This matches /apex/**/javalib/*.jar.
static const char* kApexPrefix = "/apex/";
static const char* kApexJavalibPathSuffix = "/javalib";
if (android::base::StartsWith(path, kApexPrefix) && android::base::EndsWith(path, kJarSuffix) &&
android::base::EndsWith(android::base::Dirname(path), kApexJavalibPathSuffix)) {
return true;
}
// the in-memory file created by ART through memfd_create is allowed.