Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Install setresuid()/setresgid() seccomp filter in AppZygote.

Browse Source 
Transition app_zygote to the slightly less restrictive app_zygote
seccomp filter; install a separate uid/gid filter to mitigate the
risk.

Bug: 111434506
Test: atest CtsSeccompHostTestCases passes

Change-Id: I8bf85ce4bbfe843d1a161ae6408c7003e729c062
This commit is contained in:
Martijn Coenen
2019-01-18 16:40:01 +01:00
parent 86f08a5190
commit 6ef1680964
1 changed files with 1 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
core/jni/com_android_internal_os_Zygote.cpp
View File

@@ -312,10 +312,7 @@ static void SetUpSeccompFilter(uid_t uid, bool is_child_zygote) {
// Apply system or app filter based on uid.
if (uid >= AID_APP_START) {
if (is_child_zygote) {
// set_app_zygote_seccomp_filter();
// TODO(b/111434506) install the filter; for now, install the app filter
// which is more restrictive.
set_app_seccomp_filter();
set_app_zygote_seccomp_filter();
} else {
set_app_seccomp_filter();
}
@@ -1309,14 +1306,10 @@ static void com_android_internal_os_Zygote_nativeInstallSeccompUidGidFilter(
return;
}
// TODO(b/111434506) install the filter
/*
bool installed = install_setuidgid_seccomp_filter(uidGidMin, uidGidMax);
if (!installed) {
RuntimeAbort(env, __LINE__, "Could not install setuid/setgid seccomp filter.");
}
*/
}
static const JNINativeMethod gMethods[] = {