Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Improve container capability bounding in containers"

Browse Source 
am: 586fd52b34

Change-Id: I7c67b571164e67b3e4a8ae9c9a2701e338693a4b
This commit is contained in:
Luis Hector Chavez
2017-08-16 21:32:13 +00:00
committed by android-build-merger
parent 5bef43fb64 586fd52b34
commit ed05287c55
2 changed files with 34 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
core/java/com/android/internal/os/ZygoteInit.java
View File

@@ -43,6 +43,8 @@ import android.security.keystore.AndroidKeyStoreProvider;
import android.system.ErrnoException; import android.system.ErrnoException;
import android.system.Os; import android.system.Os;
import android.system.OsConstants; import android.system.OsConstants;
import android.system.StructCapUserData;
import android.system.StructCapUserHeader;
import android.text.Hyphenator; import android.text.Hyphenator;
import android.util.BootTimingsTraceLog; import android.util.BootTimingsTraceLog;
import android.util.EventLog; import android.util.EventLog;
@@ -88,7 +90,6 @@ public class ZygoteInit {
private static final String PROPERTY_DISABLE_OPENGL_PRELOADING = "ro.zygote.disable_gl_preload"; private static final String PROPERTY_DISABLE_OPENGL_PRELOADING = "ro.zygote.disable_gl_preload";
private static final String PROPERTY_GFX_DRIVER = "ro.gfx.driver.0"; private static final String PROPERTY_GFX_DRIVER = "ro.gfx.driver.0";
private static final String PROPERTY_RUNNING_IN_CONTAINER = "ro.boot.container";
private static final int LOG_BOOT_PROGRESS_PRELOAD_START = 3020; private static final int LOG_BOOT_PROGRESS_PRELOAD_START = 3020;
private static final int LOG_BOOT_PROGRESS_PRELOAD_END = 3030; private static final int LOG_BOOT_PROGRESS_PRELOAD_END = 3030;
@@ -604,12 +605,20 @@ public class ZygoteInit {
OsConstants.CAP_SYS_PTRACE, OsConstants.CAP_SYS_PTRACE,
OsConstants.CAP_SYS_TIME, OsConstants.CAP_SYS_TIME,
OsConstants.CAP_SYS_TTY_CONFIG, OsConstants.CAP_SYS_TTY_CONFIG,
OsConstants.CAP_WAKE_ALARM OsConstants.CAP_WAKE_ALARM,
OsConstants.CAP_BLOCK_SUSPEND
); );
/* Containers run without this capability, so avoid setting it in that case */ /* Containers run without some capabilities, so drop any caps that are not available. */
if (!SystemProperties.getBoolean(PROPERTY_RUNNING_IN_CONTAINER, false)) { StructCapUserHeader header = new StructCapUserHeader(
capabilities |= posixCapabilitiesAsBits(OsConstants.CAP_BLOCK_SUSPEND); OsConstants._LINUX_CAPABILITY_VERSION_3, 0);
StructCapUserData[] data;
try {
data = Os.capget(header);
} catch (ErrnoException ex) {
throw new RuntimeException("Failed to capget()", ex);
} }
capabilities &= ((long) data[0].effective) | (((long) data[1].effective) << 32);
/* Hardcoded command line to start the system server */ /* Hardcoded command line to start the system server */
String args[] = { String args[] = {
"--setuid=1000", "--setuid=1000",

20
core/jni/com_android_internal_os_Zygote.cpp
View File

@@ -674,6 +674,22 @@ static pid_t ForkAndSpecializeCommon(JNIEnv* env, uid_t uid, gid_t gid, jintArra
} }
return pid; return pid;
} }
static uint64_t GetEffectiveCapabilityMask(JNIEnv* env) {
__user_cap_header_struct capheader;
memset(&capheader, 0, sizeof(capheader));
capheader.version = _LINUX_CAPABILITY_VERSION_3;
capheader.pid = 0;
__user_cap_data_struct capdata[2];
if (capget(&capheader, &capdata[0]) == -1) {
ALOGE("capget failed: %s", strerror(errno));
RuntimeAbort(env, __LINE__, "capget failed");
}
return capdata[0].effective |
(static_cast<uint64_t>(capdata[1].effective) << 32);
}
} // anonymous namespace } // anonymous namespace
namespace android { namespace android {
@@ -724,6 +740,10 @@ static jint com_android_internal_os_Zygote_nativeForkAndSpecialize(
capabilities |= (1LL << CAP_BLOCK_SUSPEND); capabilities |= (1LL << CAP_BLOCK_SUSPEND);
} }
// Containers run without some capabilities, so drop any caps that are not
// available.
capabilities &= GetEffectiveCapabilityMask(env);
return ForkAndSpecializeCommon(env, uid, gid, gids, debug_flags, return ForkAndSpecializeCommon(env, uid, gid, gids, debug_flags,
rlimits, capabilities, capabilities, mount_external, se_info, rlimits, capabilities, capabilities, mount_external, se_info,
se_name, false, fdsToClose, fdsToIgnore, instructionSet, appDataDir); se_name, false, fdsToClose, fdsToIgnore, instructionSet, appDataDir);