Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Run unshare for app data isolation for instant app" into rvc-dev am: bc55a100a3 am: 2afa0768d7

Browse Source 
Change-Id: Ib05b8f01cfc4d881f1dbc50ab63aac4571b7a453
This commit is contained in:
Automerger Merge Worker
2020-03-10 08:30:54 +00:00
parent 4896523b15 2afa0768d7
commit f37d1fd54b
1 changed files with 18 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
core/jni/com_android_internal_os_Zygote.cpp
View File

@@ -133,6 +133,11 @@ static jmethodID gCreateSystemServerClassLoader;
static bool gIsSecurityEnforced = true; static bool gIsSecurityEnforced = true;
/**
* True if the app process is running in its mount namespace.
*/
static bool gInAppMountNamespace = false;
/** /**
* The maximum number of characters (not including a null terminator) that a * The maximum number of characters (not including a null terminator) that a
* process name may contain. * process name may contain.
@@ -548,6 +553,17 @@ static void SetGids(JNIEnv* env, jintArray managed_gids, fail_fn_t fail_fn) {
} }
} }
static void ensureInAppMountNamespace(fail_fn_t fail_fn) {
if (gInAppMountNamespace) {
// In app mount namespace already
return;
}
if (unshare(CLONE_NEWNS) == -1) {
fail_fn(CREATE_ERROR("Failed to unshare(): %s", strerror(errno)));
}
gInAppMountNamespace = true;
}
// Sets the resource limits via setrlimit(2) for the values in the // Sets the resource limits via setrlimit(2) for the values in the
// two-dimensional array of integers that's passed in. The second dimension // two-dimensional array of integers that's passed in. The second dimension
// contains a tuple of length 3: (resource, rlim_cur, rlim_max). nullptr is // contains a tuple of length 3: (resource, rlim_cur, rlim_max). nullptr is
@@ -811,9 +827,7 @@ static void MountEmulatedStorage(uid_t uid, jint mount_mode,
} }
// Create a second private mount namespace for our process // Create a second private mount namespace for our process
if (unshare(CLONE_NEWNS) == -1) { ensureInAppMountNamespace(fail_fn);
fail_fn(CREATE_ERROR("Failed to unshare(): %s", strerror(errno)));
}
// Handle force_mount_namespace with MOUNT_EXTERNAL_NONE. // Handle force_mount_namespace with MOUNT_EXTERNAL_NONE.
if (mount_mode == MOUNT_EXTERNAL_NONE) { if (mount_mode == MOUNT_EXTERNAL_NONE) {
@@ -1319,6 +1333,7 @@ static void isolateAppData(JNIEnv* env, jobjectArray pkg_data_info_list,
if ((size % 3) != 0) { if ((size % 3) != 0) {
fail_fn(CREATE_ERROR("Wrong pkg_inode_list size %d", size)); fail_fn(CREATE_ERROR("Wrong pkg_inode_list size %d", size));
} }
ensureInAppMountNamespace(fail_fn);
// Mount tmpfs on all possible data directories, so app no longer see the original apps data. // Mount tmpfs on all possible data directories, so app no longer see the original apps data.
char internalCePath[PATH_MAX]; char internalCePath[PATH_MAX];