The bug proposes to 'move' the /proc/self/fd/ readlink/stat/etc checks
performed by the FileDescriptorAllowlist from before-fork to an earlier
stage.
The original aim was to allow the app zygote Preload hook to open
ashmem/memfd read-only regions to save more RAM (around 5MiB on aarch64)
via sharing more across processes. Potentially other files/sockets can
be opened - the app zygote takes responsibility of managing file
descriptor access controls across its own processes. App Zygote Preload
does not run 3rd party code.
Unfortunately a straightforward move of the checks to
just-before-preload has disadvantages:
* opens more codepaths for potential accidental misuse (the zygote
accepts commands between preload and fork, there are valid usecases
for extending these commands)
* this way FileDescriptorAllowlist would need to support more file
descriptor types (sockets and maybe pipes), which is not needed now
because these FDs are closed right before forking
The solution proposed here is to:
1. Determine the set of file descriptors open before preload
2. Run the preload hook
3. Determine FDs opened by the hook and allow them to remain open across
fork
4. Hypothetical new attempts to preload (if ever supported) will not
affect the allowed FDs - the preload will be able to toss its own FDs
the way it wants, but not open the new-new ones
Bug: 184808875
Test: Manual: unreleased Chrome patch: while in app zygote preload,
create ashmem region, passes it to 'untrusted_app' (=browser
process), and call mmap(2) on it.
Change-Id: Ie302eabca83a0e4f409cb131e4308b73e5f6a580
This CL contains changes made by the autoformatter to make these files
conform to the C++ style guide.
BYPASS_INCLUSIVE_LANGUAGE_REASON="compatability with vendor files"
Test: None
Change-Id: I04ac8fba3a2038133689c456a8d8e2c7bd856541
Changed "whitelist" to "allowlist" in many Zygote files.
BYPASS_INCLUSIVE_LANGUAGE_REASON="compatability with vendor files"
Test: cts
Change-Id: Ia0a8548f2e254fc36a9dce7e50af8284ed0caa47
Revert "Move ICU from ART APEX to i18n APEX"
Revert "Move v8 and libpac into i18n APEX"
Revert "Move core-icu4j into I18n APEX"
Revert "Move ICU from ART APEX into i18n APEX"
Revert "Move core-icu4j into i18n APEX"
Revert "Move libpac into i18n APEX"
Revert "Add shared library into i18n APEX and add the required s..."
Revert "Make com_android_i18n namespace visible"
Revert submission 1299494-i18nApex
Reason for revert: Breaking aosp_x86-eng on aosp-master
Reverted Changes:
I30fc3735b:Move ICU from ART APEX to i18n APEX
Icb7e98b5c:Calling @IntraCoreApi from core-icu4j should not c...
Ic7de63fe3:Move core-icu4j into I18n APEX
I65b97bdba:Make com_android_i18n namespace visible
Ia4c83bc15:Move v8 and libpac into i18n APEX
I10e6d4948:Move core-icu4j into i18n APEX
I8d989cad7:Move ICU from ART APEX into i18n APEX
I72216ca12:Move ICU into i18n APEX
Ief9dace85:Add shared library into i18n APEX and add the requ...
I7d97a10ba:Move libpac into i18n APEX
I90fff9c55:Move ICU from ART APEX into i18n APEX
Change-Id: I74223119f0e90e928a3d5364ffd359ddf953c30c
Add /sys/kernel/tracing/trace_marker to whitelist of paths
that the zygote is allowed to keep open. It currently contains
/sys/kernel/debug/tracing/trace_marker which is only created when
debugfs is mounted. tracefs will be mounted at /sys/kernel/tracing
when debugfs is not mounted.
Test: AtraceHostTest
Bug: 148436518
Change-Id: I734120e8c88ba9d5451a1bd1589e084323824285
Add below nodes so that device could boot to home.
/dev/stune/foreground/tasks
/dev/blkio/tasks
Bug: 139521784
Test: device boot to home
Change-Id: I6b52aced0ac5daaabb3b5c8d482f200bd7566ea1
Recent work has paved the way to get MediaStore.java building against
"core_platform", and this change is actually shifting MediaStore.java
inside the MediaProvider APEX boundary.
This involves defining a new "updatable-mediaprovider" library JAR
and ensuring that it's spliced into classpaths where needed to keep
everything building and working.
Note that the MediaProvider APK itself is still bundled, so we're
manually including the MediaStore.java when building that APK so that
we can continue referencing @hide symbols, but there's a STOPSHIP
comment to remove that once we get the APK building against
"system_current".
Bug: 144247087
Test: atest --test-mapping packages/providers/MediaProvider
Change-Id: I27ed3fde40751d9ac136a31710c62004b1b8962f
Create framework-statsd jar in statsd apex.
Move StatsEvent to framework-statsd.jar.
Right now, frameworks jar links against framework-statsd directly. This
should be changed to link against framework-statsd-stubs.
Bug: 145923096
Bug: 145923116
Bug: 142810493
Test: m
Test: flashes successfully
Test: adb shell cmd stats print-logs && adb logcat "*:S statsd:*"
Change-Id: Ife224abd5c9b9b0eeab681dc4b7f71c0bdb856b1
These need to be whitelisted because they are not part of the jars
in /system/framework/ now. Earlier they were, due to which this was
not required since libs under /system/framework are already
whitelisted (through a separate rule).
Test: basic telephony sanity
Test: m com.android.telephony && adb install com.android.telephony.apex
Bug: 145555313
Change-Id: Ieaeec41f1db527f1dd8568a542697c5ba4a4c419
This change adds the IKE apex to the whitelist of open paths. Without
this change, adding IKE to the boot classpath will fail.
Bug: 143905344
Test: Compiles, doesn't fail.
Change-Id: I63a2531e88b9d715e5089a6dc9fec721970d0de5
A memfd file can be created with any name, but to protect ourselves
from unintended leakage, check that it's the name ART uses.
Test: boots
Bug: 119800099
Change-Id: Ibc684d09dd05f38933c6808b72fb402fc9d5e4eb
When there is overlay package in system_ext, turn on POLICY_SYSTEM_PARTITION.
In other words, overlay pacakge in /system_ext is considered as system's one
Test: mv vendor/overlay/framework-res__auto_generated_rro.apk system_ext/overlay
and then check if it works properly.
Bug: 136715327
Change-Id: Ib225368eae41203a8630f4310d26e9cf1afa706a
Merged-In: Ib225368eae41203a8630f4310d26e9cf1afa706a
(cherry picked from commit cba9579158)
This patch removes several debugging log messages. These messages were
useful when the `FDs to ignore` list was usually empty, but with the
addition of USAPs this has become spammy.
(cherry picked from commit da0a9cd05c)
Test: Build
Bug: 130172109
Change-Id: Id166990a63f20efb3bf6ffd5b697efd436d50921
Merged-In: Id166990a63f20efb3bf6ffd5b697efd436d50921
This patch removes several debugging log messages. These messages were
useful when the `FDs to ignore` list was usually empty, but with the
addition of USAPs this has become spammy.
Test: Build
Bug: 130172109
Change-Id: Id166990a63f20efb3bf6ffd5b697efd436d50921
