ACPR/android_system_core
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add AID for PRNG seeder daemon.

Browse source 
Also adjust permissions on /dev/hw_random to allow prng_seeder group
read access.

Manual testing protocol:
* Verify prng_seeder daemon is running and has the
  correct label and uid/gid.
* Verify prng_seeder socket present and has correct
  label and permissions
* Verify no SELinux denials
* strace a libcrypto process and verify it reads seeding
  data from prng_seeder (e.g. strace bssl rand -hex 1024)
* strace seeder daemon to observe incoming connections
  (e.g. strace -f -p `pgrep prng_seeder`)
* Kill daemon, observe that init restarts it
* strace again and observe clients now seed from new instance

Bug: 243933553
Test: Manual - see above
Change-Id: I4d526844b232fc2a1fa5ffd701ca5bc5c09e7e96
Merged-In: I4d526844b232fc2a1fa5ffd701ca5bc5c09e7e96
(cherry picked from commit 6cb61610e6)
This commit is contained in:
Pete Bentley 2022-09-23 12:09:32 +01:00
parent 0024d68287
commit 046a809a90
2 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
libcutils/include/private/android_filesystem_config.h
View file

@ -138,6 +138,7 @@
#define AID_JC_IDENTITYCRED 1089 /* Javacard Identity Cred HAL - to manage omapi ARA rules */ #define AID_JC_IDENTITYCRED 1089 /* Javacard Identity Cred HAL - to manage omapi ARA rules */
#define AID_SDK_SANDBOX 1090 /* SDK sandbox virtual UID */ #define AID_SDK_SANDBOX 1090 /* SDK sandbox virtual UID */
#define AID_SECURITY_LOG_WRITER 1091 /* write to security log */ #define AID_SECURITY_LOG_WRITER 1091 /* write to security log */
#define AID_PRNG_SEEDER 1092 /* PRNG seeder daemon */
/* Changes to this file must be made in AOSP, *not* in internal branches. */ /* Changes to this file must be made in AOSP, *not* in internal branches. */
#define AID_SHELL 2000 /* adb and debug shell user */ #define AID_SHELL 2000 /* adb and debug shell user */

2
rootdir/ueventd.rc
View file

@ -37,6 +37,8 @@ subsystem dma_heap
/dev/tty 0666 root root /dev/tty 0666 root root
/dev/random 0666 root root /dev/random 0666 root root
/dev/urandom 0666 root root /dev/urandom 0666 root root
# Aside from kernel threads, only prng_seeder needs access to HW RNG
/dev/hw_random 0400 prng_seeder prng_seeder
/dev/ashmem* 0666 root root /dev/ashmem* 0666 root root
/dev/binder 0666 root root /dev/binder 0666 root root
/dev/hwbinder 0666 root root /dev/hwbinder 0666 root root