From 77f3fe5e6831db10ac378fec0fcbcd5bc15e8fc5 Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Wed, 12 Oct 2022 12:25:46 -0700 Subject: [PATCH] init: Fix the implementation of the task_profiles keyword The documentation added by commit c9c0bbac5383 ("init: Add task_profiles init command") mentions that the task_profiles keyword sets process attributes. Make the implementation of that keyword match the documentation. Change-Id: Ia080132f16bfc2488f8c25176d6aed37a2c42780 Signed-off-by: Bart Van Assche --- init/README.md | 5 +++-- init/service.cpp | 14 ++++++++++++-- 2 files changed, 15 insertions(+), 4 deletions(-) diff --git a/init/README.md b/init/README.md index 7b3d32ac0..6596528d5 100644 --- a/init/README.md +++ b/init/README.md @@ -368,8 +368,9 @@ runs the service. given console. `task_profiles [ \* ]` -> Set task profiles for the process when it forks. This is designed to replace the use of - writepid option for moving a process into a cgroup. +> Set task profiles. Before Android U, the profiles are applied to the main thread of the service. + For Android U and later, the profiles are applied to the entire service process. This is designed + to replace the use of writepid option for moving a process into a cgroup. `timeout_period ` > Provide a timeout after which point the service will be killed. The oneshot keyword is respected diff --git a/init/service.cpp b/init/service.cpp index a6330484a..26b3b4248 100644 --- a/init/service.cpp +++ b/init/service.cpp @@ -546,8 +546,18 @@ void Service::RunService(const std::vector& descriptors, _exit(EXIT_FAILURE); } - if (task_profiles_.size() > 0 && !SetTaskProfiles(getpid(), task_profiles_)) { - LOG(ERROR) << "failed to set task profiles"; + if (task_profiles_.size() > 0) { + bool succeeded = SelinuxGetVendorAndroidVersion() < __ANDROID_API_U__ + ? + // Compatibility mode: apply the task profiles to the current + // thread. + SetTaskProfiles(getpid(), task_profiles_) + : + // Apply the task profiles to the current process. + SetProcessProfiles(getuid(), getpid(), task_profiles_); + if (!succeeded) { + LOG(ERROR) << "failed to set task profiles"; + } } // As requested, set our gid, supplemental gids, uid, context, and