ACPR/android_system_core
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "adbd: Remove explicit capability bounding set code."

Browse source
This commit is contained in:
Jorge Lucangeli Obes 2016-02-24 22:13:09 +00:00 • committed by Gerrit Code Review
commit d458730b64
1 changed files with 4 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
adb/daemon/main.cpp
View file

@ -43,24 +43,15 @@
static const char* root_seclabel = nullptr; static const char* root_seclabel = nullptr;
static void drop_capabilities_bounding_set_if_needed() { static void drop_capabilities_bounding_set_if_needed(struct minijail *j) {
#ifdef ALLOW_ADBD_ROOT #if defined(ALLOW_ADBD_ROOT)
char value[PROPERTY_VALUE_MAX]; char value[PROPERTY_VALUE_MAX];
property_get("ro.debuggable", value, ""); property_get("ro.debuggable", value, "");
if (strcmp(value, "1") == 0) { if (strcmp(value, "1") == 0) {
return; return;
} }
#endif #endif
for (int i = 0; prctl(PR_CAPBSET_READ, i, 0, 0, 0) >= 0; i++) { minijail_capbset_drop(j, CAP_TO_MASK(CAP_SETUID) | CAP_TO_MASK(CAP_SETGID));
if (i == CAP_SETUID || i == CAP_SETGID) {
// CAP_SETUID CAP_SETGID needed by /system/bin/run-as
continue;
}
if (prctl(PR_CAPBSET_DROP, i, 0, 0, 0) == -1) {
PLOG(FATAL) << "Could not drop capabilities";
}
}
} }
static bool should_drop_privileges() { static bool should_drop_privileges() {
@ -131,7 +122,7 @@ static void drop_privileges(int server_port) {
// Don't listen on a port (default 5037) if running in secure mode. // Don't listen on a port (default 5037) if running in secure mode.
// Don't run as root if running in secure mode. // Don't run as root if running in secure mode.
if (should_drop_privileges()) { if (should_drop_privileges()) {
drop_capabilities_bounding_set_if_needed(); drop_capabilities_bounding_set_if_needed(jail.get());
minijail_change_gid(jail.get(), AID_SHELL); minijail_change_gid(jail.get(), AID_SHELL);
minijail_change_uid(jail.get(), AID_SHELL); minijail_change_uid(jail.get(), AID_SHELL);