ACPR/android_system_core
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "Enable hidepid=2 on /proc"

Browse source 
am: 2d8f1d4c47

* commit '2d8f1d4c478b9d921730d3fc9b290315e2ff9f04':
  Enable hidepid=2 on /proc
This commit is contained in:
Nick Kralevich 2015-11-09 20:29:44 +00:00 • committed by android-build-merger
commit ea8452cc72
9 changed files with 15 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
adb/daemon/main.cpp
View file

@ -142,9 +142,11 @@ int adbd_main(int server_port) {
// AID_SDCARD_R to allow reading from the SD card // AID_SDCARD_R to allow reading from the SD card
// AID_SDCARD_RW to allow writing to the SD card // AID_SDCARD_RW to allow writing to the SD card
// AID_NET_BW_STATS to read out qtaguid statistics // AID_NET_BW_STATS to read out qtaguid statistics
// AID_READPROC for reading /proc entries across UID boundaries
gid_t groups[] = {AID_ADB, AID_LOG, AID_INPUT, gid_t groups[] = {AID_ADB, AID_LOG, AID_INPUT,
AID_INET, AID_NET_BT, AID_NET_BT_ADMIN, AID_INET, AID_NET_BT, AID_NET_BT_ADMIN,
AID_SDCARD_R, AID_SDCARD_RW, AID_NET_BW_STATS}; AID_SDCARD_R, AID_SDCARD_RW, AID_NET_BW_STATS,
AID_READPROC };
if (setgroups(sizeof(groups) / sizeof(groups[0]), groups) != 0) { if (setgroups(sizeof(groups) / sizeof(groups[0]), groups) != 0) {
PLOG(FATAL) << "Could not set supplental groups"; PLOG(FATAL) << "Could not set supplental groups";
} }

1
debuggerd/debuggerd.rc
View file

@ -1,3 +1,4 @@
service debuggerd /system/bin/debuggerd service debuggerd /system/bin/debuggerd
class main class main
group root readproc
writepid /dev/cpuset/system-background/tasks writepid /dev/cpuset/system-background/tasks

1
debuggerd/debuggerd64.rc
View file

@ -1,3 +1,4 @@
service debuggerd64 /system/bin/debuggerd64 service debuggerd64 /system/bin/debuggerd64
class main class main
group root readproc
writepid /dev/cpuset/system-background/tasks writepid /dev/cpuset/system-background/tasks

2
include/private/android_filesystem_config.h
View file

@ -101,6 +101,7 @@
#define AID_NET_BW_STATS 3006 /* read bandwidth statistics */ #define AID_NET_BW_STATS 3006 /* read bandwidth statistics */
#define AID_NET_BW_ACCT 3007 /* change bandwidth statistics accounting */ #define AID_NET_BW_ACCT 3007 /* change bandwidth statistics accounting */
#define AID_NET_BT_STACK 3008 /* bluetooth: access config files */ #define AID_NET_BT_STACK 3008 /* bluetooth: access config files */
#define AID_READPROC 3009 /* Allow /proc read access */
/* The range 5000-5999 is also reserved for OEM, and must never be used here. */ /* The range 5000-5999 is also reserved for OEM, and must never be used here. */
#define AID_OEM_RESERVED_2_START 5000 #define AID_OEM_RESERVED_2_START 5000
@ -191,6 +192,7 @@ static const struct android_id_info android_ids[] = {
{ "net_bw_stats", AID_NET_BW_STATS, }, { "net_bw_stats", AID_NET_BW_STATS, },
{ "net_bw_acct", AID_NET_BW_ACCT, }, { "net_bw_acct", AID_NET_BW_ACCT, },
{ "net_bt_stack", AID_NET_BT_STACK, }, { "net_bt_stack", AID_NET_BT_STACK, },
{ "readproc", AID_READPROC, },
{ "everybody", AID_EVERYBODY, }, { "everybody", AID_EVERYBODY, },
{ "misc", AID_MISC, }, { "misc", AID_MISC, },

3
init/init.cpp
View file

@ -546,7 +546,8 @@ int main(int argc, char** argv) {
mkdir("/dev/pts", 0755); mkdir("/dev/pts", 0755);
mkdir("/dev/socket", 0755); mkdir("/dev/socket", 0755);
mount("devpts", "/dev/pts", "devpts", 0, NULL); mount("devpts", "/dev/pts", "devpts", 0, NULL);
mount("proc", "/proc", "proc", 0, NULL); #define MAKE_STR(x) __STRING(x)
mount("proc", "/proc", "proc", 0, "hidepid=2,gid=" MAKE_STR(AID_READPROC));
mount("sysfs", "/sys", "sysfs", 0, NULL); mount("sysfs", "/sys", "sysfs", 0, NULL);
} }

1
lmkd/lmkd.rc
View file

@ -1,5 +1,6 @@
service lmkd /system/bin/lmkd service lmkd /system/bin/lmkd
class core class core
group root readproc
critical critical
socket lmkd seqpacket 0660 system system socket lmkd seqpacket 0660 system system
writepid /dev/cpuset/system-background/tasks writepid /dev/cpuset/system-background/tasks

2
logd/logd.rc
View file

@ -3,7 +3,7 @@ service logd /system/bin/logd
socket logd stream 0666 logd logd socket logd stream 0666 logd logd
socket logdr seqpacket 0666 logd logd socket logdr seqpacket 0666 logd logd
socket logdw dgram 0222 logd logd socket logdw dgram 0222 logd logd
group root system group root system readproc
writepid /dev/cpuset/system-background/tasks writepid /dev/cpuset/system-background/tasks
service logd-reinit /system/bin/logd --reinit service logd-reinit /system/bin/logd --reinit

4
logd/main.cpp
View file

@ -106,7 +106,9 @@ static int drop_privs() {
return -1; return -1;
} }
if (setgroups(0, NULL) == -1) { gid_t groups[] = { AID_READPROC };
if (setgroups(sizeof(groups) / sizeof(groups[0]), groups) == -1) {
return -1; return -1;
} }

2
rootdir/init.rc
View file

@ -560,7 +560,7 @@ service console /system/bin/sh
console console
disabled disabled
user shell user shell
group shell log group shell log readproc
seclabel u:r:shell:s0 seclabel u:r:shell:s0
on property:ro.debuggable=1 on property:ro.debuggable=1