From f5965519d183ff188273689d151bfc2cb20ece2a Mon Sep 17 00:00:00 2001 From: Luis Hector Chavez Date: Fri, 30 Jun 2017 14:04:20 -0700 Subject: [PATCH] init: Read previous state of securebits before modifying When Android is running in a container, some of the securebits might be locked, which makes prctl(PR_SET_SECUREBITS) fail. This change gets the previous state of the process' securebits and adds the desired bits. Bug: 62388055 Test: aosp_bullhead-eng boots Test: If init has non-zero securebits, it can also boot Change-Id: Ie03bf2538f9dca40955bc58314d269246f5731bd --- init/service.cpp | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/init/service.cpp b/init/service.cpp index f9a452ba9..f2e5d228c 100644 --- a/init/service.cpp +++ b/init/service.cpp @@ -235,8 +235,15 @@ void Service::KillProcessGroup(int signal) { void Service::SetProcessAttributes() { // Keep capabilites on uid change. if (capabilities_.any() && uid_) { - if (prctl(PR_SET_SECUREBITS, SECBIT_KEEP_CAPS | SECBIT_KEEP_CAPS_LOCKED) != 0) { - PLOG(FATAL) << "prtcl(PR_SET_KEEPCAPS) failed for " << name_; + // If Android is running in a container, some securebits might already + // be locked, so don't change those. + int64_t securebits = prctl(PR_GET_SECUREBITS); + if (securebits == -1) { + PLOG(FATAL) << "prctl(PR_GET_SECUREBITS) failed for " << name_; + } + securebits |= SECBIT_KEEP_CAPS | SECBIT_KEEP_CAPS_LOCKED; + if (prctl(PR_SET_SECUREBITS, securebits) != 0) { + PLOG(FATAL) << "prctl(PR_SET_SECUREBITS) failed for " << name_; } }