diff options
| author | Jorge Lucangeli Obes <jorgelo@google.com> | 2016-12-15 12:13:38 -0500 |
|---|---|---|
| committer | Jorge Lucangeli Obes <jorgelo@google.com> | 2016-12-16 13:04:52 -0500 |
| commit | f3f824ee42892fb69cb0d9b0557cd9c5aed357d2 (patch) | |
| tree | 97295c9ae5c113ef4d7abb3e35e05173a6d27c2e /trusty/coverage/coverage.cpp | |
| parent | 3b261ace575a931d0cac9870798548560992c221 (diff) | |
capabilities: Check ambient caps, last valid runtime cap.
Partners have expressed interest in using the 'capabilities' keyword
in init, so make the code more resilient:
-Check that ambient capabilities are supported by the kernel.
-Check that the last valid cap at runtime is not higher than what's in
kernel headers.
-Check that the user is not requesting a capability present in kernel
headers but not supported by the kernel at runtime.
-Don't attempt to drop bounding set capabilities not supported at
runtime.
This CL also fixes a small bug where < should have been used instead of
<=, and uses 'static' instead of anonymous namespaces.
Bug: 32438163
Test: Use a test service that uses capabilities.
Test: Apply in internal tree and test with angler and rild.
Change-Id: Ia271cc7eb389d1d526d61f897261e4bac4d19e5d
Diffstat (limited to 'trusty/coverage/coverage.cpp')
0 files changed, 0 insertions, 0 deletions