diff options
| -rw-r--r-- | adb/daemon/main.cpp | 35 |
1 files changed, 30 insertions, 5 deletions
diff --git a/adb/daemon/main.cpp b/adb/daemon/main.cpp index 3c27582761..5adeb4446b 100644 --- a/adb/daemon/main.cpp +++ b/adb/daemon/main.cpp @@ -19,10 +19,11 @@ #include "sysdeps.h" #include <errno.h> +#include <getopt.h> #include <signal.h> #include <stdio.h> #include <stdlib.h> -#include <getopt.h> +#include <sys/capability.h> #include <sys/prctl.h> #include <memory> @@ -49,13 +50,13 @@ static const char* root_seclabel = nullptr; -static void drop_capabilities_bounding_set_if_needed(struct minijail *j) { +static bool should_drop_capabilities_bounding_set() { #if defined(ALLOW_ADBD_ROOT) if (__android_log_is_debuggable()) { - return; + return false; } #endif - minijail_capbset_drop(j, CAP_TO_MASK(CAP_SETUID) | CAP_TO_MASK(CAP_SETGID)); + return true; } static bool should_drop_privileges() { @@ -116,13 +117,37 @@ static void drop_privileges(int server_port) { // Don't listen on a port (default 5037) if running in secure mode. // Don't run as root if running in secure mode. if (should_drop_privileges()) { - drop_capabilities_bounding_set_if_needed(jail.get()); + const bool should_drop_caps = should_drop_capabilities_bounding_set(); + + if (should_drop_caps) { + minijail_use_caps(jail.get(), CAP_TO_MASK(CAP_SETUID) | CAP_TO_MASK(CAP_SETGID)); + } minijail_change_gid(jail.get(), AID_SHELL); minijail_change_uid(jail.get(), AID_SHELL); // minijail_enter() will abort if any priv-dropping step fails. minijail_enter(jail.get()); + // Whenever ambient capabilities are being used, minijail cannot + // simultaneously drop the bounding capability set to just + // CAP_SETUID|CAP_SETGID while clearing the inheritable, effective, + // and permitted sets. So we need to do that in two steps. + using ScopedCaps = + std::unique_ptr<std::remove_pointer<cap_t>::type, std::function<void(cap_t)>>; + ScopedCaps caps(cap_get_proc(), &cap_free); + if (cap_clear_flag(caps.get(), CAP_INHERITABLE) == -1) { + PLOG(FATAL) << "cap_clear_flag(INHERITABLE) failed"; + } + if (cap_clear_flag(caps.get(), CAP_EFFECTIVE) == -1) { + PLOG(FATAL) << "cap_clear_flag(PEMITTED) failed"; + } + if (cap_clear_flag(caps.get(), CAP_PERMITTED) == -1) { + PLOG(FATAL) << "cap_clear_flag(PEMITTED) failed"; + } + if (cap_set_proc(caps.get()) != 0) { + PLOG(FATAL) << "cap_set_proc() failed"; + } + D("Local port disabled"); } else { // minijail_enter() will abort if any priv-dropping step fails. |