diff options
| -rw-r--r-- | adb/daemon/main.cpp | 35 | ||||
| -rw-r--r-- | healthd/Android.mk | 2 | ||||
| -rw-r--r-- | healthd/android.hardware.health@2.0-service.rc | 1 |
3 files changed, 32 insertions, 6 deletions
diff --git a/adb/daemon/main.cpp b/adb/daemon/main.cpp index 3c2758276..5adeb4446 100644 --- a/adb/daemon/main.cpp +++ b/adb/daemon/main.cpp @@ -19,10 +19,11 @@ #include "sysdeps.h" #include <errno.h> +#include <getopt.h> #include <signal.h> #include <stdio.h> #include <stdlib.h> -#include <getopt.h> +#include <sys/capability.h> #include <sys/prctl.h> #include <memory> @@ -49,13 +50,13 @@ static const char* root_seclabel = nullptr; -static void drop_capabilities_bounding_set_if_needed(struct minijail *j) { +static bool should_drop_capabilities_bounding_set() { #if defined(ALLOW_ADBD_ROOT) if (__android_log_is_debuggable()) { - return; + return false; } #endif - minijail_capbset_drop(j, CAP_TO_MASK(CAP_SETUID) | CAP_TO_MASK(CAP_SETGID)); + return true; } static bool should_drop_privileges() { @@ -116,13 +117,37 @@ static void drop_privileges(int server_port) { // Don't listen on a port (default 5037) if running in secure mode. // Don't run as root if running in secure mode. if (should_drop_privileges()) { - drop_capabilities_bounding_set_if_needed(jail.get()); + const bool should_drop_caps = should_drop_capabilities_bounding_set(); + + if (should_drop_caps) { + minijail_use_caps(jail.get(), CAP_TO_MASK(CAP_SETUID) | CAP_TO_MASK(CAP_SETGID)); + } minijail_change_gid(jail.get(), AID_SHELL); minijail_change_uid(jail.get(), AID_SHELL); // minijail_enter() will abort if any priv-dropping step fails. minijail_enter(jail.get()); + // Whenever ambient capabilities are being used, minijail cannot + // simultaneously drop the bounding capability set to just + // CAP_SETUID|CAP_SETGID while clearing the inheritable, effective, + // and permitted sets. So we need to do that in two steps. + using ScopedCaps = + std::unique_ptr<std::remove_pointer<cap_t>::type, std::function<void(cap_t)>>; + ScopedCaps caps(cap_get_proc(), &cap_free); + if (cap_clear_flag(caps.get(), CAP_INHERITABLE) == -1) { + PLOG(FATAL) << "cap_clear_flag(INHERITABLE) failed"; + } + if (cap_clear_flag(caps.get(), CAP_EFFECTIVE) == -1) { + PLOG(FATAL) << "cap_clear_flag(PEMITTED) failed"; + } + if (cap_clear_flag(caps.get(), CAP_PERMITTED) == -1) { + PLOG(FATAL) << "cap_clear_flag(PEMITTED) failed"; + } + if (cap_set_proc(caps.get()) != 0) { + PLOG(FATAL) << "cap_set_proc() failed"; + } + D("Local port disabled"); } else { // minijail_enter() will abort if any priv-dropping step fails. diff --git a/healthd/Android.mk b/healthd/Android.mk index 7792eafc3..00ae159b6 100644 --- a/healthd/Android.mk +++ b/healthd/Android.mk @@ -100,7 +100,7 @@ CHARGER_STATIC_LIBRARIES := \ android.hardware.health@1.0-convert \ libhidltransport \ libhidlbase \ - libhwbinder \ + libhwbinder_nolto \ libhealthstoragedefault \ libvndksupport \ libhealthd_charger \ diff --git a/healthd/android.hardware.health@2.0-service.rc b/healthd/android.hardware.health@2.0-service.rc index 8b868687e..dca0ccc0e 100644 --- a/healthd/android.hardware.health@2.0-service.rc +++ b/healthd/android.hardware.health@2.0-service.rc @@ -2,3 +2,4 @@ service health-hal-2-0 /vendor/bin/hw/android.hardware.health@2.0-service class hal user system group system + file /dev/kmsg w |