From f97e6e7dd452798e3016f4efca1113b34306af5b Mon Sep 17 00:00:00 2001 From: Jin Qian Date: Wed, 22 Feb 2017 17:17:49 -0800 Subject: [PATCH 1/2] storaged: reduce storaged privilege Remove storaged from system group. Let init set priority based on rc file. Test: adb shell dumpsys storaged --force Bug: 35323867 Change-Id: I9d893ec69d9cc34a9e24f47166384efd7ef4d9d2 --- storaged/main.cpp | 18 ------------------ storaged/storaged.rc | 3 ++- 2 files changed, 2 insertions(+), 19 deletions(-) diff --git a/storaged/main.cpp b/storaged/main.cpp index f5a8f3901..672f453b3 100644 --- a/storaged/main.cpp +++ b/storaged/main.cpp @@ -44,20 +44,6 @@ storaged_t storaged; -static int drop_privs() { - // privilege setting - struct sched_param param; - memset(¶m, 0, sizeof(param)); - - if (set_sched_policy(0, SP_BACKGROUND) < 0) return -1; - - if (sched_setscheduler((pid_t) 0, SCHED_BATCH, ¶m) < 0) return -1; - - if (setpriority(PRIO_PROCESS, 0, ANDROID_PRIORITY_BACKGROUND) < 0) return -1; - - return 0; -} - // Function of storaged's main thread void* storaged_main(void* s) { storaged_t* storaged = (storaged_t*)s; @@ -133,10 +119,6 @@ int main(int argc, char** argv) { if (fd_emmc < 0) fd_emmc = TEMP_FAILURE_RETRY(open(mmc0_ext_csd, O_RDONLY)); - if (drop_privs() != 0) { - return -1; - } - storaged.set_privileged_fds(fd_emmc); // Start the main thread of storaged diff --git a/storaged/storaged.rc b/storaged/storaged.rc index bb7c623fd..a24c7fba8 100644 --- a/storaged/storaged.rc +++ b/storaged/storaged.rc @@ -1,6 +1,7 @@ service storaged /system/bin/storaged class main + priority 10 file /d/mmc0/mmc0:0001/ext_csd r writepid /dev/cpuset/system-background/tasks user root - group system package_info \ No newline at end of file + group package_info \ No newline at end of file From 135f161bae64d04e33574fb7309b0890d85d6b84 Mon Sep 17 00:00:00 2001 From: Jin Qian Date: Wed, 22 Feb 2017 17:20:17 -0800 Subject: [PATCH 2/2] libcutils: remove storaged caps Test: adb shell dumpsys storaged --force Bug: 35323867 Change-Id: Ia58e5aa24885dcf56f8c4bec9dc15d0f3b4c3f4f --- libcutils/fs_config.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/libcutils/fs_config.c b/libcutils/fs_config.c index 394a89703..dbfe6a9c3 100644 --- a/libcutils/fs_config.c +++ b/libcutils/fs_config.c @@ -149,10 +149,6 @@ static const struct fs_path_config android_files[] = { "system/bin/run-as" }, { 00700, AID_SYSTEM, AID_SHELL, CAP_MASK_LONG(CAP_BLOCK_SUSPEND), "system/bin/inputflinger" }, - { 00750, AID_SYSTEM, AID_SHELL, CAP_MASK_LONG(CAP_SETUID) | - CAP_MASK_LONG(CAP_SETGID) | - CAP_MASK_LONG(CAP_SYS_PTRACE), - "system/bin/storaged" }, /* Support FIFO scheduling mode in SurfaceFlinger. */ { 00755, AID_SYSTEM, AID_GRAPHICS, CAP_MASK_LONG(CAP_SYS_NICE),