Merge "init.rc: Lock down access to /proc/net/fib_trie" into oc-mr1-dev

am: c3090ba2f4 Change-Id: I9ffa9c76b807c8439f05388f4b8aae3d131bac5a
2017-08-28 14:42:49 +00:00 · 2017-08-28 14:42:49 +00:00 · 566ae3ebf6
parent 096d8034a6 c3090ba2f4
commit 566ae3ebf6
1 changed files with 3 additions and 0 deletions
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@ -148,6 +148,9 @@ on init
    write /proc/sys/net/ipv4/conf/all/accept_redirects 0
    write /proc/sys/net/ipv6/conf/all/accept_redirects 0

+    # /proc/net/fib_trie leaks interface IP addresses
+    chmod 0400 /proc/net/fib_trie
+
    # Create cgroup mount points for process groups
    mkdir /dev/cpuctl
    mount cgroup none /dev/cpuctl cpu