From edc23801091f1a909efe130e0dba8abab3329eb5 Mon Sep 17 00:00:00 2001 From: Christopher Ferris Date: Thu, 5 May 2016 11:13:50 -0700 Subject: [PATCH] Set groups before dropping privileges. The code for dumping tombstones tries to read the log data. This was silently failing after the change to drop root privileges. Fix this by explicitly setting the groups allowed before dropping privileges. Bug: 28590884 Change-Id: Iaccb1d2928268fc9fc855f6e3814c31ce019badf --- debuggerd/debuggerd.cpp | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/debuggerd/debuggerd.cpp b/debuggerd/debuggerd.cpp index b90a5e00c..908af107a 100644 --- a/debuggerd/debuggerd.cpp +++ b/debuggerd/debuggerd.cpp @@ -513,13 +513,21 @@ static bool perform_dump(const debugger_request_t& request, int fd, int tombston } static bool drop_privileges() { + // AID_LOG: for reading the logs data associated with the crashing process. + // AID_READPROC: for reading /proc//{comm,cmdline}. + gid_t groups[] = { AID_DEBUGGERD, AID_LOG, AID_READPROC }; + if (setgroups(sizeof(groups)/sizeof(groups[0]), groups) != 0) { + ALOGE("debuggerd: failed to setgroups: %s", strerror(errno)); + return false; + } + if (setresgid(AID_DEBUGGERD, AID_DEBUGGERD, AID_DEBUGGERD) != 0) { - ALOGE("debuggerd: failed to setresgid"); + ALOGE("debuggerd: failed to setresgid: %s", strerror(errno)); return false; } if (setresuid(AID_DEBUGGERD, AID_DEBUGGERD, AID_DEBUGGERD) != 0) { - ALOGE("debuggerd: failed to setresuid"); + ALOGE("debuggerd: failed to setresuid: %s", strerror(errno)); return false; }