openkylin
/
platform_system_core
mirror of https://gitee.com/openkylin/platform_system_core.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge \"Use Minijail for privilege dropping.\" 

am: 97f49e5cb3

Change-Id: I032ea3fcdac1a16bf36d43731b8533214264fee2
This commit is contained in:
Jorge Lucangeli Obes 2016-07-18 16:06:38 +00:00 committed by android-build-merger
parent c067116ad5 97f49e5cb3
commit fe4f764e75
2 changed files with 15 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sdcard/Android.mk
View File

@ -5,7 +5,7 @@ include $(CLEAR_VARS)
LOCAL_SRC_FILES := sdcard.cpp fuse.cpp
LOCAL_MODULE := sdcard
LOCAL_CFLAGS := -Wall -Wno-unused-parameter -Werror
LOCAL_SHARED_LIBRARIES := libbase liblog libcutils libpackagelistparser
LOCAL_SHARED_LIBRARIES := libbase liblog libcutils libminijail libpackagelistparser
LOCAL_SANITIZE := integer
LOCAL_CLANG := true

24
sdcard/sdcard.cpp
View File

@ -36,6 +36,9 @@
#include <cutils/multiuser.h>
#include <packagelistparser/packagelistparser.h>
#include <libminijail.h>
#include <scoped_minijail.h>
#include <private/android_filesystem_config.h>
// README
@ -204,6 +207,15 @@ static int fuse_setup(struct fuse* fuse, gid_t gid, mode_t mask) {
return 0;
}
static void drop_privs(uid_t uid, gid_t gid) {
ScopedMinijail j(minijail_new());
minijail_set_supplementary_gids(j.get(), sizeof(kGroups) / sizeof(kGroups[0]), kGroups);
minijail_change_gid(j.get(), gid);
minijail_change_uid(j.get(), uid);
/* minijail_enter() will abort if priv-dropping fails. */
minijail_enter(j.get());
}
static void* start_handler(void* data) {
struct fuse_handler* handler = static_cast<fuse_handler*>(data);
handle_fuse_requests(handler);
@ -299,16 +311,8 @@ static void run(const char* source_path, const char* label, uid_t uid,
}
}
/* Drop privs. */
if (setgroups(sizeof(kGroups) / sizeof(kGroups[0]), kGroups) < 0) {
PLOG(FATAL) << "cannot setgroups";
}
if (setgid(gid) < 0) {
PLOG(FATAL) << "cannot setgid";
}
if (setuid(uid) < 0) {
PLOG(FATAL) << "cannot setuid";
}
// Will abort if priv-dropping fails.
drop_privs(uid, gid);
if (multi_user) {
fs_prepare_dir(global.obb_path, 0775, uid, gid);