tequilaOS/platform_bionic
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Don't resolve permitted.paths"

Browse source
This commit is contained in:
Treehugger Robot 2017-09-22 05:56:37 +00:00 committed by Gerrit Code Review
commit 24c9c3f380
1 changed files with 21 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
linker/linker_config.cpp
View file

@ -320,7 +320,7 @@ class Properties {
return (it == properties_.end()) ? "" : it->second.value();
}
std::vector<std::string> get_paths(const std::string& name, size_t* lineno = nullptr) {
std::vector<std::string> get_paths(const std::string& name, bool resolve, size_t* lineno = nullptr) {
std::string paths_str = get_string(name, lineno);
std::vector<std::string> paths;
@ -338,12 +338,16 @@ class Properties {
format_string(&path, params);
}
std::vector<std::string> resolved_paths;
if (resolve) {
std::vector<std::string> resolved_paths;
// do not remove paths that do not exist
resolve_paths(paths, &resolved_paths);
// do not remove paths that do not exist
resolve_paths(paths, &resolved_paths);
return resolved_paths;
return resolved_paths;
} else {
return paths;
}
}
void set_target_sdk_version(int target_sdk_version) {
@ -474,8 +478,18 @@ bool Config::read_binary_config(const char* ld_config_file_path,
property_name_prefix += ".asan";
}
ns_config->set_search_paths(properties.get_paths(property_name_prefix + ".search.paths"));
ns_config->set_permitted_paths(properties.get_paths(property_name_prefix + ".permitted.paths"));
// search paths are resolved (canonicalized). This is required mainly for
// the case when /vendor is a symlink to /system/vendor, which is true for
// non Treble-ized legacy devices.
ns_config->set_search_paths(properties.get_paths(property_name_prefix + ".search.paths", true));
// However, for permitted paths, we are not required to resolve the paths
// since they are only set for isolated namespaces, which implies the device
// is Treble-ized (= /vendor is not a symlink to /system/vendor).
// In fact, the resolving is causing an unexpected side effect of selinux
// denials on some executables which are not allowed to access some of the
// permitted paths.
ns_config->set_permitted_paths(properties.get_paths(property_name_prefix + ".permitted.paths", false));
}
failure_guard.Disable();