tequilaOS/platform_system_core
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_core/logd/logd.rc

36 lines
888 B
Text
Raw Normal View History

bundle init.rc contents with its service Bug: 23186545 Change-Id: I52616b8ab1165fdef716f9b8f958665f2308c12e
2015-08-14 22:02:51 +02:00
service logd /system/bin/logd
socket logd stream 0666 logd logd
socket logdr seqpacket 0666 logd logd
logd: add "+passcred" for logdw socket Tell init to set SO_PASSCRED on the socket before bind() and handoff. Test: gtest logd-unit-test --gtest_filter=logd.statistics right after boot Bug: 37985222 Change-Id: I318969ee3241834e5326233aabd97e52ef505969
2017-05-06 00:32:10 +02:00
socket logdw dgram+passcred 0222 logd logd
logd: inherit android_get_control_file() Setup and then collect from the environment /proc/kmsg and /dev/kmsg file descriptors. Do not do so for logcat --reinit. Test: gTest logd-unit-tests, liblog-unit-tests and logcat-unit-tests Bug: 32450474 Change-Id: Ied537ca561fcd4e71a9ad9c57398a23ba23f6ced
2016-10-27 17:21:35 +02:00
file /proc/kmsg r
file /dev/kmsg w
logd: start logd service in logd uid Test: gTest logd-unit-tests, liblog-unit-tests and logcat-unit-tests Manual inspect grep '^Cap' /proc/<tid>/status for correct capabilities Bug: 32450474 Change-Id: Ia6a3872901969a789d4309d410dbfd5f5d17b3ce
2016-10-28 23:36:36 +02:00
user logd
logd: refine permissions to access /data/system/packages.list Refine DAC security surrounding logd.daemon worker thread and add a positive test for logd failure to access /data/system/packages.list. - Add AID_PACKAGE_INFO to groups of worker thread. - Move AID_SYSTEM to groups, setgid to AID_LOGD. - Do not drop capabilities until after setting the uid and gids. - Add a test that is part of logd.statistics test to check when packagelistparser appears broken. - If /data/system/packages.list is encrypted, ensure we do not pick up the existing inode to ensure strong positive when finding access problems. - Replace all occurrences of NULL with nullptr in gTest code for compliance with best practices. Test: gTest logd-unit-tests --gtest_filter=logd.statistics (expect consistent failure, later CLs fix) Bug: 37751120 Bug: 36645158 Change-Id: I01b26fe5e25203246ae432d272c8daa9c07cab54
2017-04-27 23:46:31 +02:00
group logd system package_info readproc
logd: don't drop user/groups/capabilities/priority in drop_privs() On Android, unlike POSIX, groups and capabilities are able to be set per thread. This is useless however, since threads are not a security boundary. This change drops the logic to set groups and capabilities per thread and instead leaves all threads running with the initial user and groups. This does still drop some capabilities if they're unneeded due to features being disabled. This also moves the setpriority() call from code into the init script. Test: logd runs with the expected user/groups and with the expected capabilities and priority without any errors Change-Id: Ibb0e529ea1574a2b8ec391a2678504ca9fbe19be
2019-06-06 22:41:20 +02:00
capabilities SYSLOG AUDIT_CONTROL
priority 10
resolved conflicts for 5caca3dd to mnc-dr-dev-plus-aosp Change-Id: I773e514a8232b77cdd566dc36c9efc4e15f206f0
2015-09-21 23:25:34 +02:00
writepid /dev/cpuset/system-background/tasks
bundle init.rc contents with its service Bug: 23186545 Change-Id: I52616b8ab1165fdef716f9b8f958665f2308c12e
2015-08-14 22:02:51 +02:00
service logd-reinit /system/bin/logd --reinit
oneshot
disabled
logd: start logd services in logd gid logd - start as root:logd+system+readproc logd-reinit - start as logd:logd ToDo: start as logd:logd+system+readproc (libminijail) Test: gTest logd-unit-tests, liblog-unit-tests and logcat-unit-tests Bug: 32450474 Change-Id: I42c806ca1730a7f9eb9e34f064ae31a2ef9fc678
2016-10-27 17:34:12 +02:00
user logd
group logd
resolved conflicts for 5caca3dd to mnc-dr-dev-plus-aosp Change-Id: I773e514a8232b77cdd566dc36c9efc4e15f206f0
2015-09-21 23:25:34 +02:00
writepid /dev/cpuset/system-background/tasks
logd: add getEventTag command and service Will register a new event tag by name and format, and return an event-log-tags format response with the newly allocated tag. If format is not specified, then nothing will be recorded, but a pre-existing named entry will be listed. If name and format are not specified, list all dynamic entries. If name=* list all event log tag entries. Stickiness through logd crash will be managed with the tmpfs file /dev/event-log-tags and through a reboot with add_tag entries in the pmsg last logcat event log. On debug builds we retain a /data/misc/logd/event-log-tags file that aids stickiness and that can be picked up by the bugreport. If we detect truncation damage to /dev/event-log-tags, or to /data/misc/logd/event-log-tags, rebuild file with a new first line signature incorporating the time so mmap'd readers of the file can detect the possible change in shape and order. Manual testing: Make sure nc (netcat) is built for the target platform on the host: $ m nc Then the following can be used to issue a request on the platform: $ echo -n 'getEventTag name=<name> format="<format>"\0EXIT\0' | > nc -U /dev/socket/logd Test: gTest logd-unit-test --gtest_filter=getEventTag* Bug: 31456426 Change-Id: I5dacc5f84a24d52dae09cca5ee1a3a9f9207f06d
2016-09-12 23:51:54 +02:00
introduce auditctl and use it to configure SELinux throttling In an effort to ensure that our development community does not introduce new code without corresponding SELinux changes, Android closely monitors the number of SELinux denials which occur during boot. This monitoring occurs both in treehugger, as well as various dashboards. If SELinux denials are dropped during early boot, this could result in non-determinism for the various SELinux treehugger tests. Introduce /system/bin/auditctl. This tool, model after https://linux.die.net/man/8/auditctl , allows for configuring the throttling rate for the kernel auditing system. Remove any throttling from early boot. This will hopefully reduce treehugger flakiness by making denial generation more predictible during early boot. Reapply the throttling at boot complete, to avoid denial of service attacks against the auditing subsystem. Delete pre-existing unittests for logd / SELinux integration. It's intended that all throttling decisions be made in the kernel, and shouldn't be a concern of logd. Bug: 118815957 Test: Perform an operation which generates lots of SELinux denials, and count how many occur before and after the time period. Change-Id: I6c787dbdd4a28208dc854b543e1727ae92e5eeed
2019-04-09 19:59:39 +02:00
# Limit SELinux denial generation to 5/second
service logd-auditctl /system/bin/auditctl -r 5
oneshot
disabled
user logd
group logd
capabilities AUDIT_CONTROL
logd: add getEventTag command and service Will register a new event tag by name and format, and return an event-log-tags format response with the newly allocated tag. If format is not specified, then nothing will be recorded, but a pre-existing named entry will be listed. If name and format are not specified, list all dynamic entries. If name=* list all event log tag entries. Stickiness through logd crash will be managed with the tmpfs file /dev/event-log-tags and through a reboot with add_tag entries in the pmsg last logcat event log. On debug builds we retain a /data/misc/logd/event-log-tags file that aids stickiness and that can be picked up by the bugreport. If we detect truncation damage to /dev/event-log-tags, or to /data/misc/logd/event-log-tags, rebuild file with a new first line signature incorporating the time so mmap'd readers of the file can detect the possible change in shape and order. Manual testing: Make sure nc (netcat) is built for the target platform on the host: $ m nc Then the following can be used to issue a request on the platform: $ echo -n 'getEventTag name=<name> format="<format>"\0EXIT\0' | > nc -U /dev/socket/logd Test: gTest logd-unit-test --gtest_filter=getEventTag* Bug: 31456426 Change-Id: I5dacc5f84a24d52dae09cca5ee1a3a9f9207f06d
2016-09-12 23:51:54 +02:00
on fs
write /dev/event-log-tags "# content owned by logd
"
chown logd logd /dev/event-log-tags
chmod 0644 /dev/event-log-tags
introduce auditctl and use it to configure SELinux throttling In an effort to ensure that our development community does not introduce new code without corresponding SELinux changes, Android closely monitors the number of SELinux denials which occur during boot. This monitoring occurs both in treehugger, as well as various dashboards. If SELinux denials are dropped during early boot, this could result in non-determinism for the various SELinux treehugger tests. Introduce /system/bin/auditctl. This tool, model after https://linux.die.net/man/8/auditctl , allows for configuring the throttling rate for the kernel auditing system. Remove any throttling from early boot. This will hopefully reduce treehugger flakiness by making denial generation more predictible during early boot. Reapply the throttling at boot complete, to avoid denial of service attacks against the auditing subsystem. Delete pre-existing unittests for logd / SELinux integration. It's intended that all throttling decisions be made in the kernel, and shouldn't be a concern of logd. Bug: 118815957 Test: Perform an operation which generates lots of SELinux denials, and count how many occur before and after the time period. Change-Id: I6c787dbdd4a28208dc854b543e1727ae92e5eeed
2019-04-09 19:59:39 +02:00
on property:sys.boot_completed=1
start logd-auditctl
Reference in a new issue Copy permalink