tequilaOS/platform_system_core
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

init: Drop inheritable capabilities when switching uids

Browse source 
This change explicitly drops all inheritable capabilities (and, by
extension, ambient capabilities) when there are no explicit capabilities
being set by a service and the user is changed. This prevents Android
running in a container from accidentally granting extra capabilities to
services.

Bug: 69320306
Test: aosp_sailfish still boots
Test: sailfish:/ $ grep Cap /proc/`pidof android.hardware.audio@2.0-service`/status
      CapInh: 0000000000000000
      CapPrm: 0000000000000000
      CapEff: 0000000000000000
      CapBnd: 0000003fffffffff
      CapAmb: 0000000000000000
Test: sailfish:/ $ grep Cap /proc/`pidof logd`/status
      CapInh: 0000000000000000
      CapPrm: 0000000440000000
      CapEff: 0000000440000000
      CapBnd: 0000003fffffffff
      CapAmb: 0000000000000000
Test: Android in Chrome OS still boots
Test: localhost ~ # grep Cap /proc/`pidof android.hardware.audio@2.0-service`/status
      CapInh: 0000000000000000
      CapPrm: 0000000000000000
      CapEff: 0000000000000000
      CapBnd: 000000006daefdff
      CapAmb: 0000000000000000
Test: localhost ~ # grep Cap /proc/`pidof logd`/status
      CapInh: 0000000000000000
      CapPrm: 0000000040000000
      CapEff: 0000000040000000
      CapBnd: 000000006daefdff
      CapAmb: 0000000000000000

Change-Id: I9218f2e27ff4fb4d91d50f9a98c0fdb4e272952c
This commit is contained in:
Luis Hector Chavez 2017-11-16 15:52:00 -08:00
parent 37eb97d911
commit 94fb5b0bef
3 changed files with 19 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
init/capabilities.cpp
View file

@ -194,5 +194,18 @@ bool SetCapsForExec(const CapSet& to_keep) {
return SetAmbientCaps(to_keep);
}
bool DropInheritableCaps() {
ScopedCaps caps(cap_get_proc());
if (cap_clear_flag(caps.get(), CAP_INHERITABLE) == -1) {
PLOG(ERROR) << "cap_clear_flag(INHERITABLE) failed";
return false;
}
if (cap_set_proc(caps.get()) != 0) {
PLOG(ERROR) << "cap_set_proc() failed";
return false;
}
return true;
}
} // namespace init
} // namespace android

1
init/capabilities.h
View file

@ -35,6 +35,7 @@ int LookupCap(const std::string& cap_name);
bool CapAmbientSupported();
unsigned int GetLastValidCap();
bool SetCapsForExec(const CapSet& to_keep);
bool DropInheritableCaps();
} // namespace init
} // namespace android

5
init/service.cpp
View file

@ -291,6 +291,11 @@ void Service::SetProcessAttributes() {
if (!SetCapsForExec(capabilities_)) {
LOG(FATAL) << "cannot set capabilities for " << name_;
}
} else if (uid_) {
// Inheritable caps can be non-zero when running in a container.
if (!DropInheritableCaps()) {
LOG(FATAL) << "cannot drop inheritable caps for " << name_;
}
}
}