tequilaOS/platform_system_core
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge \"run-as: Use Minijail for privilege dropping.\"

Browse source 
am: ac9b4d47ea

Change-Id: I7f11de0b5136c18b8770b5e25ef6c6c3db117bd1
This commit is contained in:
Jorge Lucangeli Obes 2016-07-19 18:35:00 +00:00 committed by android-build-merger
commit f565b11716
2 changed files with 9 additions and 27 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
run-as/Android.mk
View file

@ -1,8 +1,8 @@
LOCAL_PATH:= $(call my-dir)
include $(CLEAR_VARS)
LOCAL_CFLAGS := -Werror
LOCAL_CFLAGS := -Wall -Werror
LOCAL_MODULE := run-as
LOCAL_SHARED_LIBRARIES := libselinux libpackagelistparser
LOCAL_SHARED_LIBRARIES := libselinux libpackagelistparser libminijail
LOCAL_SRC_FILES := run-as.cpp
include $(BUILD_EXECUTABLE)

32
run-as/run-as.cpp
View file

@ -25,6 +25,9 @@
#include <sys/types.h>
#include <unistd.h>
#include <libminijail.h>
#include <scoped_minijail.h>
#include <packagelistparser/packagelistparser.h>
#include <private/android_filesystem_config.h>
#include <selinux/android.h>
@ -136,19 +139,6 @@ int main(int argc, char* argv[]) {
error(1, 0, "only 'shell' or 'root' users can run this program");
}
__user_cap_header_struct capheader;
__user_cap_data_struct capdata[2];
memset(&capheader, 0, sizeof(capheader));
memset(&capdata, 0, sizeof(capdata));
capheader.version = _LINUX_CAPABILITY_VERSION_3;
capdata[CAP_TO_INDEX(CAP_SETUID)].effective |= CAP_TO_MASK(CAP_SETUID);
capdata[CAP_TO_INDEX(CAP_SETGID)].effective |= CAP_TO_MASK(CAP_SETGID);
capdata[CAP_TO_INDEX(CAP_SETUID)].permitted |= CAP_TO_MASK(CAP_SETUID);
capdata[CAP_TO_INDEX(CAP_SETGID)].permitted |= CAP_TO_MASK(CAP_SETGID);
if (capset(&capheader, &capdata[0]) == -1) {
error(1, errno, "couldn't set capabilities");
}
char* pkgname = argv[1];
int cmd_argv_offset = 2;
@ -201,18 +191,10 @@ int main(int argc, char* argv[]) {
// same time to avoid nasty surprises.
uid_t uid = userAppId;
uid_t gid = userAppId;
if (setresgid(gid, gid, gid) == -1) {
error(1, errno, "setresgid failed");
}
if (setresuid(uid, uid, uid) == -1) {
error(1, errno, "setresuid failed");
}
// Required if caller has uid and gid all non-zero.
memset(&capdata, 0, sizeof(capdata));
if (capset(&capheader, &capdata[0]) == -1) {
error(1, errno, "couldn't clear all capabilities");
}
ScopedMinijail j(minijail_new());
minijail_change_uid(j.get(), uid);
minijail_change_gid(j.get(), gid);
minijail_enter(j.get());
if (selinux_android_setcontext(uid, 0, info.seinfo, pkgname) < 0) {
error(1, errno, "couldn't set SELinux security context");