From 2fccf5ead36d5460c27f442a3a093b2d4d410b21 Mon Sep 17 00:00:00 2001 From: Steven Moreland Date: Mon, 10 Apr 2023 20:55:05 +0000 Subject: [PATCH] Explicit init .rc user. Set the user explicitly. For boringssl self-test, changed to 'nobody' since this test doesn't require permissions. Bug: 276813155 Test: boot, check can 'nobody' can still write to kmesg. Change-Id: I32f7134e83183bd054bffbb22d412d7a2dc0ad09 --- init/test_upgrade_mte/mte_upgrade_test.rc | 2 ++ rootdir/init.rc | 6 +++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/init/test_upgrade_mte/mte_upgrade_test.rc b/init/test_upgrade_mte/mte_upgrade_test.rc index a3e596ccd..aa6c18f05 100644 --- a/init/test_upgrade_mte/mte_upgrade_test.rc +++ b/init/test_upgrade_mte/mte_upgrade_test.rc @@ -16,9 +16,11 @@ service mte_upgrade_test_helper /system/bin/mte_upgrade_test_helper ${sys.mte_cr class late_start disabled seclabel u:r:su:s0 + user root service mte_upgrade_test_helper_overridden /system/bin/mte_upgrade_test_helper ${sys.mte_crash_test_uuid} class late_start disabled seclabel u:r:su:s0 + user root setenv BIONIC_MEMTAG_UPGRADE_SECS 0 diff --git a/rootdir/init.rc b/rootdir/init.rc index b165778b6..d755b503d 100644 --- a/rootdir/init.rc +++ b/rootdir/init.rc @@ -475,25 +475,28 @@ service boringssl_self_test32 /system/bin/boringssl_self_test32 stdio_to_kmsg # Explicitly specify that boringssl_self_test32 doesn't require any capabilities capabilities + user nobody service boringssl_self_test64 /system/bin/boringssl_self_test64 reboot_on_failure reboot,boringssl-self-check-failed stdio_to_kmsg # Explicitly specify that boringssl_self_test64 doesn't require any capabilities capabilities + user nobody service boringssl_self_test_apex32 /apex/com.android.conscrypt/bin/boringssl_self_test32 reboot_on_failure reboot,boringssl-self-check-failed stdio_to_kmsg # Explicitly specify that boringssl_self_test_apex32 doesn't require any capabilities capabilities + user nobody service boringssl_self_test_apex64 /apex/com.android.conscrypt/bin/boringssl_self_test64 reboot_on_failure reboot,boringssl-self-check-failed stdio_to_kmsg # Explicitly specify that boringssl_self_test_apex64 doesn't require any capabilities capabilities - + user nobody # Healthd can trigger a full boot from charger mode by signaling this # property when the power button is held. @@ -1260,6 +1263,7 @@ service ueventd /system/bin/ueventd class core critical seclabel u:r:ueventd:s0 + user root shutdown critical service console /system/bin/sh