Add the following mount options to the /proc filesystem:
hidepid=2,gid=3009
This change blocks /proc access unless you're in group 3009
(aka AID_READPROC).
Please see
https://github.com/torvalds/linux/blob/master/Documentation/filesystems/proc.txt
for documentation on the hidepid option.
hidepid=2 is preferred over hidepid=1 since it leaks less information
and doesn't generate SELinux ptrace denials when trying to access
/proc without being in the proper group.
Add AID_READPROC to processes which need to access /proc entries for
other UIDs.
Bug: 23310674
Change-Id: I22bb55ff7b80ff722945e224845215196f09dafa
Now that libselinux uses libpackagelistparser, in order
for libpackagelistparser to be properly statically linked
liblog must come after libselinux for all the liblog
references to be defined in libpackagelistparser which
is included in libselinux. This patch corrects that order.
Change-Id: I7aee10c9395310919779ed2463aab6b2f8b380cc
Signed-off-by: William Roberts <william.c.roberts@intel.com>
Keeping these means that every build has different init and debuggerd
binaries, even if the source was the same. So OTAs that don't touch
these sources would still need to update the binaries.
Both of these messages are only informational, so can be safely removed.
Bootchart already encodes build-specific information from the system
properties.
Bug: 24204119
Change-Id: I7ebd65a20a3e031e7528c9f741616e20b3cd7446
* commit '2fb90dc8b2b590e674c5e433e8bf3d3f08a887c8':
debuggerd: audit pid, uid and gid on SE Linux denial
property_service: log pid,uid and gid of setprop client
The cost of generating and throwing away a bunch of stuff that no one
normally sees is high enough to be worth avoiding.
Here's AOSP ToT on N9...
init: (Parsing /system/etc/init/atrace.rc took 0.0112s.)
init: (Parsing /system/etc/init/bootanim.rc took 0.0094s.)
init: (Parsing /system/etc/init/crash_reporter.rc took 0.0103s.)
init: (Parsing /system/etc/init/debuggerd.rc took 0.0090s.)
init: (Parsing /system/etc/init/debuggerd64.rc took 0.0085s.)
init: (Parsing /system/etc/init/drmserver.rc took 0.0078s.)
init: (Parsing /system/etc/init/dumpstate.rc took 0.0073s.)
init: (Parsing /system/etc/init/gatekeeperd.rc took 0.0063s.)
init: (Parsing /system/etc/init/installd.rc took 0.0067s.)
init: (Parsing /system/etc/init/keystore.rc took 0.0060s.)
init: (Parsing /system/etc/init/lmkd.rc took 0.0060s.)
init: (Parsing /system/etc/init/logcatd.rc took 0.0059s.)
init: (Parsing /system/etc/init/logd.rc took 0.0068s.)
init: (Parsing /system/etc/init/mdnsd.rc took 0.0057s.)
init: (Parsing /system/etc/init/mediaserver.rc took 0.0064s.)
init: (Parsing /system/etc/init/metrics_daemon.rc took 0.0063s.)
init: (Parsing /system/etc/init/mtpd.rc took 0.0055s.)
init: (Parsing /system/etc/init/netd.rc took 0.0066s.)
init: (Parsing /system/etc/init/perfprofd.rc took 0.0057s.)
init: (Parsing /system/etc/init/racoon.rc took 0.0054s.)
init: (Parsing /system/etc/init/rild.rc took 0.0061s.)
init: (Parsing /system/etc/init/servicemanager.rc took 0.0063s.)
init: (Parsing /system/etc/init/surfaceflinger.rc took 0.0061s.)
init: (Parsing /system/etc/init/uncrypt.rc took 0.0068s.)
init: (Parsing /system/etc/init/vdc.rc took 0.0065s.)
init: (Parsing /system/etc/init/vold.rc took 0.0063s.)
0.0112+0.0094+0.0103+0.0090+0.0085+0.0078+0.0073+0.0063+0.0067+0.0060+
0.0060+0.0059+0.0068+0.0057+0.0064+0.0063+0.0055+0.0066+0.0057+0.0054+
0.0061+0.0063+0.0061+0.0068+0.0065+0.0063 = 0.1809
And here it is again with the logging disabled:
init: (Parsing /system/etc/init/atrace.rc took 0.0021s.)
init: (Parsing /system/etc/init/bootanim.rc took 0.0006s.)
init: (Parsing /system/etc/init/crash_reporter.rc took 0.0007s.)
init: (Parsing /system/etc/init/debuggerd.rc took 0.0004s.)
init: (Parsing /system/etc/init/debuggerd64.rc took 0.0005s.)
init: (Parsing /system/etc/init/drmserver.rc took 0.0005s.)
init: (Parsing /system/etc/init/dumpstate.rc took 0.0005s.)
init: (Parsing /system/etc/init/gatekeeperd.rc took 0.0005s.)
init: (Parsing /system/etc/init/installd.rc took 0.0005s.)
init: (Parsing /system/etc/init/keystore.rc took 0.0013s.)
init: (Parsing /system/etc/init/lmkd.rc took 0.0006s.)
init: (Parsing /system/etc/init/logcatd.rc took 0.0013s.)
init: (Parsing /system/etc/init/logd.rc took 0.0007s.)
init: (Parsing /system/etc/init/mdnsd.rc took 0.0005s.)
init: (Parsing /system/etc/init/mediaserver.rc took 0.0009s.)
init: (Parsing /system/etc/init/metrics_daemon.rc took 0.0008s.)
init: (Parsing /system/etc/init/mtpd.rc took 0.0011s.)
init: (Parsing /system/etc/init/netd.rc took 0.0005s.)
init: (Parsing /system/etc/init/perfprofd.rc took 0.0005s.)
init: (Parsing /system/etc/init/racoon.rc took 0.0005s.)
init: (Parsing /system/etc/init/rild.rc took 0.0005s.)
init: (Parsing /system/etc/init/servicemanager.rc took 0.0005s.)
init: (Parsing /system/etc/init/surfaceflinger.rc took 0.0005s.)
init: (Parsing /system/etc/init/uncrypt.rc took 0.0005s.)
init: (Parsing /system/etc/init/vdc.rc took 0.0005s.)
init: (Parsing /system/etc/init/vold.rc took 0.0006s.)
0.0021+0.0006+0.0007+0.0004+0.0005+0.0005+0.0005+0.0005+0.0005+0.0013+
0.0006+0.0013+0.0007+0.0005+0.0009+0.0008+0.0011+0.0005+0.0005+0.0005+
0.0005+0.0005+0.0005+0.0005+0.0005+0.0006 = 0.0181
It's less than a second, but one problem is that the cost of the current
dumping is proportional to the number of init.rc files, so the more
cleanly you factor things, the more it would cost.
Change-Id: Id96f59e7d0b082d8cfdba4bdbff43a922ba4eeee
When auditing setprop denials, it is often unclear of who the process is
in a multi-process domain. To help identify the invoker, log the pid, uid,
and gid of the caller.
Before:
avc: denied { set } for property=wifi.xxx ...
After:
avc: denied { set } for property=wifi.xxx pid=30691 uid=123 gid=345 ...
Change-Id: I5cdcb3d18fbd52e0987b5e1497b9f6620c6c742a
Signed-off-by: William Roberts <william.c.roberts@intel.com>
device.shell() was changed to return a (stdout, stderr) tuple in
the following CL.
https://android-review.googlesource.com/170420
This CL fixes perfboot.py to work with the return value.
Change-Id: I85d72fc63c1f96257fb19c3051482991a7b4049d
Updates are as follows:
A detailed explanation of event triggers and property triggers
including how they can now be used
A new section describing .rc files, their locations, and the
intentions for each of these locations
A new section describing the import keyword and how it is not a
command but rather its own section
Removal of deprecated or incorrect text
Change-Id: If0a37375ac92a857900f3303ada4ba742360daff
Create a Parser class that uses multiple SectionParser interfaces to
handle parsing the different sections of an init rc.
Create an ActionParser and ServiceParser that implement SectionParser
and parse the sections corresponding to Action and Service
classes.
Remove the legacy keyword structure and replace it with std::map's
that map keyword -> (minimum args, maximum args, function pointer) for
Commands and Service Options.
Create an ImportParser that implements SectionParser and handles the
import 'section'.
Clean up the unsafe memory handling of the Action class by using
std::unique_ptr.
Change-Id: Ic5ea5510cb956dbc3f78745a35096ca7d6da7085
When init queues a trigger, it actually enqueues all of the Actions
that match with that given trigger. This works currently because
all init scripts are loaded and therefore all Actions are available
before init starts queueing any triggers.
To support loading init scripts after init has started queueing
triggers, this change enqueues Trigger objects instead of their
matching Actions. Each Trigger object then matches its associated
Actions during its execution.
Additionally, this makes a few cosmetic clean ups related to triggers.
Bug: 23186545
Change-Id: I5d177458e6df1c4b32b1072cf77e87ef952c87e4
The current behavior, which is to use tags[-1] for end_tag, is good
enough in most cases, but sometime it makes more sense to use a
different one as end_tag.
For example, when optimizing APK scanning code in package manager,
using 'boot_progress_pms_scan_end' as end_tag would give us quicker
benchmark iterations as well as more relevant numbers possibly with
a smaller standard deviation.
Change-Id: Ic6371c936b36d1d87e9742502fd8958682a3b7d5
