These will be used for quota tracking on external storage devices
that don't have sdcardfs.
Bug: 146419093
Test: N/A
Change-Id: If00961cc3807bcc3e93675e5d27dd6444007fdba
Helps with support of recovery and rollback boot reason history, by
also using /metadata/bootstat/persist.sys.boot.reason to file the
reboot reason.
Test: manual
Bug: 129007837
Change-Id: Id1d21c404067414847bef14a0c43f70cafe1a3e2
tracefs will be mounted at /sys/kernel/tracing when debugfs
is not mounted.
Bug: 134669095
Test: atest AtraceHostTest
Change-Id: I8178babaa6928ac3796622bdb08f123428ccd191
These will be used as a GID for the Android/data and Android/obb
directories respectively, on devices that don't have sdcardfs.
Bug: 146419093
Test: builds
Change-Id: I52a3235e872eb4b0402f918d5c47661f16626ba6
When debugfs is not mounted, atrace should look for
tracefs in /sys/kernel/tracing.
Test: CtsAtraceHostTestCases
Bug: 148436518
Change-Id: I45c0e664892bcda277fd9612106ad5216aea0a1b
This gid allows processes full access to public areas of external
storage. This includes the following:
1. EmulatedVolumes: All files and directories excluding the app
specific directories under Android/
2. PublicVolumes: Including 'unreliable' volumes (USB OTG) that are
not typically accesible to ordinary apps
Apps with the MANAGE_EXTERNAL_STORAGE permission will automatically
have this gid
Test: m
Bug: 144914977
Change-Id: I17da0b2367e356edc031d063e214574463afc985
Create KernelLibcutilsTest and add it to vts-core.
VtsKernelLibcutilsTest just run the test of libcutils_test_static
and filter-out all of the test except AshmemTest#. We can just use the
include-filter to do the same thing.
Bug: 147789274
Test: atest KernelLibcutilsTest
Change-Id: Idb5cee3596bf063c2419f1a11055a17ad3075e26
The credstore system daemon is running as an unprivileged user. This
CL adds this user and also creates a directory (/data/misc/credstore/)
where this daemon can store its data.
Bug: 111446262
Test: N/A
Change-Id: I8da2c32dd04fef797870b8a7bbc5e499bed71f9e
For a Q APEX built with use_vendor, rather than using AIDL to talk to
ashmemd, it would directly open /dev/ashmem. R libcutils does ashmem
differently, but in order to allow R-built APEXes to replace this
category of APEXes, falling back to /dev/ashmem.
Fixes: 147363115
Test: tested on Q in swcodec APEX
Change-Id: I625e46b15fee6649251ab9be7a1bbe11c5427525
This is to deprecate the sysprop change notification in atrace.
After this change, processes will only update their enabled tags
at the first atrace event. Previously we reloaded the tags as a
result of the sysprop changed Binder notification, which woke up
every process in the system.
Test: adb shell su root atrace -t 10 ss
Test: #define ATRACE_SHMEM 0; adb shell su root atrace -t 10 ss
Bug: 137366208
Change-Id: Idffba5fd4ba23fba2f6b9f594365df68ac0c1626
SurfaceFlinger requires CAP_SYS_NICE which is set in
libcutils/fs_config.cpp. This is the old way of setting capabilities
and new the way is to set it directly on surfaceflnger.rc
Test: adb shell /data/nativetest64/SurfaceFlinger_test/SurfaceFlinger_test
Test: adb shell stop surfaceflinger && adb shell start surfaceflinger
Bug: 147271477
Change-Id: I680509a385928a9c929d4fe4857118af219e2b13
Flattened APEXes can be installed in /system_ext.
Especially, GSI have both flattened/unflattened apexes so that it can
run with updatable devices and non-updatable devices as well.
Bug: 145963716
Test: flash GSI on P device and boot
Change-Id: I3a941672446a5353517243a851739a66f4252617
We're never going to fix this warning and it's not causing any active
issues that vendors are using this header. It is however causing
active issues that we have extraneous warning messages in the log.
Bug: 123758136
Test: no build warnings from <cutils/log.h>
Change-Id: Iccf702bf2536ba106a00ac04467d54401cbe2a50
Use TEMP_FAILURE_RETRY() for recvmsg() to prevent failing
unnecessarily from EINTR. Use PLOG(ERROR) in ueventd to display the
actual error if reading from the uevent socket does fail.
Test: build
Change-Id: I64a22698ce6ffc7573f75b57803551c7b6940e30
Setting executable bit on system_ext/bin is missing, so add them into
list.
Bug: 144066307
Test: m && check if system_ext/bin/* have execute permission.
Change-Id: I89c9e0d2d54f965ecd058bb9e77ba77b7ed164c1
Update fs_config tests for the new behavior in
a8eb00720c.
Before the above CL, fs_config_cmp() would match any partition prefix
to any path, even if there is not a logical relationship between them.
For example, these two lines in the test the demonstrate the changed
behavior:
{ true, "vendor/lib", "system/vendor/lib/hw", true },
{ true, "system/vendor/lib", "vendor/lib/hw", true },
The first line should match and does; it is testing that files located
at system/vendor/lib/hw are matched by an fs_path_config entry
specified as vendor/lib. This is to allow for applying the policy we
have for the vendor partition to files in /system/vendor in the case
that there is no vendor partition.
The second line should not match. This is testing that a file
that's located at vendor/lib/hw is matched by an fs_path_config entry
specified as system/vendor/lib. This is backwards; we do not want to
have policy specified for system/vendor to impact policy for the
vendor partition.
Also, we never have any relationships from /system/oem to /oem or
/system/odm to /odm, so these are logically unrelated and should fail
to match. We do however have a relationship from /vendor/odm to /odm,
so this test is added.
Test: libcutils unit tests pass on CF
Change-Id: I026f0233e00bbd0aad9bc0fb701aef000d2a037c
This reverts commit 5f8162b086.
Reason for revert: Turns out they're being used.
Merged-In: Iad9010190c7a4140b69dc553df5debdd88dcf81a
Change-Id: Iad9010190c7a4140b69dc553df5debdd88dcf81a
These functions and headers were all mistakenly added to the vndk.
They should not be used by vendors.
Test: these symbols do not appear in vendor libraries
Merged-In: I03919b437c2d9f0e573b7a6b40249ed12fe874b9
Change-Id: I03919b437c2d9f0e573b7a6b40249ed12fe874b9
Expose API to return name of task profile for cpuset/sched policy so
that libprocessgroup clients using SetTaskProfiles directly don't have
to maintain the mapping. This reduces the risk of inconsistency and saves
memory.
Bug: 139521784
Test: atest libcutils_test:SchedPolicy
Change-Id: I414312a038613913fb6a827bdcefceb3dec21264
This change is part of a topic that moves the recovery resources from the
system partition to the vendor partition, if it exists, or the vendor directory
on the system partition otherwise. The recovery resources are moving from the
system image to the vendor partition so that a single system image may be used
with either an A/B or a non-A/B vendor image. The topic removes a delta in the
system image that prevented such reuse in the past.
The recovery resources that are moving are involved with updating the recovery
partition after an update. In a non-A/B configuration, the system boots from
the recovery partition, updates the other partitions (system, vendor, etc.)
Then, the next time the system boots normally, a script updates the recovery
partition (if necessary). This script, the executables it invokes, and the data
files that it uses were previously on the system partition. The resources that
are moving include the following.
* install-recovery.sh
* applypatch
* recovery-resource.dat (if present)
* recovery-from-boot.p (if present)
This change moves the recovery resources to vendor in libcutils/fs_config.cpp
and removes the flash_recovery service from rootdir/init.rc. This service moved
to a vendor init.rc file in bootable/recovery/applypatch.
Bug: 68319577
Test: Ensure that recovery partition is updated correctly.
Change-Id: I492f7989ea8042912e9d0e0eadeaa351affbee13
Having libcutils ask ashmemd for ashmem fds results in unsatisfactory
performance/memory overhead. Introduce a duplicate of /dev/ashmem and
route to it instead.
Our goal remains as before, namely, use SELinux to phase out usage of
ashmem that doesn't go through libcutils.
Bug: 139855428
Test: boot aosp_crosshatch, browse internet, use camera
Change-Id: I02260a9042acb412571b11f1f4c1d8608483064a
This reverts commit aa96e8898c.
Reason for revert: It caused BB, and b/139257138 is for your reference
Change-Id: I93f1d0ba0fa43325e2815e9b2de84bb7cb41c457
With Treble and Mainline, each partition needs to be able to
independently define its own set of AIDs and therefore needs its own
AID range to not conflict with updates made to other partitions.
This includes the system partition in the case of vendors making
additions to it. Bionic will always have the hardcoded list of
platform AIDs in its own reserved list.
Bug: 73062966
Test: can load AIDs from partitions other than vendor
Test: bionic-unit-tests
Change-Id: I6509acc555cd28b421b9edaf3f8006bad6c56125
No one outside of libcutils is using these structs and we don't want
to leak them as they are private.
Test: build
Change-Id: I1c95564a9843c9155a333334008cbff7c7ff1f51
This reverts commit 1ec3b78b67.
Reason for revert: breaks all camera use cases
Bug: 135568875
Exempt-From-Owner-Approval: revert, no build cop
Change-Id: Iec8e1f94f5bedced3f3faf73f851fd2f13e2e768
libprocessgroup symbols are being moved into libcutils in order to
optimize linking/memory usage. libprocessgroup will no longer be
required in the future (however removing references to it will come
separately).
Bug: 135145426
Test: boot
Test:
BEFORE:
$ adb shell showmap -a $(pid hwservicemanager) | grep -P "libprocessgroup|libcutils" -A1 | grep -P 'libprocessgroup|libcutils|\.bss' | awk '{s += $9}END{print s}'
28
AFTER:
$ adb shell showmap -a $(pid hwservicemanager) | grep -P "libprocessgroup|libcutils" -A1 | grep -P 'libprocessgroup|libcutils|\.bss' | awk '{s += $9}END{print s}'
12
Change-Id: I10d7c2d2b2b14cbbe0a128b9156d31206419d24c
We replaced creating the binary fs_config files with a python script
(/build/make/tools/fs_config/fs_config_generator.py), so there are no
more users of this function, nor do we plan for there to be.
Test: build
Change-Id: I49ec7e3d22c206bc250cbda6f66a4a59e47030e9
In device root directory, we have the following symlinks:
- /odm/app -> /vendor/odm/app
- /odm/bin -> /vendor/odm/bin
- /odm/etc -> /vendor/odm/etc
...
This allows the Generic System Image (GSI) to be used on both devices:
1) Has a physical odm partition, where those symlink will be hidden
when /odm is used as the mount point
2) Has no physical odm partition and fallback to /vendor/odm/.
We can't just have the symlink /odm -> /vendor/odm, because the former
devices won't have /vendor/odm directory, which leads to mount failure
when the mount point /odm is resolved to /vendor/odm.
The existing /vendor/odm/build.prop won't be loaded in the latter
devices, because there is no symlink
- /odm/build.prop -> /vendor/odm/build.prop.
Note that init blocks reading through direct symlinks (O_NOFOLLOW) so
the above symlink won't work either. This CL moves the odm build.prop
to /odm/etc/build.prop for init to load it (symlinks in earlier
components of the path will still be followed by O_NOFOLLOW).
Bug: 132128501
Test: boot a device and checks /odm/etc/build.prop is loaded
Change-Id: I0733c277baa67c549bb45599abb70aba13fbdbcf
Merged-In: I0733c277baa67c549bb45599abb70aba13fbdbcf
(cherry picked from commit c49655b2a4)
In device root directory, we have the following symlinks:
- /odm/app -> /vendor/odm/app
- /odm/bin -> /vendor/odm/bin
- /odm/etc -> /vendor/odm/etc
...
This allows the Generic System Image (GSI) to be used on both devices:
1) Has a physical odm partition, where those symlink will be hidden
when /odm is used as the mount point
2) Has no physical odm partition and fallback to /vendor/odm/.
We can't just have the symlink /odm -> /vendor/odm, because the former
devices won't have /vendor/odm directory, which leads to mount failure
when the mount point /odm is resolved to /vendor/odm.
The existing /vendor/odm/build.prop won't be loaded in the latter
devices, because there is no symlink
- /odm/build.prop -> /vendor/odm/build.prop.
Note that init blocks reading through direct symlinks (O_NOFOLLOW) so
the above symlink won't work either. This CL moves the odm build.prop
to /odm/etc/build.prop for init to load it (symlinks in earlier
components of the path will still be followed by O_NOFOLLOW).
Bug: 132128501
Test: boot a device and checks /odm/etc/build.prop is loaded
Change-Id: I0733c277baa67c549bb45599abb70aba13fbdbcf
Merged-In: I0733c277baa67c549bb45599abb70aba13fbdbcf
Android build system added support for building translated binaries
used on natively bridged targets (arm on x86 for example).
However in order to avoid building unnecessary binaries and libraries
for such architectures most modules do not support native bridge by default.
All needed modules have to explicitly indicate if they may be used as part
of translated binary build.
This change enabled native bridge support for libcutils which is a
greylisted library (available for apps targeting Android version < N).
Bug: http://b/77159578
Test: make
Change-Id: I56fe5e11a884d22714cfc4afb78bec0a352d6370
In odm's binary files can't have executable permission.
Add default executable permission in odm/bin and vendor/odm/bin.
Previously partitions that except system, only appeared in
system partition if product haven't separated partition.
After support ODM, vendor/odm should considered.
Bug : 124465978
Test : Check each file's permission.
system/vendor/bin/* -> 0755
system/product/bin/* -> 0755
system/product_services/bin/* -> 0644
system/oem/bin/* -> 0644
vendor/odm/bin/* -> 0755
vendor/product/bin/* -> 0644
vendor/product_services/bin/* -> 0644
Change-Id: I5cee48474fceaf73853b2013d58017bd64953d86
Add a new ashmem_init function that only dlopens libashmemd_client.
This allows the library to be preloaded in the zygote.
Test: boots, works
Bug: 129543489
Change-Id: Ie106791edf381654f085203c266c9f9c0df35cfc
Add a new ashmem_init function that only dlopens libashmemd_client.
This allows the library to be preloaded in the zygote.
Test: boots, works
Bug: 129543489
Change-Id: Ie106791edf381654f085203c266c9f9c0df35cfc
Use the LL-NDK library to read cgroup.rc.
As a side-effect, the CgroupController class is changed
to a wrapper of ACgroupController* from the library. The
class itself essentially becomes the pointer, and can be
trivially copied. Modify all client code for this change.
Test: builds and boots
Bug: 123664216
Change-Id: I635d9885db62e82f37421f6d20f59c84a6f4cbb2
Merged-In: I635d9885db62e82f37421f6d20f59c84a6f4cbb2
Use the LL-NDK library to read cgroup.rc.
As a side-effect, the CgroupController class is changed
to a wrapper of ACgroupController* from the library. The
class itself essentially becomes the pointer, and can be
trivially copied. Modify all client code for this change.
Test: builds and boots
Bug: 123664216
Change-Id: I635d9885db62e82f37421f6d20f59c84a6f4cbb2
Hex literals have the type of the first type they fit in. The reboot
constants are large enough that that's `unsigned` rather than `int`.
Bug: http://b/76110968
Test: treehugger
Change-Id: Iac4fe61d1fe572297febf0b57e34d698942469f9
It appears Chase has fixed their app, so we no longer need to keep these
permissions relaxed.
This reverts commit 53842f8a90.
Bug: 119605322
Test: compiles and boots
Change-Id: Iba5e9ecd685eb386997a5e92638b8a1b5943ad4b
Having shared host libraries allows libraries depending on these to use
'shared_libs' for these. This simplifies configurations since these
libraries don't have to specify 'shared_libs' on all non-host targets.
Bug: 124524556
Test: build only
Change-Id: I09fb4a4fb66ea0a87cb76b1e6f400c537a11f082
If the path to android_get_control_file is a symlink, the final sanity
check will fail that the fd does not have the same path as the given
file. We can't expect callers to readlink() because this would change
the environment key. Instead, try to call realpath on both paths.
Bug: 126233777
Test: lpdump
Change-Id: I0df10d7dbe3e572b8335faad812e5cd80bff1733
Remove a superfluous check in fs_mgr, since those return values are
already impossible for a non-debuggable build. Replace a one time
call to __android_log_is_debuggable(), since there's no reason to
cache the value or use this symbol.
Test: build
Change-Id: Icd4bef7b616c49d304303747388d7e3018c6fcfc
Move tests in the same directory as the corresponding code, so it's
easier to see what is/isn't tested.
Fix naming of libcutils_tests (plural) to match the singular that's more
common (even though the plural makes more sense to me).
Add these two to system/core/'s TEST_MAPPING.
Remove obsolete AndroidTest.xml.
Fix a flaky (timing-dependent) libcutils test.
Test: ran tests
Change-Id: I7e0a31ff45c8a152562bf66fc97161594249366e
This patch adds support to make libcutils create and use memfd where
possible, instead of ashmem.
The libcutils library is made dynamic, since apps are still sending over
ashmem FDs to processes and we are working on moving those apps away
from ashmem. The best we can do for that is make the library work, and
force apps in the long run to move away from directly using ashmem.
Due to further complications mentioned in the 'NOTE' section of the
patch, memfd is kept disabled for now, so nothing changes yet. To enable
it, set the sys.use_memfd property (check user_debug build).
Bug: 113362644
Change-Id: I491cb7841b664db5b1c26b3e07a440a14810e182
Signed-off-by: Joel Fernandes <joelaf@google.com>
If libcutils is not a VNDK version and /dev/ashmem is not available,
then ask ashmemd for opened fd to /dev/ashmem.
We rely on SELinux policy to determine what's allowed to open
/dev/ashmem directly.
Bug: 113362644
Test: device boots (in selinux permissive mode)
Change-Id: I93c4fa6044b0bfa5282097c6c32139a8d8f67deb
Abstract usage of cgroups into task profiles that allows for changes
in cgroup hierarchy and version without affecting framework codebase.
Rework current processgroup and sched_policy API function implementations
to use task profiles instead of hardcoded paths and attributes.
Mount cgroups using information from cgroups.json rather than from init.rc
Exempt-From-Owner-Approval: already approved in internal master
Bug: 111307099
Test: builds, boots
Change-Id: If5532d6dc570add825cebd5b5148e00c7d688e32
Merged-In: If5532d6dc570add825cebd5b5148e00c7d688e32
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
When TARGET_FLATTEN_APEX is set to true, the APEXes are flattened
directly under /system/apex/<name>. Among them the runtime APEX carries
binaries such as linker, dex2oat and they need to be configured to be
executable.
Bug: 123684826
Test: Marlin/sailfish boots to the UI
Change-Id: I8ebe9dc4341410ff91ca2cb7cf95e21b0829c008
This reverts commit b5394db682.
Reason for revert: AOSP is fixed with new vendor image
Change-Id: Ie1a2e0200600214a65f4fe2250c903c8e8ce0a29
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Also add simpleperf_app_runner in shell utilities.
Bug: 118835348
Test: build and boot.
Test: run simpleperf_app_runner manually.
Change-Id: I538503dabfa8ff192f4b3029206a62613eacdf32
Introduce a new systrace tag, TRACE_TAG_RRO, for use with runtime
resource overlay.
Bug: 119761810
Test: builds
Merged-In: I7b883d107a9ae2b12bbda04b74001a68e2a904aa
Change-Id: I7b883d107a9ae2b12bbda04b74001a68e2a904aa
The header contained inline functions that called unimplemented code on
Windows. Enable building the implementations.
Bug: none
Test: make -j 50 checkbuild
Change-Id: I11b39e6f5c72fc000088182f3631a9f538474c42
In commit f4fc922f0b, we tightened the
permissions on various bin directories. Please see
https://android-review.googlesource.com/c/platform/system/core/+/822955
for details.
This change causes the Chase banking app to crash. This is because
the Chase app is using inotify_add_watch() on the /system/bin directory
and not checking the return value.
The Android Security model guarantees the immutability of files in
/system/bin, so the inotify watch is unnecessary.
Until the Chase app fixes their bug, we need to relax the permissions on
the /system/bin directory. Conceptually, this is a partial revert of
f4fc922f0b.
Bug: 119605322
Test: compiles
Change-Id: Ic72dd24cb27cff677093963bdfd0ae09bf132e08
Increase size of the NETLINK_KOBJECT_UEVENT socket receive buffer to
16M. Also, use SO_RCVBUFFORCE to override any limits set by
/proc/sys/net/core/rmem_max.
We had a couple of instances, where we lost critical uevent messages due
to receive buffer overflows.
Bug: 119933843
Change-Id: I6aab183aa0194e173f9175b47c6beb0835cf6675
Currently, /system/bin, /system/xbin, /product/bin, and /vendor/bin
are 0755, which allows any process to iterate through those
directories and list out the contents. For the vast majority of
processes, this is unnecessary. They only need to know whether a
particular binary exists or doesn't exist, but they don't need to
know the other binaries within those directories.
Allowing this is particularly problematic for SELinux. In particular,
some third party Android applications try to examine every file in
the bin directories, generating SELinux audit noise along the
way. This audit noise makes it harder to see real bugs, and falsely
implies an architectural dependency between the application and random
files in directories like /system/bin.
This change removes the ability to list the contents of the various bin
directories, preventing random probing by such apps. The ability to
execute files, or to probe a specific file by name, remain unchanged.
Addresses SELinux denials similar to the following:
avc: denied { getattr } for comm="Thread-11" path="/system/bin/atrace" dev="dm-0" ino=189 scontext=u:r:untrusted_app_27:s0:c512,c768 tcontext=u:object_r:atrace_exec:s0 tclass=file permissive=0 app=uk.co.santander.santanderUK
avc: denied { getattr } for comm="Binder:26637_2" path="/system/bin/atrace" dev="dm-0" ino=168 scontext=u:r:untrusted_app_25:s0:c512,c768 tcontext=u:object_r:atrace_exec:s0 tclass=file permissive=0 app=com.tencent.mm
avc: denied { getattr } for comm="Thread-12" path="/system/bin/apexd" dev="dm-0" ino=451 scontext=u:r:untrusted_app_27:s0:c512,c768 tcontext=u:object_r:apexd_exec:s0 tclass=file permissive=1 app=com.grppl.android.shell.CMBlloydsTSB73
Shell access to these directories continues to be allowed, to allow for
host-side CTS tests.
Also adjust the indentation of some clang directives, to make the
presubmit hooks happy.
Test: Device boots and no apparent problems.
Change-Id: Ibe75682fac1983d39f3f479a5850ab5a96f6627d
set_sched_policy checks that operations related to the kernel config
CONFIG_CGROUP_SCHEDTUNE are working properly, but this config is not
required so devices without this were failing the test.
This CL splits set_sched_policy into two tests so that the policy and
timerslack tests can be skipped individually when devices don't support
them.
Bug: 113185515, 112550681
Test: libcutils_test{32,64} now pass on aosp_x86_64 emulator
Change-Id: I31638b61e033f0c96b63428a8d27d27dbc36bce3
Attempting to reduce the number of different spellings we have for
"product services" partition in the codebase.
Bug: 112431447
Test: m
Change-Id: I1a87d7e040a8b1f91f973ac7d90d6360b5b54f71
Merged-In: I1a87d7e040a8b1f91f973ac7d90d6360b5b54f71
This CL is largely and adaptation of
Ie996def20e25dc1afe0c74af2096af844934b2dc
Bug: 80741439
Test: Successfully built product-services.img with one module in it, and
flashed on device. Also successfully built image with
/system/product-services and no dedicated /product-services partition.
Change-Id: I1046dfe19bf874da929c9131b76a1f85422fbb80
Callers already verify that they are calling ashmem API on a valid fd by
calling ashmem_valid first. Lets make the fstat syscall only if the
ioctl returns -ENOTTY. This means in the regular case, only 1 syscall is
needed (ioctl) vs the current 2 (fstat+ioctl).
Some data to show improvements in reduction of vfs_getattr calls in the
kernel by 10x when doing a camera.
Test: Boot and camera CTS
Bug: 111418894
Change-Id: I992620bbe44355e54ba19eeac81da586c5e5a6e0
Signed-off-by: Joel Fernandes <joelaf@google.com>
This change removes the CAP_SYSLOG file based capability from bootstat,
since the intention is that it should not be accessing the logs in the
long term. In order to avoid bitrot, the fallback code that depends on
CAP_SYSLOG has also been removed.
Bug: 62845925
Test: system/core/bootstat/boot_reason_test.sh
Change-Id: I899be44ef3ac1c4d81072f801d55c928ae09bb15
This change moves logd's capabilities from being file based to being set
by init through ambient capabilities.
Bug: 62845925
Test: sailfish:/ # grep Cap /proc/`pidof logd`/status
CapInh: 0000000000000000
CapPrm: 0000000440000000
CapEff: 0000000440000000
CapBnd: 0000000440000040
CapAmb: 0000000000000000
$ capsh --decode=0x440000040
0x440000040=cap_setgid,cap_audit_control,cap_syslog
Test: liblog-unit-tests, logd-unit-tests, logcat-unit-tests
Change-Id: I28c7c4ad37ad5eafd399aef78c303ce31298a9ef
Bug: 80422611
Test: m -j succeeded and permissions of files under /product/bin are set
correctly
Change-Id: I83377d809c47c92da6b226d2853ea6a7462fb127
Merged-In: I83377d809c47c92da6b226d2853ea6a7462fb127
(cherry picked from commit 25195daaca)
1. TEMP_FAILURE_RETRY() isn't necessary with getsockname() because
it's a synchronous syscall.
2. There's no need to allocate and free a temporary buffer for the
full pathname of the socket.
Test: Manually, as follows:
- added temporary ALOG output
- flashed and booted a device
- checked expected output from all system daemons
- removed log statements
Change-Id: I4550a2d67fdffe6aff3c1050f8eeeaca0f985fb3
Libraries that are direct or indirect dependencies of modules installed
to recovery partition (e.g. toybox) are marked as recovery_available:
true. This allows a recovery variant of the lib is created when it is
depended by other recovery or recovery_available modules.
Bug: 67916654
Bug: 64960723
Test: m -j
Change-Id: Ie59155c08890e96ce1893fa3687afcf763d7aea3
This commit excludes `qtaguid.cpp` from the VNDK-SP variant of
`libcutils.so` because the interface of `libnetd_client.so` may vary
between AOSP releases.
Besides, these functions don't work in vendor processes either because
VNDK-SP libraries are loaded in an isolated `vndk` linker namespace,
which cannot access `/system/lib[64]/libnetd_client.so` directly. This
change makes it easier to spot the issue at build time and saves several
bytes.
Test: Build aosp_walleye-userdebug and
/system/lib[64]/vndk-sp-$VER/libctuils.so no longer exports qtaguid_*
functions.
Bug: 79329469
Change-Id: Idf6b60f6e58371ea320193641669d1e4412d62b8
Merged-In: Idf6b60f6e58371ea320193641669d1e4412d62b8
(cherry picked from commit 25b742c627)
Normally, the whole configfs is mounted on /config and /config will be
word readable:
sailfish:/ $ ls -ld /config/*
drwxrwx--- 258 system package_info 0 2018-05-08 16:08 /config/sdcardfs
sailfish:/ $ ls -ld /config/
drwxr-xr-x 3 root root 0 1969-12-31 16:00 /config/
On ARC++, we only mount-bind config/sdcardfs, so it is important that
/config is set properly.
It is actually 0500, so system could not see /config/sdcardfs, even if
/config/sdcardfs is set properly:
Although root can, as system uid, we can not reach /config/sdcardfs:
:/ $ ls -ld /config
dr-x------ 3 root root 31 2018-05-02 21:56 /config
:/ $ ls -ld /config/sdcardfs
ls: /config/sdcardfs: Permission denied
With this change, system (and systemservice) is able to reach
/config/sdcardfs:
:/ $ ls -ld /config
dr-xr-xr-x 3 root root 31 2018-05-02 21:56 /config
:/ $ ls -ld /config/sdcardfs
drwxrwx--- 109 system package_info 0 2018-05-08 15:29 /config/sdcardfs
Bug: 63876697
Test: After change, package service is able to create the bindings in
/config/sdcardfs.
Change-Id: I7e9b99d7af2ad001fbb1b95bee35d494e861be78
Signed-off-by: Gwendal Grignou <gwendal@google.com>
This commit excludes `qtaguid.cpp` from the VNDK-SP variant of
`libcutils.so` because the interface of `libnetd_client.so` may vary
between AOSP releases.
Besides, these functions don't work in vendor processes either because
VNDK-SP libraries are loaded in an isolated `vndk` linker namespace,
which cannot access `/system/lib[64]/libnetd_client.so` directly. This
change makes it easier to spot the issue at build time and saves several
bytes.
Test: Build aosp_walleye-userdebug and
/system/lib[64]/vndk-sp-$VER/libctuils.so no longer exports qtaguid_*
functions.
Bug: 79329469
Change-Id: Idf6b60f6e58371ea320193641669d1e4412d62b8
This way you'll get a build time error if you make the usual mistake of
adding to the enum but not adding an entry to the array.
Also improve the unit tests, and fix get_sched_policy_name's incorrect
behavior on invalid inputs.
Bug: N/A
Test: ran tests
Change-Id: Iefcb1ec9ef66267837da7a576c8be3d0cfb16cd0
Introduce a standalone live-lock daemon (llkd), to catch kernel
or native user space deadlocks and take mitigating actions. Will
also configure [khungtaskd] to fortify the actions.
If a thread is in D or Z state with no forward progress for longer
than ro.llk.timeout_ms, or ro.llk.[D|Z].timeout_ms, kill the process
or parent process respectively. If another scan shows the same
process continues to exist, then have a confirmed live-lock condition
and need to panic. Panic the kernel in a manner to provide the
greatest bugreporting details as to the condition. Add a alarm self
watchdog should llkd ever get locked up that is double the expected
time to flow through the mainloop. Sampling is every
ro.llk_sample_ms.
Default will not monitor init, or [kthreadd] and all that [kthreadd]
spawns. This reduces the effectiveness of llkd by limiting its
coverage. If in the future, if value in covering kthreadd spawned
threads, the requirement will be to code drivers so that they do not
remain in a persistent 'D' state, or that they have mechanisms to
recover the thread should it be killed externally. Then the
blacklists can be adjusted accordingly if these conditions are met.
An accompanying gTest set have been added, and will setup a persistent
D or Z process, with and without forward progress, but not in a
live-lock state because that would require a buggy kernel, or a module
or kernel modification to stimulate.
Android Properties llkd respond to (*_ms parms are in milliseconds):
- ro.config.low_ram default false, if true do not sysrq t (dump
all threads).
- ro.llk.enable default false, allow live-lock daemon to be enabled.
- ro.khungtask.enable default false, allow [khungtaskd] to be enabled.
- ro.llk.mlockall default true, allow mlock'd live-lock daemon.
- ro.khungtask.timeout default 12 minutes.
- ro.llk.timeout_ms default 10 minutes, D or Z maximum timelimit,
double this value and it sets the alarm watchdog for llkd.
- ro.llk.D.timeout_ms default ro.llk.timeout_ms, D maximum timelimit.
- ro.llk.Z.timeout_ms default ro.llk.timeout_ms, Z maximum timelimit.
- ro.llk.check_ms default 2 minutes sampling interval
(ro.llk.timeout_ms / 5) for threads in D or Z state.
- ro.llk.blacklist.process default 0,1,2 (kernel, init and
[kthreadd]), and process names (/comm or /cmdline) init,[kthreadd],
lmkd,lmkd.llkd,llkd,[khungtaskd],watchdogd,[watchdogd],
[watchdogd/0] ...
- ro.llk.blacklist.parent default 0,2 (kernel and [kthreadd]) and
"[kthreadd]". A comma separated lists of process ids, /comm names
or /cmdline names.
- ro.llk.blacklist.uid default <empty>, comma separated list of
uid numbers or names from getpwuid/getpwnam.
Test: llkd_unit_test
Bug: 33808187
Bug: 72838192
Change-Id: I32e8aa78aef10834e093265d0f3ed5b4199807c6
Set F() capability set and 'drop' lmkd from AID_ROOT to AID_LMKD uid
and from AID_ROOT to AID_LMKD and AID_SYSTEM gid.
/dev/memcg/memory.pressure defaults to root.root mode 0000, set it up
as root.system mode 0040 to allow lmkd read access.
Instrument failure to set SCHED_FIFO.
Annotate access points that require elevated capabilities.
Test: check /proc/`pidof lmkd`/status for capability set
Test: lmkd_unit_test
Bug: 77650566
Change-Id: I986081a0434cf6e842b63a55726380205b30a3ea
Their capability bits are now specified in their associated init .rc
file, which is the proper place for this to be done.
A notice is added to guide developers away from using android_files to
give services Linux capabilities and to guide them away from adding
vendor/ entries.
Bug: 74554159
Test: BT, Wifi, Tethering work on walleye
Merged-In: I13c425d022b4f5c217587cdf601884ef44650ac7
Change-Id: I13c425d022b4f5c217587cdf601884ef44650ac7
(cherry picked from commit b5e5c56401)
Their capability bits are now specified in their associated init .rc
file, which is the proper place for this to be done.
A notice is added to guide developers away from using android_files to
give services Linux capabilities and to guide them away from adding
vendor/ entries.
Bug: 74554159
Test: BT, Wifi, Tethering work on walleye
Change-Id: I13c425d022b4f5c217587cdf601884ef44650ac7
This reverts commit 656b75c77c.
Capability bits are moving from fs_config.cpp to the associated init
scripts for daemons on /vendor.
Bug: 74554159
Test: wifi tethering works on walleye
So we can auto-generate tracing code for AIDL interfaces.
Bug: 74416314
Test: inspect atrace output
Change-Id: I91b14b3b16d8d7a29f531101b14ddf10dbc61a5a
Merged-In: I91b14b3b16d8d7a29f531101b14ddf10dbc61a5a
So we can auto-generate tracing code for AIDL interfaces.
Bug: 74416314
Test: inspect atrace output
Change-Id: I91b14b3b16d8d7a29f531101b14ddf10dbc61a5a
This process is now spawned from the main app_process zygote, rather
than being its own binary launched by init.
Bug: 63749735
Test: m
Change-Id: I87e00197e1ce64d77b4c306fcd702c6ad778b236
Now all somewhat time-consuming methods of the VibratorService
are surrounded by traceBegin/traceEnd blocks.
The vibration itself is surrounded with asyncTrace block.
Test: Run "systrace vibrator" and see the time consumption report.
Bug: 73000045
Merged-In: I94172e379354ec3418321b8151e6182cec2e886c
Change-Id: I94172e379354ec3418321b8151e6182cec2e886c
Multiple LTP tests require a "daemon" or "bin" user. These user ids
have been defined since UNIX incept, and even up to the '80s remained
in many of the tools as hard coded values. Add these two ids with
a cautionary note.
Test: compile
Bug: 31152327
Bug: 31226046
Bug: 32385889
Change-Id: Ida2fb6d817b8ada0624870439fcf848667b31fb3
For processes that start very early, atrace initialization can cause
an selinux denial, so make sure it's possible to disable it and avoid
the call to open "trace_marker".
Bug: 63927601
Test: disable atrace early in vold, ensure that selinux denial is
avoided.
Change-Id: I2422e6d0db323bc13c6d6ed1896435151fca21f7
There may be evidence of ashmem_valid(fd) reporting that the file
descriptor is an ashmem node. Increase testing of ashmem_valid(fd),
reporting that the node _is_ ashmem, to inspire confidence in the
positive result. Scan all file descriptors in the system, and for
those that pass ashmem_valid, get a non-zero size reference back.
Some clang-format-isms applied.
Test: libcutils-test --gtest_filter=AshmemTest.*
Bug: 72021458
Change-Id: I77d746b57a89a6afa1b829dddfdc4dd319f6b684
This CL will enable reading /product/build.prop and add product paths
into ld.config.txt.in.
Bug: 64195575
Test: tested with 'PRODUCT_PRODUCT_PROPERTIES := ro.product.abc=abc' on
sailfish
Change-Id: Ie996def20e25dc1afe0c74af2096af844934b2dc
Filesystems allow the setting of the "resgid" parameter to designate
a GID that is allowed to use the "reserved" disk space (in addition
to UID 0). We'll be granting this GID to critical system processes,
so that the system is usable enough for the user to free up disk
space used by abusive apps.
Test: builds, boots
Bug: 62024591
Change-Id: I2d166f3b730f0a3e7279fb40f12db7413c1dadad
We should have done this from the beginning. Thanks to Windows, we're not
going to be able to switch libbase over to std::string_view any time soon.
Bug: N/A
Test: ran tests
Change-Id: Iff2f56986e39de53f3ac484415378af17dacf26b
