0b2a011cc4
On Android, unlike POSIX, groups and capabilities are able to be set
per thread. This is useless however, since threads are not a security
boundary. This change drops the logic to set groups and capabilities
per thread and instead leaves all threads running with the initial
user and groups.
This does still drop some capabilities if they're unneeded due to
features being disabled.
This also moves the setpriority() call from code into the init script.
Test: logd runs with the expected user/groups and with the expected
capabilities and priority without any errors
Change-Id: Ibb0e529ea1574a2b8ec391a2678504ca9fbe19be
35 lines
888 B
Text
35 lines
888 B
Text
service logd /system/bin/logd
|
|
socket logd stream 0666 logd logd
|
|
socket logdr seqpacket 0666 logd logd
|
|
socket logdw dgram+passcred 0222 logd logd
|
|
file /proc/kmsg r
|
|
file /dev/kmsg w
|
|
user logd
|
|
group logd system package_info readproc
|
|
capabilities SYSLOG AUDIT_CONTROL
|
|
priority 10
|
|
writepid /dev/cpuset/system-background/tasks
|
|
|
|
service logd-reinit /system/bin/logd --reinit
|
|
oneshot
|
|
disabled
|
|
user logd
|
|
group logd
|
|
writepid /dev/cpuset/system-background/tasks
|
|
|
|
# Limit SELinux denial generation to 5/second
|
|
service logd-auditctl /system/bin/auditctl -r 5
|
|
oneshot
|
|
disabled
|
|
user logd
|
|
group logd
|
|
capabilities AUDIT_CONTROL
|
|
|
|
on fs
|
|
write /dev/event-log-tags "# content owned by logd
|
|
"
|
|
chown logd logd /dev/event-log-tags
|
|
chmod 0644 /dev/event-log-tags
|
|
|
|
on property:sys.boot_completed=1
|
|
start logd-auditctl
|