c39ba5ae32
Add the following mount options to the /proc filesystem: hidepid=2,gid=3009 This change blocks /proc access unless you're in group 3009 (aka AID_READPROC). Please see https://github.com/torvalds/linux/blob/master/Documentation/filesystems/proc.txt for documentation on the hidepid option. hidepid=2 is preferred over hidepid=1 since it leaks less information and doesn't generate SELinux ptrace denials when trying to access /proc without being in the proper group. Add AID_READPROC to processes which need to access /proc entries for other UIDs. Bug: 23310674 Change-Id: I22bb55ff7b80ff722945e224845215196f09dafa
12 lines
364 B
Text
12 lines
364 B
Text
service logd /system/bin/logd
|
|
class core
|
|
socket logd stream 0666 logd logd
|
|
socket logdr seqpacket 0666 logd logd
|
|
socket logdw dgram 0222 logd logd
|
|
group root system readproc
|
|
writepid /dev/cpuset/system-background/tasks
|
|
|
|
service logd-reinit /system/bin/logd --reinit
|
|
oneshot
|
|
disabled
|
|
writepid /dev/cpuset/system-background/tasks
|