Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f39f6a47 authored by Treehugger Robot's avatar Treehugger Robot Committed by Gerrit Code Review
Browse files

Merge changes I2e370952,I811cc8e1 

* changes:
  Remove TEMPORARY_DISABLE_PATH_RESTRICTIONS
  nsjail: Always remount /tmp before src/out/dist
parents ede50781 347ba756

cmd/path_interposer/main.go

+1 −10
Original line number Diff line number Diff line
@@ -53,14 +53,7 @@ func main() { 
		os.Exit(1)

	}



	disableError := false

	if e, ok := os.LookupEnv("TEMPORARY_DISABLE_PATH_RESTRICTIONS"); ok {

		disableError = e == "1" || e == "y" || e == "yes" || e == "on" || e == "true"

	}



	exitCode, err := Main(os.Stdout, os.Stderr, interposer, os.Args, mainOpts{

		disableError: disableError,



		sendLog:       paths.SendLog,

		config:        paths.GetConfig,

		lookupParents: lookupParents,
@@ -79,8 +72,6 @@ If a tool isn't in the allowed list, a log will be posted to the unix domain 
socket at <interposer>_log.`)



type mainOpts struct {

	disableError bool



	sendLog       func(logSocket string, entry *paths.LogEntry, done chan interface{})

	config        func(name string) paths.PathConfig

	lookupParents func() []paths.LogProcess
@@ -131,7 +122,7 @@ func Main(stdout, stderr io.Writer, interposer string, args []string, opts mainO 
			}, waitForLog)

			defer func() { <-waitForLog }()

		}

		if config.Error && !opts.disableError {

		if config.Error {

			return 1, fmt.Errorf("%q is not allowed to be used. See https://android.googlesource.com/platform/build/+/master/Changes.md#PATH_Tools for more information.", base)

		}

	}

ui/build/path.go

+5 −2
Original line number Diff line number Diff line
@@ -177,9 +177,12 @@ func SetupPath(ctx Context, config Config) { 
		execs = append(execs, parsePathDir(pathEntry)...)

	}



	allowAllSymlinks := config.Environment().IsEnvTrue("TEMPORARY_DISABLE_PATH_RESTRICTIONS")

	if config.Environment().IsEnvTrue("TEMPORARY_DISABLE_PATH_RESTRICTIONS") {

		ctx.Fatalln("TEMPORARY_DISABLE_PATH_RESTRICTIONS was a temporary migration method, and is now obsolete.")

	}



	for _, name := range execs {

		if !paths.GetConfig(name).Symlink && !allowAllSymlinks {

		if !paths.GetConfig(name).Symlink {

			continue

		}

ui/build/sandbox_linux.go

+3 −3
Original line number Diff line number Diff line
@@ -181,15 +181,15 @@ func (c *Cmd) wrapSandbox() { 
		// For now, just map everything. Make most things readonly.

		"-R", "/",



		// Mount a writable tmp dir

		"-B", "/tmp",



		// Mount source are read-write

		"-B", sandboxConfig.srcDir,



		//Mount out dir as read-write

		"-B", sandboxConfig.outDir,



		// Mount a writable tmp dir

		"-B", "/tmp",



		// Disable newcgroup for now, since it may require newer kernels

		// TODO: try out cgroups

		"--disable_clone_newcgroup",