Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 11c1a687 authored by Ray Essick's avatar Ray Essick
Browse files

flexibility for having extra policy files 

add an interface to accept a list of additional policy files, instead of just a single file.
Also add TEST_MAPPING for presubmit.

Bug: 147914640
Test: boot with empty, 1, and 2 element lists, atest
Change-Id: I97e8e0ec7b68699838595c09a4a8e7c7eef657c3
parent 7e101988

services/minijail/Android.bp

+1 −0
Original line number Diff line number Diff line
@@ -39,4 +39,5 @@ cc_test { 
    srcs: [

        "av_services_minijail_unittest.cpp",

    ],

    test_suites: ["device-tests"],

}

services/minijail/TEST_MAPPING

0 → 100644
+5 −0
Original line number Diff line number Diff line 
{

  "presubmit": [

    { "name": "libavservices_minijail_unittest" }

  ]

}

services/minijail/av_services_minijail_unittest.cpp

+31 −2
Original line number Diff line number Diff line
@@ -34,13 +34,32 @@ class WritePolicyTest : public ::testing::Test 
        "mmap: 1\n"

        "munmap: 1\n";



    const std::string third_policy_ =

        "open: 1\n"

        "close: 1\n";



    const std::string full_policy_ = base_policy_ + std::string("\n") + additional_policy_;

    const std::string triple_policy_ = base_policy_ +

                                       std::string("\n") + additional_policy_ +

                                       std::string("\n") + third_policy_;

};



TEST_F(WritePolicyTest, OneFile)

{

    std::string final_string;

    android::base::unique_fd fd(android::WritePolicyToPipe(base_policy_, std::string()));

    // vector with an empty pathname

    android::base::unique_fd fd(android::WritePolicyToPipe(base_policy_, {std::string()}));

    EXPECT_LE(0, fd.get());

    bool success = android::base::ReadFdToString(fd.get(), &final_string);

    EXPECT_TRUE(success);

    EXPECT_EQ(final_string, base_policy_);

}



TEST_F(WritePolicyTest, OneFileAlternate)

{

    std::string final_string;

    // empty vector

    android::base::unique_fd fd(android::WritePolicyToPipe(base_policy_, {}));

    EXPECT_LE(0, fd.get());

    bool success = android::base::ReadFdToString(fd.get(), &final_string);

    EXPECT_TRUE(success);
@@ -50,9 +69,19 @@ TEST_F(WritePolicyTest, OneFile) 
TEST_F(WritePolicyTest, TwoFiles)

{

    std::string final_string;

    android::base::unique_fd fd(android::WritePolicyToPipe(base_policy_, additional_policy_));

    android::base::unique_fd fd(android::WritePolicyToPipe(base_policy_, {additional_policy_}));

    EXPECT_LE(0, fd.get());

    bool success = android::base::ReadFdToString(fd.get(), &final_string);

    EXPECT_TRUE(success);

    EXPECT_EQ(final_string, full_policy_);

}



TEST_F(WritePolicyTest, ThreeFiles)

{

    std::string final_string;

    android::base::unique_fd fd(android::WritePolicyToPipe(base_policy_, {additional_policy_, third_policy_}));

    EXPECT_LE(0, fd.get());

    bool success = android::base::ReadFdToString(fd.get(), &final_string);

    EXPECT_TRUE(success);

    EXPECT_EQ(final_string, triple_policy_);

}

services/minijail/minijail.cpp

+26 −13
Original line number Diff line number Diff line
@@ -29,7 +29,7 @@ 
namespace android {



int WritePolicyToPipe(const std::string& base_policy_content,

                      const std::string& additional_policy_content)

                      const std::vector<std::string>& additional_policy_contents)

{

    int pipefd[2];

    if (pipe(pipefd) == -1) {
@@ -40,9 +40,11 @@ int WritePolicyToPipe(const std::string& base_policy_content, 
    base::unique_fd write_end(pipefd[1]);

    std::string content = base_policy_content;



    if (additional_policy_content.length() > 0) {

    for (auto one_content : additional_policy_contents) {

        if (one_content.length() > 0) {

            content += "\n";

        content += additional_policy_content;

            content += one_content;

        }

    }



    if (!base::WriteStringToFd(content, write_end.get())) {
@@ -53,29 +55,40 @@ int WritePolicyToPipe(const std::string& base_policy_content, 
    return pipefd[0];

}



void SetUpMinijail(const std::string& base_policy_path, const std::string& additional_policy_path)

void SetUpMinijail(const std::string& base_policy_path,

                   const std::string& additional_policy_path)

{

    SetUpMinijailList(base_policy_path, {additional_policy_path});

}



void SetUpMinijailList(const std::string& base_policy_path,

                   const std::vector<std::string>& additional_policy_paths)

{

    // No seccomp policy defined for this architecture.

    if (access(base_policy_path.c_str(), R_OK) == -1) {

        LOG(WARNING) << "No seccomp policy defined for this architecture.";

        // LOG(WARNING) << "No seccomp policy defined for this architecture.";

        LOG(WARNING) << "missing base seccomp_policy file '" << base_policy_path << "'";

        return;

    }



    std::string base_policy_content;

    std::string additional_policy_content;

    std::vector<std::string> additional_policy_contents;

    if (!base::ReadFileToString(base_policy_path, &base_policy_content,

                                false /* follow_symlinks */)) {

        LOG(FATAL) << "Could not read base policy file '" << base_policy_path << "'";

    }



    if (additional_policy_path.length() > 0 &&

        !base::ReadFileToString(additional_policy_path, &additional_policy_content,

    for (auto one_policy_path : additional_policy_paths) {

        std::string one_policy_content;

        if (one_policy_path.length() > 0 &&

                !base::ReadFileToString(one_policy_path, &one_policy_content,

                    false /* follow_symlinks */)) {

        LOG(WARNING) << "Could not read additional policy file '" << additional_policy_path << "'";

        additional_policy_content = std::string();

            LOG(WARNING) << "Could not read additional policy file '" << one_policy_path << "'";

        }

        additional_policy_contents.push_back(one_policy_content);

    }



    base::unique_fd policy_fd(WritePolicyToPipe(base_policy_content, additional_policy_content));

    base::unique_fd policy_fd(WritePolicyToPipe(base_policy_content, additional_policy_contents));

    if (policy_fd.get() == -1) {

        LOG(FATAL) << "Could not write seccomp policy to fd";

    }

services/minijail/minijail.h

+6 −2
Original line number Diff line number Diff line
@@ -16,11 +16,15 @@ 
#define AV_SERVICES_MINIJAIL_MINIJAIL



#include <string>

#include <vector>



namespace android {

int WritePolicyToPipe(const std::string& base_policy_content,

                      const std::string& additional_policy_content);

void SetUpMinijail(const std::string& base_policy_path, const std::string& additional_policy_path);

                      const std::vector<std::string>& additional_policy_contents);

void SetUpMinijail(const std::string& base_policy_path,

                   const std::string& additional_policy_path);

void SetUpMinijailList(const std::string& base_policy_path,

                       const std::vector<std::string>& additional_policy_paths);

}



#endif  // AV_SERVICES_MINIJAIL_MINIJAIL