Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 551e5af0 authored by Victor Hsieh's avatar Victor Hsieh
Browse files

Revert "Move zygote's seccomp setup to post-fork" 

This reverts commit a188dbc0.

Reason for revert: selinux denials, see b/71768585

Change-Id: Ic1b81e146b52b68445ba634de39657f199107da3
parent a188dbc0

core/java/android/os/Seccomp.java

+1 −2
Original line number Diff line number Diff line
@@ -20,6 +20,5 @@ package android.os; 
 * @hide

 */

public final class Seccomp {

    public static native void setSystemServerPolicy();

    public static native void setAppPolicy();

    public static final native void setPolicy();

}

core/java/com/android/internal/os/Zygote.java

+0 −4
Original line number Diff line number Diff line
@@ -17,7 +17,6 @@ 
package com.android.internal.os;



import android.os.IVold;

import android.os.Seccomp;

import android.os.Trace;

import android.system.ErrnoException;

import android.system.Os;
@@ -154,9 +153,6 @@ public final class Zygote { 
     */

    public static int forkSystemServer(int uid, int gid, int[] gids, int runtimeFlags,

            int[][] rlimits, long permittedCapabilities, long effectiveCapabilities) {

        // Set system server specific seccomp policy.

        Seccomp.setSystemServerPolicy();



        VM_HOOKS.preFork();

        // Resets nice priority for zygote process.

        resetNicePriority();

core/java/com/android/internal/os/ZygoteConnection.java

+0 −4
Original line number Diff line number Diff line
@@ -30,7 +30,6 @@ import android.net.Credentials; 
import android.net.LocalSocket;

import android.os.FactoryTest;

import android.os.Process;

import android.os.Seccomp;

import android.os.SystemProperties;

import android.os.Trace;

import android.system.ErrnoException;
@@ -768,9 +767,6 @@ class ZygoteConnection { 
            Process.setArgV0(parsedArgs.niceName);

        }



        // Set app specific seccomp policy.

        Seccomp.setAppPolicy();



        // End of the postFork event.

        Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);

        if (parsedArgs.invokeWith != null) {

core/java/com/android/internal/os/ZygoteInit.java

+3 −0
Original line number Diff line number Diff line
@@ -782,6 +782,9 @@ public class ZygoteInit { 
            // Zygote process unmounts root storage spaces.

            Zygote.nativeUnmountStorageOnInit();



            // Set seccomp policy

            Seccomp.setPolicy();



            ZygoteHooks.stopZygoteNoThreadCreation();



            if (startSystemServer) {

core/jni/android_os_seccomp.cpp

+3 −16
Original line number Diff line number Diff line
@@ -21,33 +21,20 @@ 


#include "seccomp_policy.h"



static void Seccomp_setSystemServerPolicy(JNIEnv* /*env*/) {

static void Seccomp_setPolicy(JNIEnv* /*env*/) {

    if (security_getenforce() == 0) {

        ALOGI("seccomp disabled by setenforce 0");

        return;

    }



    if (!set_system_seccomp_filter()) {

        ALOGE("Failed to set seccomp policy - killing");

        exit(1);

    }

}



static void Seccomp_setAppPolicy(JNIEnv* /*env*/) {

    if (security_getenforce() == 0) {

        ALOGI("seccomp disabled by setenforce 0");

        return;

    }



    if (!set_app_seccomp_filter()) {

    if (!set_seccomp_filter()) {

        ALOGE("Failed to set seccomp policy - killing");

        exit(1);

    }

}



static const JNINativeMethod method_table[] = {

    NATIVE_METHOD(Seccomp, setSystemServerPolicy, "()V"),

    NATIVE_METHOD(Seccomp, setAppPolicy, "()V"),

    NATIVE_METHOD(Seccomp, setPolicy, "()V"),

};



namespace android {