Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b2d305c5 authored by Martin Stjernholm's avatar Martin Stjernholm
Browse files

Avoid hardcoded paths to specific APEX jars in the fd allow list. 

Test: build & boot
Bug: 148517954
Change-Id: I2cbe75381c3032e56dd0cd2934bda3f027cb65bf
Merged-In: I2cbe75381c3032e56dd0cd2934bda3f027cb65bf
parent abf29724

core/jni/fd_utils.cpp

+6 −16
Original line number Diff line number Diff line
@@ -33,17 +33,6 @@ 


// Static whitelist of open paths that the zygote is allowed to keep open.

static const char* kPathWhitelist[] = {

        "/apex/com.android.appsearch/javalib/framework-appsearch.jar",

        "/apex/com.android.conscrypt/javalib/conscrypt.jar",

        "/apex/com.android.ipsec/javalib/ike.jar",

        "/apex/com.android.i18n/javalib/core-icu4j.jar",

        "/apex/com.android.media/javalib/updatable-media.jar",

        "/apex/com.android.mediaprovider/javalib/framework-mediaprovider.jar",

        "/apex/com.android.os.statsd/javalib/framework-statsd.jar",

        "/apex/com.android.permission/javalib/framework-permission.jar",

        "/apex/com.android.sdkext/javalib/framework-sdkextensions.jar",

        "/apex/com.android.wifi/javalib/framework-wifi.jar",

        "/apex/com.android.tethering/javalib/framework-tethering.jar",

        "/dev/null",

        "/dev/socket/zygote",

        "/dev/socket/zygote_secondary",
@@ -103,10 +92,11 @@ bool FileDescriptorWhitelist::IsAllowed(const std::string& path) const { 
    }

  }



  // Jars from the ART APEX are allowed.

  static const char* kArtApexPrefix = "/apex/com.android.art/javalib/";

  if (android::base::StartsWith(path, kArtApexPrefix)

      && android::base::EndsWith(path, kJarSuffix)) {

  // Jars from APEXes are allowed. This matches /apex/**/javalib/*.jar.

  static const char* kApexPrefix = "/apex/";

  static const char* kApexJavalibPathSuffix = "/javalib";

  if (android::base::StartsWith(path, kApexPrefix) && android::base::EndsWith(path, kJarSuffix) &&

      android::base::EndsWith(android::base::Dirname(path), kApexJavalibPathSuffix)) {

      return true;

  }