Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bb8b4814 authored by Nick Kralevich's avatar Nick Kralevich
Browse files

Am.java: Use write-only file descriptors 

Use write only file descriptors for am commands. Having read-write
file descriptors isn't needed, and not all SELinux app domains have
read access to /data/local/tmp file descriptors.

Addresses the following denial:

  avc: denied { read } for path="/data/local/tmp/foo" dev="dm-2"
  ino=654084 scontext=u:r:system_app:s0
  tcontext=u:object_r:shell_data_file:s0 tclass=file permissive=0

Steps to reproduce:

  adb shell ps | grep settings
  adb shell am dumpheap PID_FROM_ABOVE /data/local/tmp/settings.hat

Expected:
1) command works

Actual:
1) SELinux denial and no settings.hat output.

Bug: 27472701
Change-Id: Id8df0c5a41046b405444e14c70075c986d9936c3
parent 2e54da0d

cmds/am/src/com/android/commands/am/Am.java

+4 −4
Original line number Diff line number Diff line
@@ -606,7 +606,7 @@ public class Am extends BaseCommand { 
                            new File(mProfileFile),

                            ParcelFileDescriptor.MODE_CREATE |

                            ParcelFileDescriptor.MODE_TRUNCATE |

                            ParcelFileDescriptor.MODE_READ_WRITE);

                            ParcelFileDescriptor.MODE_WRITE_ONLY);

                } catch (FileNotFoundException e) {

                    System.err.println("Error: Unable to open file: " + mProfileFile);

                    System.err.println("Consider using a file under /data/local/tmp/");
@@ -903,7 +903,7 @@ public class Am extends BaseCommand { 
            fd = openForSystemServer(file,

                    ParcelFileDescriptor.MODE_CREATE |

                            ParcelFileDescriptor.MODE_TRUNCATE |

                            ParcelFileDescriptor.MODE_READ_WRITE);

                            ParcelFileDescriptor.MODE_WRITE_ONLY);

        } catch (FileNotFoundException e) {

            System.err.println("Error: Unable to open file: " + filename);

            System.err.println("Consider using a file under /data/local/tmp/");
@@ -992,7 +992,7 @@ public class Am extends BaseCommand { 
                        new File(profileFile),

                        ParcelFileDescriptor.MODE_CREATE |

                        ParcelFileDescriptor.MODE_TRUNCATE |

                        ParcelFileDescriptor.MODE_READ_WRITE);

                        ParcelFileDescriptor.MODE_WRITE_ONLY);

            } catch (FileNotFoundException e) {

                System.err.println("Error: Unable to open file: " + profileFile);

                System.err.println("Consider using a file under /data/local/tmp/");
@@ -1052,7 +1052,7 @@ public class Am extends BaseCommand { 
            fd = openForSystemServer(file,

                    ParcelFileDescriptor.MODE_CREATE |

                    ParcelFileDescriptor.MODE_TRUNCATE |

                    ParcelFileDescriptor.MODE_READ_WRITE);

                    ParcelFileDescriptor.MODE_WRITE_ONLY);

        } catch (FileNotFoundException e) {

            System.err.println("Error: Unable to open file: " + heapFile);

            System.err.println("Consider using a file under /data/local/tmp/");