Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f49b8a3b authored by Treehugger Robot's avatar Treehugger Robot Committed by Automerger Merge Worker
Browse files

Merge "Avoid hardcoded paths to specific APEX jars in the fd allow list." am: 3e2cfa7b 

Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1489718

Change-Id: If1ffdc9f1dcfa534647ef81f28cfc59adc125c21
parents 15753f03 3e2cfa7b

core/jni/fd_utils.cpp

+6 −15
Original line number Diff line number Diff line
@@ -33,16 +33,6 @@ 


// Static whitelist of open paths that the zygote is allowed to keep open.

static const char* kPathWhitelist[] = {

        "/apex/com.android.conscrypt/javalib/conscrypt.jar",

        "/apex/com.android.ipsec/javalib/ike.jar",

        "/apex/com.android.i18n/javalib/core-icu4j.jar",

        "/apex/com.android.media/javalib/updatable-media.jar",

        "/apex/com.android.mediaprovider/javalib/framework-mediaprovider.jar",

        "/apex/com.android.os.statsd/javalib/framework-statsd.jar",

        "/apex/com.android.permission/javalib/framework-permission.jar",

        "/apex/com.android.sdkext/javalib/framework-sdkextensions.jar",

        "/apex/com.android.wifi/javalib/framework-wifi.jar",

        "/apex/com.android.tethering/javalib/framework-tethering.jar",

        "/dev/null",

        "/dev/socket/zygote",

        "/dev/socket/zygote_secondary",
@@ -100,10 +90,11 @@ bool FileDescriptorWhitelist::IsAllowed(const std::string& path) const { 
    }

  }



  // Jars from the ART APEX are allowed.

  static const char* kArtApexPrefix = "/apex/com.android.art/javalib/";

  if (android::base::StartsWith(path, kArtApexPrefix)

      && android::base::EndsWith(path, kJarSuffix)) {

  // Jars from APEXes are allowed. This matches /apex/**/javalib/*.jar.

  static const char* kApexPrefix = "/apex/";

  static const char* kApexJavalibPathSuffix = "/javalib";

  if (android::base::StartsWith(path, kApexPrefix) && android::base::EndsWith(path, kJarSuffix) &&

      android::base::EndsWith(android::base::Dirname(path), kApexJavalibPathSuffix)) {

      return true;

  }