Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a8baab0c authored by Jason Macnak's avatar Jason Macnak
Browse files

Update checking debug.vulkan.layer.* system props 

... to scan a fixed range of priorities followed by
consecutive priorities instead of scanning all system
props (property_list()) which causes sepolicy audits
when Vulkan is loaded in a process with a restrictive
sepolicy.

This avoids sepolicy audits in system_server for example
when running on Cuttlefish with SwANGLE (ANGLE GL on top
of SwiftShader Vulkan).

Bug: b/179967574
Test: boot Cuttlefish with SwANGLE and inspect audit logs
Change-Id: I63b3f45113fbdd3ab62c22f062150e25b99d7352
parent 82a8c40f

vulkan/libvulkan/api.cpp

+32 −22
Original line number Diff line number Diff line
@@ -33,6 +33,7 @@ 
#include <unordered_set>

#include <utility>



#include <android-base/properties.h>

#include <android-base/strings.h>

#include <cutils/properties.h>

#include <log/log.h>
@@ -134,7 +135,7 @@ class OverrideLayerNames { 
        // If no layers specified via Settings, check legacy properties

        if (implicit_layers_.count <= 0) {

            ParseDebugVulkanLayers();

            property_list(ParseDebugVulkanLayer, this);

            ParseDebugVulkanLayer();



            // sort by priorities

            auto& arr = implicit_layers_;
@@ -181,30 +182,39 @@ class OverrideLayerNames { 
            AddImplicitLayer(prio, p, strlen(p));

    }



    static void ParseDebugVulkanLayer(const char* key,

                                      const char* val,

                                      void* user_data) {

    void ParseDebugVulkanLayer() {

        // Checks for consecutive debug.vulkan.layer.<priority> system

        // properties after always checking an initial fixed range.

        static const char prefix[] = "debug.vulkan.layer.";

        const size_t prefix_len = sizeof(prefix) - 1;



        if (strncmp(key, prefix, prefix_len) || val[0] == '\0')

            return;

        key += prefix_len;



        // debug.vulkan.layer.<priority>

        int priority = -1;

        if (key[0] >= '0' && key[0] <= '9')

            priority = atoi(key);



        if (priority < 0) {

            ALOGW("Ignored implicit layer %s with invalid priority %s", val,

                  key);

        static constexpr int kFixedRangeBeginInclusive = 0;

        static constexpr int kFixedRangeEndInclusive = 9;



        bool logged = false;



        int priority = kFixedRangeBeginInclusive;

        while (true) {

            const std::string prop_key =

                std::string(prefix) + std::to_string(priority);

            const std::string prop_val =

                android::base::GetProperty(prop_key, "");



            if (!prop_val.empty()) {

                if (!logged) {

                    ALOGI(

                        "Detected Vulkan layers configured with "

                        "debug.vulkan.layer.<priority>. Checking for "

                        "debug.vulkan.layer.<priority> in the range [%d, %d] "

                        "followed by a consecutive scan.",

                        kFixedRangeBeginInclusive, kFixedRangeEndInclusive);

                    logged = true;

                }

                AddImplicitLayer(priority, prop_val.c_str(), prop_val.length());

            } else if (priority >= kFixedRangeEndInclusive) {

                return;

            }



        OverrideLayerNames& override_layers =

            *reinterpret_cast<OverrideLayerNames*>(user_data);

        override_layers.AddImplicitLayer(priority, val, strlen(val));

            ++priority;

        }

    }



    void AddImplicitLayer(int priority, const char* name, size_t len) {