Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2bbdbe85 authored by Jorge Lucangeli Obes's avatar Jorge Lucangeli Obes
Browse files

logd: Use Minijail for privilege dropping. 

Makes code smaller, removes duplication. Using Minijail also allows
adding further sandboxing down the road.

Bug: 30156807
Change-Id: I8fa242fba545049ee82f6655fe6ecc14c53fcab7
parent ddbcecec

logd/Android.mk

+2 −1
Original line number Diff line number Diff line
@@ -28,7 +28,8 @@ LOCAL_SHARED_LIBRARIES := \ 
    liblog \

    libcutils \

    libbase \

    libpackagelistparser

    libpackagelistparser \

    libminijail



# This is what we want to do:

#  event_logtags = $(shell \

logd/main.cpp

+11 −38
Original line number Diff line number Diff line
@@ -36,12 +36,15 @@ 
#include <cstdbool>

#include <memory>



#include <android-base/macros.h>

#include <cutils/properties.h>

#include <cutils/sched_policy.h>

#include <cutils/sockets.h>

#include <libminijail.h>

#include <log/event_tag_map.h>

#include <packagelistparser/packagelistparser.h>

#include <private/android_filesystem_config.h>

#include <scoped_minijail.h>

#include <utils/threads.h>



#include "CommandListener.h"
@@ -65,7 +68,7 @@ 
//     EACCESS if started without precautions (below)

//

// Here is a cookbook procedure for starting up logd manually assuming

// init is out of the way, pedantically all permissions and selinux

// init is out of the way, pedantically all permissions and SELinux

// security is put back in place:

//

//    setenforce 0
@@ -102,43 +105,13 @@ static int drop_privs() { 
        return -1;

    }



    if (prctl(PR_SET_KEEPCAPS, 1) < 0) {

        return -1;

    }



    gid_t groups[] = { AID_READPROC };



    if (setgroups(sizeof(groups) / sizeof(groups[0]), groups) == -1) {

        return -1;

    }



    if (setgid(AID_LOGD) != 0) {

        return -1;

    }



    if (setuid(AID_LOGD) != 0) {

        return -1;

    }



    struct __user_cap_header_struct capheader;

    struct __user_cap_data_struct capdata[2];

    memset(&capheader, 0, sizeof(capheader));

    memset(&capdata, 0, sizeof(capdata));

    capheader.version = _LINUX_CAPABILITY_VERSION_3;

    capheader.pid = 0;



    capdata[CAP_TO_INDEX(CAP_SYSLOG)].permitted = CAP_TO_MASK(CAP_SYSLOG);

    capdata[CAP_TO_INDEX(CAP_AUDIT_CONTROL)].permitted |= CAP_TO_MASK(CAP_AUDIT_CONTROL);



    capdata[0].effective = capdata[0].permitted;

    capdata[1].effective = capdata[1].permitted;

    capdata[0].inheritable = 0;

    capdata[1].inheritable = 0;



    if (capset(&capheader, &capdata[0]) < 0) {

        return -1;

    }



    ScopedMinijail j(minijail_new());

    minijail_set_supplementary_gids(j.get(), arraysize(groups), groups);

    minijail_change_uid(j.get(), AID_LOGD);

    minijail_change_gid(j.get(), AID_LOGD);

    minijail_use_caps(j.get(), CAP_TO_MASK(CAP_SYSLOG) | CAP_TO_MASK(CAP_AUDIT_CONTROL));

    minijail_enter(j.get());

    return 0;

}