Merge "init: add support for global seccomp boot option" (9f1980e2) · Commits · e / os / android_system_core

init/Android.mk

+1 −0

+13 −0

Original line number	Original line	Diff line number	Diff line
	@@ -23,6 +23,7 @@
	#include <inttypes.h>		#include <inttypes.h>
	#include <libgen.h>		#include <libgen.h>
	#include <paths.h>		#include <paths.h>
			#include <seccomp_policy.h>
	#include <signal.h>		#include <signal.h>
	#include <stdarg.h>		#include <stdarg.h>
	#include <stdio.h>		#include <stdio.h>
	@@ -554,6 +555,15 @@ static int queue_property_triggers_action(const std::vector<std::string>& args)
	return 0;		return 0;
	}		}

			static void global_seccomp() {
			import_kernel_cmdline(false, [](const std::string& key, const std::string& value, bool in_qemu) {
			if (key == "androidboot.seccomp" && value == "global" && !set_global_seccomp_filter()) {
			LOG(ERROR) << "Failed to globally enable seccomp!";
			panic();
			}
			});
			}

	static void selinux_init_all_handles(void)		static void selinux_init_all_handles(void)
	{		{
	sehandle = selinux_android_file_context_handle();		sehandle = selinux_android_file_context_handle();
	@@ -1004,6 +1014,9 @@ int main(int argc, char** argv) {

	SetInitAvbVersionInRecovery();		SetInitAvbVersionInRecovery();

			// Enable seccomp if global boot option was passed (otherwise it is enabled in zygote).
			global_seccomp();

	// Set up SELinux, loading the SELinux policy.		// Set up SELinux, loading the SELinux policy.
	selinux_initialize(true);		selinux_initialize(true);