Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b07cc5e0 authored by Treehugger Robot's avatar Treehugger Robot Committed by Gerrit Code Review
Browse files

Merge changes I3978cbe2,I7b8e1232 

* changes:
  Reland "Prevent vendors from accessing private VNDK libs"
  Permitted and search path change
parents 3289b9c9 ad7ddd5a

rootdir/Android.mk

+11 −3
Original line number Original line Diff line number Diff line
@@ -208,11 +208,17 @@ LOCAL_MODULE_PATH := $(TARGET_OUT_ETC) 
LOCAL_MODULE_STEM := $(LOCAL_MODULE)

LOCAL_MODULE_STEM := $(LOCAL_MODULE)

include $(BUILD_SYSTEM)/base_rules.mk

include $(BUILD_SYSTEM)/base_rules.mk





llndk_libraries := $(subst $(space),:,$(addsuffix .so,$(LLNDK_LIBRARIES)))

llndk_libraries := $(subst $(space),:,$(addsuffix .so,\

$(filter-out $(VNDK_PRIVATE_LIBRARIES),$(LLNDK_LIBRARIES))))





vndk_sameprocess_libraries := $(subst $(space),:,$(addsuffix .so,$(VNDK_SAMEPROCESS_LIBRARIES)))

private_llndk_libraries := $(subst $(space),:,$(addsuffix .so,\

$(filter $(VNDK_PRIVATE_LIBRARIES),$(LLNDK_LIBRARIES))))





vndk_core_libraries := $(subst $(space),:,$(addsuffix .so,$(VNDK_CORE_LIBRARIES)))

vndk_sameprocess_libraries := $(subst $(space),:,$(addsuffix .so,\

$(filter-out $(VNDK_PRIVATE_LIBRARIES),$(VNDK_SAMEPROCESS_LIBRARIES))))



vndk_core_libraries := $(subst $(space),:,$(addsuffix .so,\

$(filter-out $(VNDK_PRIVATE_LIBRARIES),$(VNDK_CORE_LIBRARIES))))





sanitizer_runtime_libraries := $(subst $(space),:,$(addsuffix .so,\

sanitizer_runtime_libraries := $(subst $(space),:,$(addsuffix .so,\

$(ADDRESS_SANITIZER_RUNTIME_LIBRARY) \

$(ADDRESS_SANITIZER_RUNTIME_LIBRARY) \
@@ -223,6 +229,7 @@ $(2ND_UBSAN_RUNTIME_LIBRARY) \ 
$(2ND_TSAN_RUNTIME_LIBRARY)))

$(2ND_TSAN_RUNTIME_LIBRARY)))





$(LOCAL_BUILT_MODULE): PRIVATE_LLNDK_LIBRARIES := $(llndk_libraries)

$(LOCAL_BUILT_MODULE): PRIVATE_LLNDK_LIBRARIES := $(llndk_libraries)

$(LOCAL_BUILT_MODULE): PRIVATE_PRIVATE_LLNDK_LIBRARIES := $(private_llndk_libraries)

$(LOCAL_BUILT_MODULE): PRIVATE_VNDK_SAMEPROCESS_LIBRARIES := $(vndk_sameprocess_libraries)

$(LOCAL_BUILT_MODULE): PRIVATE_VNDK_SAMEPROCESS_LIBRARIES := $(vndk_sameprocess_libraries)

$(LOCAL_BUILT_MODULE): PRIVATE_LLNDK_PRIVATE_LIBRARIES := $(llndk_private_libraries)

$(LOCAL_BUILT_MODULE): PRIVATE_LLNDK_PRIVATE_LIBRARIES := $(llndk_private_libraries)

$(LOCAL_BUILT_MODULE): PRIVATE_VNDK_CORE_LIBRARIES := $(vndk_core_libraries)

$(LOCAL_BUILT_MODULE): PRIVATE_VNDK_CORE_LIBRARIES := $(vndk_core_libraries)
@@ -231,6 +238,7 @@ $(LOCAL_BUILT_MODULE): $(LOCAL_PATH)/etc/ld.config.txt.in 
	@echo "Generate: $< -> $@"

	@echo "Generate: $< -> $@"

	@mkdir -p $(dir $@)

	@mkdir -p $(dir $@)

	$(hide) sed -e 's?%LLNDK_LIBRARIES%?$(PRIVATE_LLNDK_LIBRARIES)?g' $< >$@

	$(hide) sed -e 's?%LLNDK_LIBRARIES%?$(PRIVATE_LLNDK_LIBRARIES)?g' $< >$@

	$(hide) sed -i -e 's?%PRIVATE_LLNDK_LIBRARIES%?$(PRIVATE_PRIVATE_LLNDK_LIBRARIES)?g' $@

	$(hide) sed -i -e 's?%VNDK_SAMEPROCESS_LIBRARIES%?$(PRIVATE_VNDK_SAMEPROCESS_LIBRARIES)?g' $@

	$(hide) sed -i -e 's?%VNDK_SAMEPROCESS_LIBRARIES%?$(PRIVATE_VNDK_SAMEPROCESS_LIBRARIES)?g' $@

	$(hide) sed -i -e 's?%VNDK_CORE_LIBRARIES%?$(PRIVATE_VNDK_CORE_LIBRARIES)?g' $@

	$(hide) sed -i -e 's?%VNDK_CORE_LIBRARIES%?$(PRIVATE_VNDK_CORE_LIBRARIES)?g' $@

	$(hide) sed -i -e 's?%SANITIZER_RUNTIME_LIBRARIES%?$(PRIVATE_SANITIZER_RUNTIME_LIBRARIES)?g' $@

	$(hide) sed -i -e 's?%SANITIZER_RUNTIME_LIBRARIES%?$(PRIVATE_SANITIZER_RUNTIME_LIBRARIES)?g' $@

rootdir/etc/ld.config.txt.in

+22 −16
Original line number Original line Diff line number Diff line
@@ -51,7 +51,7 @@ namespace.default.asan.permitted.paths = /data:/system/${LIB}/drm:/system/${LIB} 
namespace.sphal.isolated = true

namespace.sphal.isolated = true

namespace.sphal.visible = true

namespace.sphal.visible = true

namespace.sphal.search.paths = /vendor/${LIB}/egl:/vendor/${LIB}/hw:/vendor/${LIB}

namespace.sphal.search.paths = /vendor/${LIB}/egl:/vendor/${LIB}/hw:/vendor/${LIB}

namespace.sphal.permitted.paths = /vendor/${LIB}:/system/${LIB}/vndk-sp/hw

namespace.sphal.permitted.paths = /vendor/${LIB}:/system/${LIB}/vndk-sp${VNDK_VER}/hw





namespace.sphal.asan.search.paths = /data/asan/vendor/${LIB}/egl:/vendor/${LIB}/egl:/data/asan/vendor/${LIB}/hw:/vendor/${LIB}/hw:/data/asan/vendor/${LIB}:/vendor/${LIB}

namespace.sphal.asan.search.paths = /data/asan/vendor/${LIB}/egl:/vendor/${LIB}/egl:/data/asan/vendor/${LIB}/hw:/vendor/${LIB}/hw:/data/asan/vendor/${LIB}:/vendor/${LIB}

namespace.sphal.asan.permitted.paths = /data/asan/vendor/${LIB}:/vendor/${LIB}

namespace.sphal.asan.permitted.paths = /data/asan/vendor/${LIB}:/vendor/${LIB}
@@ -79,14 +79,17 @@ namespace.sphal.link.rs.shared_libs = libRS_internal.so 
###############################################################################

###############################################################################

namespace.rs.isolated = true

namespace.rs.isolated = true

namespace.rs.visible = true

namespace.rs.visible = true

namespace.rs.search.paths = /vendor/${LIB}/vndk-sp:/system/${LIB}/vndk-sp:/vendor/${LIB}

namespace.rs.search.paths = /vendor/${LIB}/vndk-sp${VNDK_VER}:/system/${LIB}/vndk-sp${VNDK_VER}:/vendor/${LIB}

namespace.rs.permitted.paths = /vendor/${LIB}:/data

namespace.rs.permitted.paths = /vendor/${LIB}:/data





namespace.rs.asan.search.paths = /data/asan/vendor/${LIB}/vndk-sp:/vendor/${LIB}/vndk-sp:/data/asan/system/${LIB}/vndk-sp:/system/${LIB}/vndk-sp:/data/asan/vendor/${LIB}:/vendor/${LIB}

namespace.rs.asan.search.paths = /data/asan/vendor/${LIB}/vndk-sp${VNDK_VER}:/vendor/${LIB}/vndk-sp${VNDK_VER}:/data/asan/system/${LIB}/vndk-sp${VNDK_VER}:/system/${LIB}/vndk-sp${VNDK_VER}:/data/asan/vendor/${LIB}:/vendor/${LIB}

namespace.rs.asan.permitted.paths = /data/asan/vendor/${LIB}:/vendor/${LIB}:/data

namespace.rs.asan.permitted.paths = /data/asan/vendor/${LIB}:/vendor/${LIB}:/data





namespace.rs.links = default,vndk

namespace.rs.links = default,vndk

namespace.rs.link.default.shared_libs = %LLNDK_LIBRARIES%:%SANITIZER_RUNTIME_LIBRARIES%

namespace.rs.link.default.shared_libs = %LLNDK_LIBRARIES%:%SANITIZER_RUNTIME_LIBRARIES%

# Private LLNDK libs (e.g. libft2.so) are exceptionally allowed to this

# namespace because RS framework libs are using them.

namespace.rs.link.default.shared_libs += %PRIVATE_LLNDK_LIBRARIES%

namespace.rs.link.vndk.shared_libs = %VNDK_SAMEPROCESS_LIBRARIES%

namespace.rs.link.vndk.shared_libs = %VNDK_SAMEPROCESS_LIBRARIES%





###############################################################################

###############################################################################
@@ -96,10 +99,10 @@ namespace.rs.link.vndk.shared_libs = %VNDK_SAMEPROCESS_LIBRARIES% 
###############################################################################

###############################################################################

namespace.vndk.isolated = true

namespace.vndk.isolated = true

namespace.vndk.visible = true

namespace.vndk.visible = true

namespace.vndk.search.paths = /vendor/${LIB}/vndk-sp:/system/${LIB}/vndk-sp

namespace.vndk.search.paths = /vendor/${LIB}/vndk-sp${VNDK_VER}:/system/${LIB}/vndk-sp${VNDK_VER}

namespace.vndk.permitted.paths = /vendor/${LIB}/hw:/vendor/${LIB}/egl

namespace.vndk.permitted.paths = /vendor/${LIB}/hw:/vendor/${LIB}/egl





namespace.vndk.asan.search.paths = /data/asan/vendor/${LIB}/vndk-sp:/vendor/${LIB}/vndk-sp:/data/asan/system/${LIB}/vndk-sp:/system/${LIB}/vndk-sp

namespace.vndk.asan.search.paths = /data/asan/vendor/${LIB}/vndk-sp${VNDK_VER}:/vendor/${LIB}/vndk-sp${VNDK_VER}:/data/asan/system/${LIB}/vndk-sp${VNDK_VER}:/system/${LIB}/vndk-sp${VNDK_VER}

namespace.vndk.asan.permitted.paths = /data/asan/vendor/${LIB}/hw:/vendor/${LIB}/hw:/data/asan/vendor/${LIB}/egl:/vendor/${LIB}/egl

namespace.vndk.asan.permitted.paths = /data/asan/vendor/${LIB}/hw:/vendor/${LIB}/hw:/data/asan/vendor/${LIB}/egl:/vendor/${LIB}/egl





# When these NDK libs are required inside this namespace, then it is redirected

# When these NDK libs are required inside this namespace, then it is redirected
@@ -120,28 +123,31 @@ additional.namespaces = system 
###############################################################################

###############################################################################

# "default" namespace

# "default" namespace

#

#

# Vendor-side code runs in this namespace.

# This is the default linker namespace for a vendor process (a process started

# from /vendor/bin/*). The main executable and the libs under /vendor/lib[64]

# are loaded directly into this namespace. However, other libs under the system

# partition (VNDK and LLNDK libraries) are not loaded here but from the

# separate namespace 'system'. The delegation to the system namespace is done

# via the 'namespace.default.link.system.shared_libs' property below.

###############################################################################

###############################################################################

namespace.default.isolated = true

namespace.default.isolated = true

namespace.default.visible = true

namespace.default.visible = true





namespace.default.search.paths = /vendor/${LIB}/hw:/vendor/${LIB}/egl:/vendor/${LIB}:/vendor/${LIB}/vndk:/system/${LIB}/vndk:/vendor/${LIB}/vndk-sp:/system/${LIB}/vndk-sp

namespace.default.search.paths = /vendor/${LIB}/hw:/vendor/${LIB}/egl:/vendor/${LIB}:/vendor/${LIB}/vndk${VNDK_VER}:/vendor/${LIB}/vndk-sp${VNDK_VER}

namespace.default.permitted.paths = /vendor:/system/${LIB}/vndk:/system/${LIB}/vndk-sp

namespace.default.permitted.paths = /vendor





namespace.default.asan.search.paths = /data/asan/vendor/${LIB}/hw:/vendor/${LIB}/hw:/data/asan/vendor/${LIB}/egl:/vendor/${LIB}/egl:/data/asan/vendor/${LIB}:/vendor/${LIB}:/data/asan/vendor/${LIB}/vndk:/vendor/${LIB}/vndk:/data/asan/system/${LIB}/vndk:/system/${LIB}/vndk:/data/asan/vendor/${LIB}/vndk-sp:/vendor/${LIB}/vndk-sp:/data/asan/system/${LIB}/vndk-sp:/system/${LIB}/vndk-sp

namespace.default.asan.search.paths = /data/asan/vendor/${LIB}/hw:/vendor/${LIB}/hw:/data/asan/vendor/${LIB}/egl:/vendor/${LIB}/egl:/data/asan/vendor/${LIB}:/vendor/${LIB}:/data/asan/vendor/${LIB}/vndk${VNDK_VER}:/vendor/${LIB}/vndk${VNDK_VER}:/data/asan/vendor/${LIB}/vndk-sp${VNDK_VER}:/vendor/${LIB}/vndk-sp${VNDK_VER}:namespace.default.asan.permitted.paths = /data/asan/vendor:/vendor

namespace.default.asan.permitted.paths = /data/asan/vendor:/vendor:/data/asan/system/${LIB}/vndk:/system/${LIB}/vndk:/data/asan/system/${LIB}/vndk-sp:/system/${LIB}/vndk-sp





namespace.default.links = system

namespace.default.links = system

namespace.default.link.system.shared_libs = %LLNDK_LIBRARIES%

namespace.default.link.system.shared_libs = %LLNDK_LIBRARIES%:%VNDK_SAMEPROCESS_LIBRARIES%:%VNDK_CORE_LIBRARIES%





###############################################################################

###############################################################################

# "system" namespace

# "system" namespace

#

#

# This is for vendor process to use LL-NDK in system partition.

# This namespace is where system libs (VNDK and LLNDK libs) are loaded for

# a vendor process.

###############################################################################

###############################################################################

namespace.system.isolated = false

namespace.system.isolated = false

namespace.system.search.paths = /system/${LIB}

namespace.system.search.paths = /system/${LIB}/vndk-sp${VNDK_VER}:/system/${LIB}/vndk${VNDK_VER}:/system/${LIB}

namespace.system.permitted.paths = /system/${LIB}





namespace.system.asan.search.paths = /data/asan/system/${LIB}:/system/${LIB}

namespace.system.asan.search.paths = /data/asan/system/${LIB}/vndk-sp${VNDK_VER}:/system/${LIB}/vndk-sp${VNDK_VER}:/data/asan/system/${LIB}/vndk${VNDK_VER}:/system/${LIB}/vndk${VNDK_VER}:/data/asan/system/${LIB}:/system/${LIB}
 
namespace.system.asan.permitted.paths = /data/asan/system/${LIB}:/system/${LIB}