Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f5965519 authored by Luis Hector Chavez's avatar Luis Hector Chavez
Browse files

init: Read previous state of securebits before modifying 

When Android is running in a container, some of the securebits might be
locked, which makes prctl(PR_SET_SECUREBITS) fail.

This change gets the previous state of the process' securebits and adds
the desired bits.

Bug: 62388055
Test: aosp_bullhead-eng boots
Test: If init has non-zero securebits, it can also boot
Change-Id: Ie03bf2538f9dca40955bc58314d269246f5731bd
parent c997cd64

init/service.cpp

+9 −2
Original line number Original line Diff line number Diff line
@@ -235,8 +235,15 @@ void Service::KillProcessGroup(int signal) { 
void Service::SetProcessAttributes() {

void Service::SetProcessAttributes() {

    // Keep capabilites on uid change.

    // Keep capabilites on uid change.

    if (capabilities_.any() && uid_) {

    if (capabilities_.any() && uid_) {

        if (prctl(PR_SET_SECUREBITS, SECBIT_KEEP_CAPS | SECBIT_KEEP_CAPS_LOCKED) != 0) {

        // If Android is running in a container, some securebits might already

            PLOG(FATAL) << "prtcl(PR_SET_KEEPCAPS) failed for " << name_;

        // be locked, so don't change those.

        int64_t securebits = prctl(PR_GET_SECUREBITS);

        if (securebits == -1) {

            PLOG(FATAL) << "prctl(PR_GET_SECUREBITS) failed for " << name_;

        }

        securebits |= SECBIT_KEEP_CAPS | SECBIT_KEEP_CAPS_LOCKED;

        if (prctl(PR_SET_SECUREBITS, securebits) != 0) {

            PLOG(FATAL) << "prctl(PR_SET_SECUREBITS) failed for " << name_;

        }

        }

    }

    }