Skip to content
Snippets Groups Projects
  • Nick Kralevich's avatar
    2de02877
    zygote: allow replacing /proc/cpuinfo · 2de02877
    Nick Kralevich authored
    Android's native bridge functionality allows an Android native
    app written on one CPU architecture to run on a different architecture.
    For example, Android ARM apps may run on an x86 CPU.
    
    To support this, the native bridge functionality needs to replace
    /proc/cpuinfo with the version from /system/lib/<ISA>/cpuinfo
    using a bind mount. See commit ab0da5a9a6860046619629b8e6b83692d35dff86
    in system/core.
    
    This change:
    
    1) Creates a new label proc_cpuinfo, and assigns /proc/cpuinfo
    that label.
    2) Grants read-only access to all SELinux domains, to avoid
    breaking pre-existing apps.
    3) Grants zygote mounton capabilities for that file, so zygote
    can replace the file as necessary.
    
    Addresses the following denial:
    
      avc: denied { mounton } for path="/proc/cpuinfo" dev="proc" ino=4026532012 scontext=u:r:zygote:s0 tcontext=u:object_r:proc:s0 tclass=file
    
    Bug: 17671501
    Change-Id: Ib70624fba2baeccafbc0a41369833f76b976ee20
    2de02877
    History
    zygote: allow replacing /proc/cpuinfo
    Nick Kralevich authored
    Android's native bridge functionality allows an Android native
    app written on one CPU architecture to run on a different architecture.
    For example, Android ARM apps may run on an x86 CPU.
    
    To support this, the native bridge functionality needs to replace
    /proc/cpuinfo with the version from /system/lib/<ISA>/cpuinfo
    using a bind mount. See commit ab0da5a9a6860046619629b8e6b83692d35dff86
    in system/core.
    
    This change:
    
    1) Creates a new label proc_cpuinfo, and assigns /proc/cpuinfo
    that label.
    2) Grants read-only access to all SELinux domains, to avoid
    breaking pre-existing apps.
    3) Grants zygote mounton capabilities for that file, so zygote
    can replace the file as necessary.
    
    Addresses the following denial:
    
      avc: denied { mounton } for path="/proc/cpuinfo" dev="proc" ino=4026532012 scontext=u:r:zygote:s0 tcontext=u:object_r:proc:s0 tclass=file
    
    Bug: 17671501
    Change-Id: Ib70624fba2baeccafbc0a41369833f76b976ee20