-
- Downloads
system_server: replace sys_resource with sys_ptrace
Commit https://android.googlesource.com/kernel/common/+/f0ce0eee added CAP_SYS_RESOURCE as a capability check which would allow access to sensitive /proc/PID files. However, in an SELinux based world, allowing this access causes CAP_SYS_RESOURCE to duplicate what CAP_SYS_PTRACE (without :process ptrace) already provides. Use CAP_SYS_PTRACE instead of CAP_SYS_RESOURCE. Test: Device boots, functionality remains identical, no sys_resource denials from system_server. Bug: 34951864 Bug: 38496951 Change-Id: I04d745b436ad75ee1ebecf0a61c6891858022e34 (cherry picked from commit 44866954)
Loading