base: Install seccomp filter even if selinux is permissive
* If selinux is permissive, Google decide to disable seccomp
filter because debug tools like strace needs both them to be
disabled to work.
* This is fine for developers, but if one runs selinux permissive
in production, it will be super easy for a macilious app to gain
root access on Q+, with newly interoduced ZygotePreload API.
* Technical details:
https://github.com/dantmnf/BrokenSandbox
https://github.com/vvb2060/Magica
Change-Id: I1a1208a0a82d36aeb49820972429d106919d6bce
(cherry picked from commit 32cf8c9cb1915ef67526c4e961ecb6a2181b6934)
Signed-off-by: SuperDroidBond <superdroidbond@yahoo.com>
1 file changed