commit 3a8faf1d1e31b459d7e5e7128e0f51132939f966
author TreeHugger Robot <treehugger-gerrit@google.com> Tue Feb 28 00:45:24 2017 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Tue Feb 28 00:45:25 2017 +0000
tree 4d35854805f0c1161cef15c3192d048ff0a38a6f
parent 8f99c70fe878fca9dbe2fdb2982952f8a4b9559d
parent d9038c120e78e8bf409eb559adeeb3bf4661a080

Merge changes from topic 'remove_cap'

* changes:
  libcutils: remove storaged caps
  storaged: reduce storaged privilege

libcutils/fs_config.c

diff --git a/libcutils/fs_config.c b/libcutils/fs_config.c
index b92fff9..5e9bd4d 100644
--- a/libcutils/fs_config.c
+++ b/libcutils/fs_config.c
@@ -149,10 +149,6 @@
                                               "system/bin/run-as" },
     { 00700, AID_SYSTEM,    AID_SHELL,     CAP_MASK_LONG(CAP_BLOCK_SUSPEND),
                                               "system/bin/inputflinger" },
-    { 00750, AID_SYSTEM,    AID_SHELL,     CAP_MASK_LONG(CAP_SETUID) |
-                                           CAP_MASK_LONG(CAP_SETGID) |
-                                           CAP_MASK_LONG(CAP_SYS_PTRACE),
-                                              "system/bin/storaged" },
 
     /* Support FIFO scheduling mode in SurfaceFlinger. */
     { 00755, AID_SYSTEM,    AID_GRAPHICS,  CAP_MASK_LONG(CAP_SYS_NICE),

storaged/main.cpp

diff --git a/storaged/main.cpp b/storaged/main.cpp
index f5a8f39..672f453 100644
--- a/storaged/main.cpp
+++ b/storaged/main.cpp
@@ -44,20 +44,6 @@
 
 storaged_t storaged;
 
-static int drop_privs() {
-    // privilege setting
-    struct sched_param param;
-    memset(&param, 0, sizeof(param));
-
-    if (set_sched_policy(0, SP_BACKGROUND) < 0) return -1;
-
-    if (sched_setscheduler((pid_t) 0, SCHED_BATCH, &param) < 0) return -1;
-
-    if (setpriority(PRIO_PROCESS, 0, ANDROID_PRIORITY_BACKGROUND) < 0) return -1;
-
-    return 0;
-}
-
 // Function of storaged's main thread
 void* storaged_main(void* s) {
     storaged_t* storaged = (storaged_t*)s;
@@ -133,10 +119,6 @@
         if (fd_emmc < 0)
             fd_emmc = TEMP_FAILURE_RETRY(open(mmc0_ext_csd, O_RDONLY));
 
-        if (drop_privs() != 0) {
-            return -1;
-        }
-
         storaged.set_privileged_fds(fd_emmc);
 
         // Start the main thread of storaged

storaged/storaged.rc

diff --git a/storaged/storaged.rc b/storaged/storaged.rc
index bb7c623..a24c7fb 100644
--- a/storaged/storaged.rc
+++ b/storaged/storaged.rc
@@ -1,6 +1,7 @@
 service storaged /system/bin/storaged
     class main
+    priority 10
     file /d/mmc0/mmc0:0001/ext_csd r
     writepid /dev/cpuset/system-background/tasks
     user root
-    group system package_info
\ No newline at end of file
+    group package_info
\ No newline at end of file