commit ab4d00fa0aaea02d4af32840fb0c950819e7b730
author Nick Kralevich <nnk@google.com> Fri Aug 25 12:55:52 2017 -0700
committer Nick Kralevich <nnk@google.com> Fri Aug 25 12:55:52 2017 -0700
tree 9a50837d7315e73e078bd7b19d035f1595fa43e7
parent 6d7e5cf677b389ef256620db43da1a01f6228fc0

init.rc: Lock down access to /proc/net/fib_trie

Make /proc/net/fib_trie only readable to root.

Bug: 31269937
Test: Device boots, file has appropriate permissions.
Change-Id: I0d01ce5c043d576344a6732b0b9ff93d62fcaa34

rootdir/init.rc

diff --git a/rootdir/init.rc b/rootdir/init.rc
index df90403..2a73335 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -148,6 +148,9 @@
     write /proc/sys/net/ipv4/conf/all/accept_redirects 0
     write /proc/sys/net/ipv6/conf/all/accept_redirects 0
 
+    # /proc/net/fib_trie leaks interface IP addresses
+    chmod 0400 /proc/net/fib_trie
+
     # Create cgroup mount points for process groups
     mkdir /dev/cpuctl
     mount cgroup none /dev/cpuctl cpu