commit c95477bc83b25dafa8ba9169313f4acc72453dd1
author Luis Hector Chavez <lhchavez@google.com> Mon Nov 27 21:58:28 2017 +0000
committer android-build-merger <android-build-merger@google.com> Mon Nov 27 21:58:28 2017 +0000
tree 6a733e824aed09678acf4e9163b0f1efac534a62
parent 0873d817f528425c289e651562096b8249c8c3bc
parent 033b54be3f844150b2133c82a35ea679aa249781

Merge "init: Drop inheritable capabilities when switching uids" am: a227804015 am: 289c1f3468
am: d4d352852d

Change-Id: I44c7f12e72c7cf236ebbcf07b36fc1bd9b8a8179

init/capabilities.cpp

diff --git a/init/capabilities.cpp b/init/capabilities.cpp
index 642a364..50987db 100644
--- a/init/capabilities.cpp
+++ b/init/capabilities.cpp
@@ -194,5 +194,18 @@
     return SetAmbientCaps(to_keep);
 }
 
+bool DropInheritableCaps() {
+    ScopedCaps caps(cap_get_proc());
+    if (cap_clear_flag(caps.get(), CAP_INHERITABLE) == -1) {
+        PLOG(ERROR) << "cap_clear_flag(INHERITABLE) failed";
+        return false;
+    }
+    if (cap_set_proc(caps.get()) != 0) {
+        PLOG(ERROR) << "cap_set_proc() failed";
+        return false;
+    }
+    return true;
+}
+
 }  // namespace init
 }  // namespace android

init/capabilities.h

diff --git a/init/capabilities.h b/init/capabilities.h
index ede85c3..fc80c98 100644
--- a/init/capabilities.h
+++ b/init/capabilities.h
@@ -35,6 +35,7 @@
 bool CapAmbientSupported();
 unsigned int GetLastValidCap();
 bool SetCapsForExec(const CapSet& to_keep);
+bool DropInheritableCaps();
 
 }  // namespace init
 }  // namespace android

init/service.cpp

diff --git a/init/service.cpp b/init/service.cpp
index 481df65..331b859 100644
--- a/init/service.cpp
+++ b/init/service.cpp
@@ -291,6 +291,11 @@
         if (!SetCapsForExec(capabilities_)) {
             LOG(FATAL) << "cannot set capabilities for " << name_;
         }
+    } else if (uid_) {
+        // Inheritable caps can be non-zero when running in a container.
+        if (!DropInheritableCaps()) {
+            LOG(FATAL) << "cannot drop inheritable caps for " << name_;
+        }
     }
 }