Merge "[RFCLAT#16] remove drop_root_and_caps" am: 95cbf3217f am: 35e51c45a4 am: dbad0785ec

Original change: https://android-review.googlesource.com/c/platform/external/android-clat/+/1949737

Change-Id: Ib896a1f0b7d05ef49ff7126ea3b6a00fa25e5954

4 files changed, 0 insertions, 53 deletions

diff --git a/Android.bp b/Android.bp
index 47d22a1..7a8ba03 100644
--- a/Android.bp
+++ b/Android.bp
@@ -53,10 +53,6 @@ filegroup {
 cc_binary {
     name: "clatd",
     defaults: ["clatd_defaults"],
-    // TODO: remove once drop_root_and_caps() is removed.
-    header_libs: [
-        "libcutils_headers",  // for AID_CLAT
-    ],
     srcs: [
         ":clatd_common",
         "main.c"
diff --git a/clatd.c b/clatd.c
index f760fef..f72f431 100644
--- a/clatd.c
+++ b/clatd.c
@@ -39,8 +39,6 @@
 #include <sys/capability.h>
 #include <sys/uio.h>
 
-#include <private/android_filesystem_config.h>  // For AID_CLAT.
-
 #include "clatd.h"
 #include "config.h"
 #include "dump.h"
@@ -55,48 +53,6 @@ struct clat_config Global_Clatd_Config;
 
 volatile sig_atomic_t running = 1;
 
-/* function: set_capability
- * set the permitted, effective and inheritable capabilities of the current
- * thread
- */
-void set_capability(uint64_t target_cap) {
-  struct __user_cap_header_struct header = {
-    .version = _LINUX_CAPABILITY_VERSION_3,
-    .pid     = 0  // 0 = change myself
-  };
-  struct __user_cap_data_struct cap[_LINUX_CAPABILITY_U32S_3] = {};
-
-  cap[0].permitted = cap[0].effective = cap[0].inheritable = target_cap;
-  cap[1].permitted = cap[1].effective = cap[1].inheritable = target_cap >> 32;
-
-  if (capset(&header, cap) < 0) {
-    logmsg(ANDROID_LOG_FATAL, "capset failed: %s", strerror(errno));
-    exit(1);
-  }
-}
-
-/* function: drop_root_and_caps
- * drops root privs and all capabilities
- */
-void drop_root_and_caps() {
-  // see man setgroups: this drops all supplementary groups
-  if (setgroups(0, NULL) < 0) {
-    logmsg(ANDROID_LOG_FATAL, "setgroups failed: %s", strerror(errno));
-    exit(1);
-  }
-
-  if (setresgid(AID_CLAT, AID_CLAT, AID_CLAT) < 0) {
-    logmsg(ANDROID_LOG_FATAL, "setresgid failed: %s", strerror(errno));
-    exit(1);
-  }
-  if (setresuid(AID_CLAT, AID_CLAT, AID_CLAT) < 0) {
-    logmsg(ANDROID_LOG_FATAL, "setresuid failed: %s", strerror(errno));
-    exit(1);
-  }
-
-  set_capability(0);
-}
-
 int ipv6_address_changed(const char *interface) {
   union anyip *interface_ip;
 
diff --git a/clatd.h b/clatd.h
index be3c9c1..87cdbcf 100644
--- a/clatd.h
+++ b/clatd.h
@@ -38,8 +38,6 @@ struct tun_data;
 
 extern volatile sig_atomic_t running;
 
-void set_capability(uint64_t target_cap);
-void drop_root_and_caps();
 int ipv6_address_changed(const char *interface);
 void event_loop(struct tun_data *tunnel);
 
diff --git a/main.c b/main.c
index 3d1ff95..d9371da 100644
--- a/main.c
+++ b/main.c
@@ -152,9 +152,6 @@ int main(int argc, char **argv) {
          uplink_interface, plat_prefix ? plat_prefix : "(none)", v4_addr ? v4_addr : "(none)",
          v6_addr ? v6_addr : "(none)");
 
-  // run under a regular user with no capabilities
-  drop_root_and_caps();
-
   // Loop until someone sends us a signal or brings down the tun interface.
   if (signal(SIGTERM, stop_loop) == SIG_ERR) {
     logmsg(ANDROID_LOG_FATAL, "sigterm handler failed: %s", strerror(errno));