aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2016-05-04Fix #ifdef statement.android-cts_7.1_r1android-cts-7.1_r9android-cts-7.1_r8android-cts-7.1_r7android-cts-7.1_r6android-cts-7.1_r5android-cts-7.1_r4android-cts-7.1_r3android-cts-7.1_r29android-cts-7.1_r28android-cts-7.1_r27android-cts-7.1_r26android-cts-7.1_r25android-cts-7.1_r24android-cts-7.1_r23android-cts-7.1_r22android-cts-7.1_r21android-cts-7.1_r20android-cts-7.1_r2android-cts-7.1_r19android-cts-7.1_r18android-cts-7.1_r17android-cts-7.1_r16android-cts-7.1_r15android-cts-7.1_r14android-cts-7.1_r13android-cts-7.1_r12android-cts-7.1_r11android-cts-7.1_r10android-cts-7.1_r1android-7.1.2_r9android-7.1.2_r8android-7.1.2_r6android-7.1.2_r5android-7.1.2_r4android-7.1.2_r39android-7.1.2_r38android-7.1.2_r37android-7.1.2_r36android-7.1.2_r33android-7.1.2_r32android-7.1.2_r30android-7.1.2_r3android-7.1.2_r29android-7.1.2_r28android-7.1.2_r27android-7.1.2_r25android-7.1.2_r24android-7.1.2_r23android-7.1.2_r2android-7.1.2_r19android-7.1.2_r18android-7.1.2_r17android-7.1.2_r16android-7.1.2_r15android-7.1.2_r14android-7.1.2_r13android-7.1.2_r12android-7.1.2_r11android-7.1.2_r10android-7.1.2_r1android-7.1.1_r9android-7.1.1_r8android-7.1.1_r7android-7.1.1_r61android-7.1.1_r60android-7.1.1_r6android-7.1.1_r59android-7.1.1_r58android-7.1.1_r57android-7.1.1_r56android-7.1.1_r55android-7.1.1_r54android-7.1.1_r53android-7.1.1_r52android-7.1.1_r51android-7.1.1_r50android-7.1.1_r49android-7.1.1_r48android-7.1.1_r47android-7.1.1_r46android-7.1.1_r45android-7.1.1_r44android-7.1.1_r43android-7.1.1_r42android-7.1.1_r41android-7.1.1_r40android-7.1.1_r4android-7.1.1_r39android-7.1.1_r38android-7.1.1_r35android-7.1.1_r33android-7.1.1_r32android-7.1.1_r31android-7.1.1_r3android-7.1.1_r28android-7.1.1_r27android-7.1.1_r26android-7.1.1_r25android-7.1.1_r24android-7.1.1_r23android-7.1.1_r22android-7.1.1_r21android-7.1.1_r20android-7.1.1_r2android-7.1.1_r17android-7.1.1_r16android-7.1.1_r15android-7.1.1_r14android-7.1.1_r13android-7.1.1_r12android-7.1.1_r11android-7.1.1_r10android-7.1.1_r1android-7.1.0_r7android-7.1.0_r6android-7.1.0_r5android-7.1.0_r4android-7.1.0_r3android-7.1.0_r2android-7.1.0_r1nougat-mr2.3-releasenougat-mr2.2-releasenougat-mr2.1-releasenougat-mr2-security-releasenougat-mr2-releasenougat-mr2-pixel-releasenougat-mr2-devnougat-mr1.8-releasenougat-mr1.7-releasenougat-mr1.6-releasenougat-mr1.5-releasenougat-mr1.4-releasenougat-mr1.3-releasenougat-mr1.2-releasenougat-mr1.1-releasenougat-mr1-volantis-releasenougat-mr1-security-releasenougat-mr1-releasenougat-mr1-flounder-releasenougat-mr1-devnougat-mr1-cts-releasenougat-dr1-releaseJorge Lucangeli Obes
am: 8c3febd20f * commit '8c3febd20f0cef00a5049f6962666b6c62093aa9': Fix #ifdef statement. Change-Id: I3c31733ab3b14fd3093e56504de970e88b63fa46
2016-05-04Skip setting seccomp filter when running with ASan.Jorge Lucangeli Obes
am: abb93141f0 * commit 'abb93141f0255a624bda29e4842611f8bc120df8': Skip setting seccomp filter when running with ASan. Change-Id: Ib3ba92897d4229ae09f9cb9c87e2b57b5f090f9e
2016-05-03Fix #ifdef statement.nougat-devJorge Lucangeli Obes
Previous version did not compile with GCC. Bug: 27980137 (cherry picked from commit 9e35c09854e55973731f80dd7cc41b80c20eec42) Change-Id: Ibbad230f6651c51df62905799c5d4fad839919b3
2016-05-03Skip setting seccomp filter when running with ASan.Jorge Lucangeli Obes
Also add an example build target for an ASan-ified libminijail (useful for debugging). Bug: 28052772 Bug: 27980137 (cherry picked from commit 2413f3713ae8a306a23550e2eecd59f380f34eae) Change-Id: I0b07b17934221a7ff4bd0b58641e4e7afb225aa6
2016-02-05Add check for supplementary groups.Jorge Lucangeli Obes
am: 0e3fe532a9 * commit '0e3fe532a9fdf42bed41e371939134af38dd53b5': Add check for supplementary groups.
2016-02-05Add check for supplementary groups.Jorge Lucangeli Obes
This binary will be used by a new Brillo Autotest test. Also tie the return value of the binary to the result of the checks =). Bug: 25368607 Change-Id: Ia338cb8270916cafdbbfbbb8808b88759906327f
2016-02-04Unit tests: Compile only on \'eng\' builds.Jorge Lucangeli Obes
am: 3c8375cdf3 * commit '3c8375cdf37104998ded0edc5ed072ab3b07c00d': Unit tests: Compile only on 'eng' builds.
2016-02-04Unit tests: Compile only on 'eng' builds.Jorge Lucangeli Obes
Bug: 26967770 Change-Id: I93e6a108803a62383c2e1b71879196e2b47c38ba
2016-02-04Merge "call abort() on sigsys"Jeffrey Vander Stoep
am: a0aa041dff * commit 'a0aa041dff6fb71c7ac7bd08b805087ad6026e37': call abort() on sigsys
2016-02-04Merge "call abort() on sigsys"Jeffrey Vander Stoep
2016-02-04Add libminijail test executable.Jorge Lucangeli Obes
am: ac9e342ef7 * commit 'ac9e342ef745e9057edc4e1b02a52d8943ea608a': Add libminijail test executable.
2016-02-03call abort() on sigsysJeff Vander Stoep
Tells debuggerd to attach to the process and send crash data to logcat. Bug: 26580739 Change-Id: I9df09f044e56cf250963d4e4cf5959642fe2ee2f
2016-02-03Add libminijail test executable.Jorge Lucangeli Obes
This is useful to test basic Minijail functionality and will be used by future Autotest tests. The code is currently very similar to 'drop_privs.cpp', but I expect that to change in the future. Bug: 25368607 Change-Id: I4db3359b07c3b37fa4ac9e24598a5d21623383d5
2016-01-29Merge "Don\'t die() on bind mounts."Jorge Lucangeli Obes
am: d569b1e6c8 * commit 'd569b1e6c811ddd39fcb46a74f386ae63af650de': Don't die() on bind mounts.
2016-01-28Merge "Don't die() on bind mounts."Jorge Lucangeli Obes
2016-01-28Don't die() on bind mounts.Jorge Lucangeli Obes
By the time we get to the removed lines, |mounts_head| will be valid in the parent (Minijail) process, but |flags.chroot| and |flags.pivot_root| will have been cleared by minijail_preexec(). The removed lines were then incorrectly aborting the process too early. The flags *will* be set in the minijail struct used by the child (jailed) process, so the bind mounts will happen correctly. A follow-up CL will make sure |mounts_head| is never valid when both flags are cleared, so that we can correctly check for this. While in there, fix a comment and an info() message. security_Minijail0 now passes. Bug: 25368607 Change-Id: I5ac85ee62560ba8957bdab3fc84689ed06d106f0
2016-01-28Fix build in x86_64.Alex Deymo
am: 7c6899c198 * commit '7c6899c198c3a3c68268243a2f46050d13bf622f': Fix build in x86_64.
2016-01-27Fix build in x86_64.Alex Deymo
The recently added #elif should be an #else. Bug: None TEST=emerge-link chromeos-minijail Change-Id: I5fcbaa4e51c6cf111a61fb33b7a90c9aa37398ca
2016-01-26Merge "Compile \'minijail0\' on Brillo/Android."Jorge Lucangeli Obes
am: e7a5908f52 * commit 'e7a5908f5200e84259686fba8dc82fec9ac8f4f7': Compile 'minijail0' on Brillo/Android.
2016-01-26Print an error when attempting to use bind mounts without chroot.Jorge Lucangeli Obes
am: 2b12ba4904 * commit '2b12ba490431f312099163c476d30fb39e9428d7': Print an error when attempting to use bind mounts without chroot.
2016-01-26Merge "Compile 'minijail0' on Brillo/Android."Jorge Lucangeli Obes
2016-01-26Print an error when attempting to use bind mounts without chroot.Jorge Lucangeli Obes
Bind mounts should be used with chroot or pivot_root. Print an error and exit when that's not the case. Clean up some comments and error messages while in there. Bug: 26784268 Change-Id: I4e384a989e1aef5b2989c4f17e047a9ac7cadbc8
2016-01-26Compile 'minijail0' on Brillo/Android.Jorge Lucangeli Obes
We're not currently using the 'minijail0' executable on Brillo or Android, but given that upstream Minijail is in AOSP, it's useful to be able to build all Minijail targets in a Brillo or Android checkout. Make it an "optional" target so that it doesn't get included on regular builds. This requires fixing one case of assigning 'const char*' to 'char*', setting an invalid PRELOADPATH variable, and disabling 'missing-field-initializers' warnings. Bug: 26798535 Change-Id: I1fe61f5ac2687d3a185d971a699fa4237a4b6a10
2016-01-26Add \'cgroups\' flag.Jorge Lucangeli Obes
am: b8a5138a45 * commit 'b8a5138a451e183debbce56f3fa031e1880ff901': Add 'cgroups' flag.
2016-01-26Add 'cgroups' flag.Jorge Lucangeli Obes
Cgroups ended up being the only feature that doesn't have a flag. Fix that, and fix some comments while we're there. Bug: 26782393 Change-Id: I83e56b6d7fb4a5668ffecc2b597902ee663fdab6
2016-01-25Add syscall logging support for x86_64 architectures on Android.Jorge Lucangeli Obes
am: b98ad29bc0 * commit 'b98ad29bc07149cc8ffa29b986c7bc4339c9ad82': Add syscall logging support for x86_64 architectures on Android.
2016-01-25Add syscall logging support for x86_64 architectures on Android.Jorge Lucangeli Obes
Bug: 26776934 Change-Id: I54d62bb74e4359beca4852484a77a3a007f17c42
2016-01-25Don\'t fail on invalid syscalls.Jorge Lucangeli Obes
am: be351a294d * commit 'be351a294d36bd90f8bd4d887a7ad323d6441a67': Don't fail on invalid syscalls.
2016-01-22Don't fail on invalid syscalls.Jorge Lucangeli Obes
When putting together a new policy, it's useful to get a list of all the invalid syscalls. Don't fail on invalid syscalls if the user requested logging failures. Bug: None Change-Id: Ib2d9bbb3e41a1eeb44a41fd2ab32b50ab4efcddf
2016-01-22Add ability to put jailed process in cgroupsDylan Reid
am: 605ce7f5cc * commit '605ce7f5ccda3597305f7ca8e21ba16e254cf96c': Add ability to put jailed process in cgroups
2016-01-20Add ability to put jailed process in cgroupsDylan Reid
This adds an API that allows the jailed process to be added to a given cgroup. This API can be called repeatedly to add the process to many cgroups. The process will be added after fork but before it is exec'd. BUG=b/26549867 TEST=set cgroups and inspect that pid is in tasks file Change-Id: I87a9897c1dc741c726873e872eeae32692088979 Signed-off-by: Dylan Reid <dgreid@chromium.org>
2016-01-20Separate child process sync from user namespaceDylan Reid
am: ce5b55eb48 * commit 'ce5b55eb48f276951b6c4d1bbfc667240c1e8f2f': Separate child process sync from user namespace
2016-01-20Separate child process sync from user namespaceDylan Reid
Syncing the child and parent was only done so that the uid/gid maps could be setup. Make this more general so that the next commit can add setting of cgroups which also wants to happen after the child forks but before the jailed process is run similar top uid/gid map setting. BUG=b/26549867 TEST=security_Minijail0 Change-Id: I81d512f351cfe459cd7af4c55263504d22b929fa Signed-off-by: Dylan Reid <dgreid@chromium.org>
2016-01-14Set HAVE_SECUREBITS_H define.Jorge Lucangeli Obes
Android/Brillo have 'linux/securebits.h' available. Bug: None Change-Id: I43ac60aa1cdafd7ff6d4579b335519e512c08f77
2016-01-14Set HAVE_SECUREBITS_H define.Jorge Lucangeli Obes
am: 33b967df36 -s ours * commit '33b967df36fe2b3997ead2c139efb4775946a612': Set HAVE_SECUREBITS_H define.
2016-01-14Make is_android staticDylan Reid
am: c4b0fdc4bf * commit 'c4b0fdc4bf008115c9d7a2589de38ed007ca8138': Make is_android static
2016-01-13Set HAVE_SECUREBITS_H define.Jorge Lucangeli Obes
Android/Brillo have 'linux/securebits.h' available. Bug: None Change-Id: I43ac60aa1cdafd7ff6d4579b335519e512c08f77
2016-01-13Make is_android staticDylan Reid
util.h gets included from more than one place on Chrome OS builds. Change-Id: I021235738115782fc2966d51fe356364953db169 Signed-off-by: Dylan Reid <dgreid@chromium.org>
2016-01-13Fix Minijail build.Jorge Lucangeli Obes
am: 272e3ab72d * commit '272e3ab72da543c3ed3cb1cf312e45796b149d19': Fix Minijail build.
2016-01-13Merge "softfail on older kernels that lack seccomp support"Jeffrey Vander Stoep
am: c31391e80a * commit 'c31391e80af7fbdb7fe06ac9bb99a85cb7542be0': softfail on older kernels that lack seccomp support
2016-01-12Fix Minijail build.Jorge Lucangeli Obes
Remove 'static' qualifier from helper functions to fix the build. Bug: None Change-Id: I03cf18a415961ee6a32f05262b2925f6e5a8a8e5
2016-01-13Merge "softfail on older kernels that lack seccomp support"Jeffrey Vander Stoep
2016-01-12softfail on older kernels that lack seccomp supportJeff Vander Stoep
Attempt to set up a seccomp filter. If seccomp not supported on an Android device and kernel version < 3.8 fail softly i.e. allow process to run without seccomp protections. Bug: 26435980 Change-Id: Ied6ac053908b6b0b81ba822621b1969bdedce4af
2016-01-11Merge "Make set_supplementary_gids return \'void\'."Jorge Lucangeli Obes
am: 0e08026203 * commit '0e080262030f07821eb2c66377eec0ab1e3ef1a5': Make set_supplementary_gids return 'void'.
2016-01-11Merge "Make set_supplementary_gids return 'void'."brillo-m9-releasebrillo-m9-devJorge Lucangeli Obes
2016-01-08Merge "Fix libminijail static build."Jorge Lucangeli Obes
am: 4c0e630787 * commit '4c0e6307875b9d278cf5e94baa3217ce1ce9dadf': Fix libminijail static build.
2016-01-08Merge "Fix libminijail static build."Jorge Lucangeli Obes
2016-01-08Make set_supplementary_gids return 'void'.Jorge Lucangeli Obes
After https://android-review.googlesource.com/#/c/195351 lands, no callers expect this function to return a result. Change the signature to avoid errors. Bug: 26099611 Change-Id: Id9c80350a0ce1f80ce5b5691117e68e37dd6c10e
2016-01-08Make set_supplementary_gids abort on memory errors.Jorge Lucangeli Obes
am: fd5fc562f3 * commit 'fd5fc562f3c609d13b80b6b93c381a3ba8dc92b0': Make set_supplementary_gids abort on memory errors.
2016-01-08Fix libminijail static build.Jorge Lucangeli Obes
Using LOCAL_WHOLE_STATIC_LIBRARIES prevents targets including a static libminijail from having to also include its dependencies. Bug: 26099611 Change-Id: I7f569b9228a5a3a66f7a36ade8e9584ad5b7d8c0
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-25 11:11:36 +0000