From a89e4d5a36b42a0018ae6cb293d6646b1240d054 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= Date: Fri, 14 Mar 2025 09:14:36 -0700 Subject: [PATCH] change 'for-system' owner from root to clat MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit See https://b.corp.google.com/issues/402962730#comment27 for explanation how clat uid not having access to this directory causes selinux denials, but basically the dynamic linker tries to call realpath on /proc/self/exe, which fails because it's post setuid/gid and thus running as clat/clat, not as uid=root or gid=system which have access. (note that the 'w' bits don't really matter since this is embedded in an apex, and thus readonly filesystem anyway) Bug: 402962730 Test: TreeHugger Signed-off-by: Maciej Żenczykowski Change-Id: Iaf620e33d9211c9bc0c017543bb1be2f43520a51 --- Tethering/apex/canned_fs_config | 2 +- service/jni/com_android_server_connectivity_ClatCoordinator.cpp | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Tethering/apex/canned_fs_config b/Tethering/apex/canned_fs_config index 1f5fcfaef5..edc5515233 100644 --- a/Tethering/apex/canned_fs_config +++ b/Tethering/apex/canned_fs_config @@ -1,3 +1,3 @@ -/bin/for-system 0 1000 0750 +/bin/for-system 1029 1000 0750 /bin/for-system/clatd 1029 1029 06755 /bin/netbpfload 0 0 0750 diff --git a/service/jni/com_android_server_connectivity_ClatCoordinator.cpp b/service/jni/com_android_server_connectivity_ClatCoordinator.cpp index c0082bbe3a..622fba8d0c 100644 --- a/service/jni/com_android_server_connectivity_ClatCoordinator.cpp +++ b/service/jni/com_android_server_connectivity_ClatCoordinator.cpp @@ -104,7 +104,7 @@ static void verifyClatPerms() { // First verify the clatd directory and binary, // since this is built into the apex file system image, // failures here are 99% likely to be build problems. - V(kClatdDir, S_IFDIR|0750, ROOT, SYSTEM, "system_file", DIR); + V(kClatdDir, S_IFDIR|0750, CLAT, SYSTEM, "system_file", DIR); V(kClatdBin, S_IFREG|S_ISUID|S_ISGID|0755, CLAT, CLAT, "clatd_exec", BIN); // Move on to verifying that the bpf programs and maps are as expected.