Merge "Use _exit for profile copy dexopt command" into oc-dr1-dev
am: de65cb8e1f
Change-Id: I1d53221347533d9d7b393141b4262b66cee53134
diff --git a/cmds/installd/dexopt.cpp b/cmds/installd/dexopt.cpp
index 4ecbf92..baa05d0 100644
--- a/cmds/installd/dexopt.cpp
+++ b/cmds/installd/dexopt.cpp
@@ -863,6 +863,8 @@
return false;
}
+ // As a security measure we want to write the profile information with the reduced capabilities
+ // of the package user id. So we fork and drop capabilities in the child.
pid_t pid = fork();
if (pid == 0) {
/* child -- drop privileges before continuing */
@@ -900,7 +902,9 @@
if (flock(out_fd.get(), LOCK_UN) != 0) {
PLOG(WARNING) << "Error unlocking profile " << data_profile_location;
}
- exit(0);
+ // Use _exit since we don't want to run the global destructors in the child.
+ // b/62597429
+ _exit(0);
}
/* parent */
int return_code = wait_child(pid);