Merge "[RFCLAT#16] remove drop_root_and_caps" am: 95cbf3217f
Original change: https://android-review.googlesource.com/c/platform/external/android-clat/+/1949737
Change-Id: I4723fab329425a472b42a0ae8bb4179bdcf85a33
diff --git a/Android.bp b/Android.bp
index 47d22a1..7a8ba03 100644
--- a/Android.bp
+++ b/Android.bp
@@ -53,10 +53,6 @@
cc_binary {
name: "clatd",
defaults: ["clatd_defaults"],
- // TODO: remove once drop_root_and_caps() is removed.
- header_libs: [
- "libcutils_headers", // for AID_CLAT
- ],
srcs: [
":clatd_common",
"main.c"
diff --git a/clatd.c b/clatd.c
index f760fef..f72f431 100644
--- a/clatd.c
+++ b/clatd.c
@@ -39,8 +39,6 @@
#include <sys/capability.h>
#include <sys/uio.h>
-#include <private/android_filesystem_config.h> // For AID_CLAT.
-
#include "clatd.h"
#include "config.h"
#include "dump.h"
@@ -55,48 +53,6 @@
volatile sig_atomic_t running = 1;
-/* function: set_capability
- * set the permitted, effective and inheritable capabilities of the current
- * thread
- */
-void set_capability(uint64_t target_cap) {
- struct __user_cap_header_struct header = {
- .version = _LINUX_CAPABILITY_VERSION_3,
- .pid = 0 // 0 = change myself
- };
- struct __user_cap_data_struct cap[_LINUX_CAPABILITY_U32S_3] = {};
-
- cap[0].permitted = cap[0].effective = cap[0].inheritable = target_cap;
- cap[1].permitted = cap[1].effective = cap[1].inheritable = target_cap >> 32;
-
- if (capset(&header, cap) < 0) {
- logmsg(ANDROID_LOG_FATAL, "capset failed: %s", strerror(errno));
- exit(1);
- }
-}
-
-/* function: drop_root_and_caps
- * drops root privs and all capabilities
- */
-void drop_root_and_caps() {
- // see man setgroups: this drops all supplementary groups
- if (setgroups(0, NULL) < 0) {
- logmsg(ANDROID_LOG_FATAL, "setgroups failed: %s", strerror(errno));
- exit(1);
- }
-
- if (setresgid(AID_CLAT, AID_CLAT, AID_CLAT) < 0) {
- logmsg(ANDROID_LOG_FATAL, "setresgid failed: %s", strerror(errno));
- exit(1);
- }
- if (setresuid(AID_CLAT, AID_CLAT, AID_CLAT) < 0) {
- logmsg(ANDROID_LOG_FATAL, "setresuid failed: %s", strerror(errno));
- exit(1);
- }
-
- set_capability(0);
-}
-
int ipv6_address_changed(const char *interface) {
union anyip *interface_ip;
diff --git a/clatd.h b/clatd.h
index be3c9c1..87cdbcf 100644
--- a/clatd.h
+++ b/clatd.h
@@ -38,8 +38,6 @@
extern volatile sig_atomic_t running;
-void set_capability(uint64_t target_cap);
-void drop_root_and_caps();
int ipv6_address_changed(const char *interface);
void event_loop(struct tun_data *tunnel);
diff --git a/main.c b/main.c
index 3d1ff95..d9371da 100644
--- a/main.c
+++ b/main.c
@@ -152,9 +152,6 @@
uplink_interface, plat_prefix ? plat_prefix : "(none)", v4_addr ? v4_addr : "(none)",
v6_addr ? v6_addr : "(none)");
- // run under a regular user with no capabilities
- drop_root_and_caps();
-
// Loop until someone sends us a signal or brings down the tun interface.
if (signal(SIGTERM, stop_loop) == SIG_ERR) {
logmsg(ANDROID_LOG_FATAL, "sigterm handler failed: %s", strerror(errno));