[RFCLAT#16] remove drop_root_and_caps
gid and uid of clatd binary has been set by apex
canned_fs_config. don't need drop_root_and_caps()
anymore.
Bug: 212345928
Test: manual test
1. Connect to ipv6-only wifi.
2. Make IPv4 traffic.
$ ping 8.8.8.8
Check uid and uid is AID_CLAT(1029) in process status:
$ adb shell ps | grep clat
clat 9743 740 10826108 2264 0 0 S clatd-wlan0
$ adb shell cat /proc/9743/status | egrep -i '^(Uid|Gid|Groups):|^Cap'
Uid: 0 1029 1029 1029
Gid: 0 1029 1029 1029
Groups: 3005
CapInh: 00000000000074ef
CapPrm: 00000000000074ef
CapEff: 0000000000000000
CapBnd: 00000000000074ef
CapAmb: 0000000000000000
Change-Id: I8f7a9c50368d5c789621ea39b39d9242adfb0fcc
diff --git a/Android.bp b/Android.bp
index 70b525b..38d45a0 100644
--- a/Android.bp
+++ b/Android.bp
@@ -53,10 +53,6 @@
cc_binary {
name: "clatd",
defaults: ["clatd_defaults"],
- // TODO: remove once drop_root_and_caps() is removed.
- header_libs: [
- "libcutils_headers", // for AID_CLAT
- ],
srcs: [
":clatd_common",
"main.c"
diff --git a/clatd.c b/clatd.c
index f760fef..f72f431 100644
--- a/clatd.c
+++ b/clatd.c
@@ -39,8 +39,6 @@
#include <sys/capability.h>
#include <sys/uio.h>
-#include <private/android_filesystem_config.h> // For AID_CLAT.
-
#include "clatd.h"
#include "config.h"
#include "dump.h"
@@ -55,48 +53,6 @@
volatile sig_atomic_t running = 1;
-/* function: set_capability
- * set the permitted, effective and inheritable capabilities of the current
- * thread
- */
-void set_capability(uint64_t target_cap) {
- struct __user_cap_header_struct header = {
- .version = _LINUX_CAPABILITY_VERSION_3,
- .pid = 0 // 0 = change myself
- };
- struct __user_cap_data_struct cap[_LINUX_CAPABILITY_U32S_3] = {};
-
- cap[0].permitted = cap[0].effective = cap[0].inheritable = target_cap;
- cap[1].permitted = cap[1].effective = cap[1].inheritable = target_cap >> 32;
-
- if (capset(&header, cap) < 0) {
- logmsg(ANDROID_LOG_FATAL, "capset failed: %s", strerror(errno));
- exit(1);
- }
-}
-
-/* function: drop_root_and_caps
- * drops root privs and all capabilities
- */
-void drop_root_and_caps() {
- // see man setgroups: this drops all supplementary groups
- if (setgroups(0, NULL) < 0) {
- logmsg(ANDROID_LOG_FATAL, "setgroups failed: %s", strerror(errno));
- exit(1);
- }
-
- if (setresgid(AID_CLAT, AID_CLAT, AID_CLAT) < 0) {
- logmsg(ANDROID_LOG_FATAL, "setresgid failed: %s", strerror(errno));
- exit(1);
- }
- if (setresuid(AID_CLAT, AID_CLAT, AID_CLAT) < 0) {
- logmsg(ANDROID_LOG_FATAL, "setresuid failed: %s", strerror(errno));
- exit(1);
- }
-
- set_capability(0);
-}
-
int ipv6_address_changed(const char *interface) {
union anyip *interface_ip;
diff --git a/clatd.h b/clatd.h
index be3c9c1..87cdbcf 100644
--- a/clatd.h
+++ b/clatd.h
@@ -38,8 +38,6 @@
extern volatile sig_atomic_t running;
-void set_capability(uint64_t target_cap);
-void drop_root_and_caps();
int ipv6_address_changed(const char *interface);
void event_loop(struct tun_data *tunnel);
diff --git a/main.c b/main.c
index 3d1ff95..d9371da 100644
--- a/main.c
+++ b/main.c
@@ -152,9 +152,6 @@
uplink_interface, plat_prefix ? plat_prefix : "(none)", v4_addr ? v4_addr : "(none)",
v6_addr ? v6_addr : "(none)");
- // run under a regular user with no capabilities
- drop_root_and_caps();
-
// Loop until someone sends us a signal or brings down the tun interface.
if (signal(SIGTERM, stop_loop) == SIG_ERR) {
logmsg(ANDROID_LOG_FATAL, "sigterm handler failed: %s", strerror(errno));