commit 533e34376be49b00072f4518eec103cdf2918225
author David Brazdil <dbrazdil@google.com> Fri Oct 28 14:06:49 2022 +0100
committer David Brazdil <dbrazdil@google.com> Thu Nov 10 16:37:24 2022 +0000
tree b1899f23df8abbf48b7a836b071716ba1432b5f3
parent 36a58d96e6d7bc35cb0d0d6be1b3f9ee17d74e8a

Remove CAP_IPC_LOCK from crosvm, use CAP_SYS_RESOURCE on VS

Crosvm currently has a capability that allows it to mlock() unlimited
amounts of RAM, necessary for running protected VMs. This mechanims is
not compatible with switching to crosvm as a child process, so replace
it with setrlimit from virtualizationservice. The limit is set to
RLIM_INFINITY to preserve the original property.

Bug: 204298056
Bug: 245727626
Test: atest MicrodroidTestApp
Change-Id: Iec393f5c0548f7eac1ba162214b57350d8328637

apex/canned_fs_config

diff --git a/apex/canned_fs_config b/apex/canned_fs_config
index 1cf63b6..ce942d3 100644
--- a/apex/canned_fs_config
+++ b/apex/canned_fs_config
@@ -1 +1 @@
-/bin/crosvm 0 2000 0755 capabilities=0x4000
+/bin/virtualizationservice 0 2000 0755 capabilities=0x1000000  # CAP_SYS_RESOURCE