Merge "Fix comment to match code" into main am: 9df1f6122f
Original change: https://android-review.googlesource.com/c/platform/packages/modules/Virtualization/+/2953857
Change-Id: I0f38339ebb30628bc2e66bc20cefe5312f6c3697
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/compos/apex/composd.rc b/compos/apex/composd.rc
index aa4b575..55f3737 100644
--- a/compos/apex/composd.rc
+++ b/compos/apex/composd.rc
@@ -19,10 +19,7 @@
interface aidl android.system.composd
disabled
oneshot
- # Explicitly specify empty capabilities, otherwise composd will inherit all
- # the capabilities from init.
- # Note: whether a process can use capabilities is controlled by SELinux, so
- # inheriting all the capabilities from init is not a security issue.
- # However, for defense-in-depth and just for the sake of bookkeeping it's
- # better to explicitly state that composd doesn't need any capabilities.
+ # We need SYS_NICE in order to allow the crosvm child process to use it.
+ # (b/322197421). composd itself never uses it (and isn't allowed to by
+ # SELinux).
capabilities SYS_NICE