commit 8b23e2398770637edad0cee1d1d7b9153cfa8d71
author Nikita Ioffe <ioffe@google.com> Tue Jan 03 13:55:07 2023 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Tue Jan 03 13:55:07 2023 +0000
tree d9ecb17885834e03f3997b896a630277f315653a
parent 93c9dbe115bc6b162d9eb708de1c847eb9f73be4
parent 4af861b63176e70588335acad66e066d80bfe487

Merge "vold: explicitly specify capabilities" am: 4af861b631

Original change: https://android-review.googlesource.com/c/platform/system/vold/+/2371428

Change-Id: Iafe087f3d1dd180069621cc9539803a4dda1bdda
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

vold.rc

diff --git a/vold.rc b/vold.rc
index 9474a1e..466e2db 100644
--- a/vold.rc
+++ b/vold.rc
@@ -7,3 +7,5 @@
     shutdown critical
     group root reserved_disk
     reboot_on_failure reboot,vold-failed
+    # CAP_SETGID, CAP_SETUID, CAP_SYS_RESOURCE are not used by the vold itself, but instead are used by the /system/bin/sdcard that vold execs
+    capabilities CHOWN DAC_OVERRIDE DAC_READ_SEARCH FOWNER FSETID KILL MKNOD NET_ADMIN SYS_ADMIN SYS_CHROOT SYS_NICE SYS_PTRACE BLOCK_SUSPEND SETGID SETUID SYS_RESOURCE