1 // Copyright (C) 2015 The Android Open Source Project 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // http://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 15 #include <sys/types.h> 16 #include <sys/capability.h> 17 #include <unistd.h> 18 19 #include <libminijail.h> 20 21 #include <android-base/logging.h> 22 23 gid_t groups[] = { 1001, 1002 }; 24 25 void log_resugid() { 26 uid_t ruid, euid, suid; 27 gid_t rgid, egid, sgid; 28 getresuid(&ruid, &euid, &suid); 29 getresgid(&rgid, &egid, &sgid); 30 31 LOG(INFO) << "ruid " << ruid << " euid " << euid << " suid " << suid; 32 LOG(INFO) << "rgid " << rgid << " egid " << egid << " sgid " << sgid; 33 34 int nsupp_groups = getgroups(0, NULL); 35 if (nsupp_groups < 0) { 36 PLOG(FATAL) << "getgroups(0)"; 37 } 38 if (nsupp_groups == 0) { 39 LOG(INFO) << "no supplemental groups"; 40 return; 41 } 42 43 gid_t *list = (gid_t*)calloc((size_t)nsupp_groups, sizeof(gid_t)); 44 nsupp_groups = getgroups(nsupp_groups, list); 45 if (nsupp_groups < 0) { 46 PLOG(FATAL) << "getgroups(nsupp_groups)"; 47 } 48 for (size_t i = 0; i < (size_t)nsupp_groups; i++) { 49 LOG(INFO) << "supp gid " << i + 1 << " " << list[i]; 50 } 51 free(list); 52 } 53 54 int main(void) { 55 log_resugid(); 56 minijail *j = minijail_new(); 57 minijail_change_user(j, "system"); 58 minijail_change_group(j, "system"); 59 minijail_set_supplementary_gids(j, sizeof(groups) / sizeof(groups[0]), groups); 60 // minijail_use_caps(j, CAP_TO_MASK(CAP_SETUID) | CAP_TO_MASK(CAP_SETGID)); 61 // minijail_use_seccomp_filter(j); 62 // minijail_log_seccomp_filter_failures(j); 63 // minijail_parse_seccomp_filters(j, "/data/filter.policy"); 64 minijail_enter(j); 65 log_resugid(); 66 minijail_destroy(j); 67 // minijail *j2 = minijail_new(); 68 // minijail_change_uid(j2, 5000); 69 // minijail_change_gid(j2, 5000); 70 // minijail_enter(j2); 71 // log_resugid(); 72 return 0; 73 } 74
