tree caa3cf37875213d630945fc931a09141172c3ca2
parent 5e8f4642b308241bc520b52d469e46f7634dfd6e
author Nick Kralevich <nnk@google.com> 1487199883 -0800
committer Teemu Hukkanen <teemu@fairphone.com> 1499782738 +0200

system_server: replace sys_resource with sys_ptrace

Commit https://android.googlesource.com/kernel/common/+/f0ce0eee added
CAP_SYS_RESOURCE as a capability check which would allow access to
sensitive /proc/PID files. However, in an SELinux based world, allowing
this access causes CAP_SYS_RESOURCE to duplicate what CAP_SYS_PTRACE
(without :process ptrace) already provides.

Use CAP_SYS_PTRACE instead of CAP_SYS_RESOURCE.

FPIIM-1252
FPIIM-1248

Test: Device boots, functionality remains identical, no sys_resource
denials from system_server.
Bug: 34951864
Bug: 38496951
Change-Id: I04d745b436ad75ee1ebecf0a61c6891858022e34
(cherry picked from commit 448669540c0b7c22ee8b8293217818f8f92238b6)
(cherry picked from commit c15810c527ffa6953108f68365cf2df9e0868096)

(cherry picked from commit 2f1af52e4e57bf8eacaccb8db6d6a27003a0b104)