minijail: Avoid setting PR_SET_KEEPCAPS if that bit is locked
This change avoids setting PR_SET_KEEPCAPS if the bit is locked and we
are using ambient capabilities. This allows using minijail from an
already-minijailed process.
Bug: 112030238
Test: make tests
Change-Id: Iafd5d2409dcb526048b84edfc8b8f29f30d0dd4c
diff --git a/system.c b/system.c
index 434980a..9852be7 100644
--- a/system.c
+++ b/system.c
@@ -44,6 +44,14 @@
_Static_assert(SECURE_ALL_BITS == 0x55, "SECURE_ALL_BITS == 0x55.");
#endif
+int secure_keep_caps_locked(void)
+{
+ int bits = prctl(PR_GET_SECUREBITS);
+ if (bits < 0)
+ return 0;
+ return bits & SECBIT_KEEP_CAPS_LOCKED;
+}
+
int secure_noroot_set_and_locked(uint64_t mask)
{
return (mask & (SECBIT_NOROOT | SECBIT_NOROOT_LOCKED)) ==