commit ec0a2c1023801b875fed9eb514eb29207d657e3f
author Luis Hector Chavez <lhchavez@google.com> Thu Jun 29 20:29:57 2017 -0700
committer Luis Hector Chavez <lhchavez@google.com> Tue Jul 11 11:15:41 2017 -0700
tree a05d6063daebfb6aefccd704faee7b32f011d879
parent fe5fb8ea506c1a198d690e712d848d149a0addd0

minijail: Allow skipping setting securebits when restricting caps

This change allows the user to optionally skip setting a subset of the
securebits that are automatically set when restricting caps.

Bug: 63069223
Test: $ gcc -static -xc -o securebits - << EOF
      #include <stdio.h>
      #include <sys/prctl.h>

      int main()
      {
              printf("%x\n", prctl(PR_GET_SECUREBITS));
      }
      EOF
      $ sudo ./minijail0 -c 1fffffffff --ambient ./securebits
      2f
      $ sudo ./minijail0 -c 1fffffffff --ambient -B 2f ./securebits
      0

Change-Id: Ie247302bbbb35f04caa2066541a8c175f6c94976