Use init to set capabilities
With the minijail code the groups set in the rild.rc are lost when
switching user. The reason for starting as root was to be able to set
capabilities, since that code was written init has gain the ability
to set capabilities at service declaration so use that instead so we
dont even have to start as root.
Test: cat /proc/`pgrep rild`/status
Before change:
Name: rild
...
Uid: 1001 1001 1001 1001
Gid: 1001 1001 1001 1001
...
Groups:
...
CapInh: 0000001000003000
CapPrm: 0000001000003000
CapEff: 0000001000003000
CapBnd: 0000001000003000
CapAmb: 0000000000000000
...
After change:
Name: rild
...
Uid: 1001 1001 1001 1001
Gid: 1001 1001 1001 1001
...
Groups: 1005 1007 2001 3003 3009 3010 9998
...
CapInh: 0000001000003000
CapPrm: 0000001000003000
CapEff: 0000001000003000
CapBnd: 0000001000003000
CapAmb: 0000001000003000
...
Bug: 33443755
Change-Id: Iac8aea697ac24417edecb4c0061e56821d3dc59e
3 files changed