1 // Copyright (C) 2015 The Android Open Source Project
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include <sys/types.h>
16 #include <sys/capability.h>
17 #include <unistd.h>
18
19 #include <libminijail.h>
20
21 #include <android-base/logging.h>
22 #include <android-base/macros.h>
23
24 gid_t groups[] = { 1001, 1002 };
25
log_resugid()26 void log_resugid() {
27 uid_t ruid, euid, suid;
28 gid_t rgid, egid, sgid;
29 getresuid(&ruid, &euid, &suid);
30 getresgid(&rgid, &egid, &sgid);
31
32 LOG(INFO) << "ruid " << ruid << " euid " << euid << " suid " << suid;
33 LOG(INFO) << "rgid " << rgid << " egid " << egid << " sgid " << sgid;
34
35 int nsupp_groups = getgroups(0, NULL);
36 if (nsupp_groups < 0) {
37 PLOG(FATAL) << "getgroups(0)";
38 }
39 if (nsupp_groups == 0) {
40 LOG(INFO) << "no supplemental groups";
41 return;
42 }
43
44 gid_t *list = (gid_t*)calloc((size_t)nsupp_groups, sizeof(gid_t));
45 nsupp_groups = getgroups(nsupp_groups, list);
46 if (nsupp_groups < 0) {
47 PLOG(FATAL) << "getgroups(nsupp_groups)";
48 }
49 for (size_t i = 0; i < (size_t)nsupp_groups; i++) {
50 LOG(INFO) << "supp gid " << i + 1 << " " << list[i];
51 }
52 free(list);
53 }
54
main(void)55 int main(void) {
56 log_resugid();
57 minijail *j = minijail_new();
58 minijail_change_user(j, "system");
59 minijail_change_group(j, "system");
60 minijail_set_supplementary_gids(j, arraysize(groups), groups);
61 // minijail_use_caps(j, CAP_TO_MASK(CAP_SETUID) | CAP_TO_MASK(CAP_SETGID));
62 // minijail_use_seccomp_filter(j);
63 // minijail_log_seccomp_filter_failures(j);
64 // minijail_parse_seccomp_filters(j, "/data/filter.policy");
65 minijail_enter(j);
66 log_resugid();
67 minijail_destroy(j);
68 // minijail *j2 = minijail_new();
69 // minijail_change_uid(j2, 5000);
70 // minijail_change_gid(j2, 5000);
71 // minijail_enter(j2);
72 // log_resugid();
73 return 0;
74 }
75