1 // Copyright (C) 2015 The Android Open Source Project
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include <sys/types.h>
16 #include <sys/capability.h>
17 #include <unistd.h>
18
19 #include <libminijail.h>
20
21 #include <android-base/logging.h>
22
23 gid_t groups[] = { 1001, 1002 };
24
log_resugid()25 void log_resugid() {
26 uid_t ruid, euid, suid;
27 gid_t rgid, egid, sgid;
28 getresuid(&ruid, &euid, &suid);
29 getresgid(&rgid, &egid, &sgid);
30
31 LOG(INFO) << "ruid " << ruid << " euid " << euid << " suid " << suid;
32 LOG(INFO) << "rgid " << rgid << " egid " << egid << " sgid " << sgid;
33
34 int nsupp_groups = getgroups(0, NULL);
35 if (nsupp_groups < 0) {
36 PLOG(FATAL) << "getgroups(0)";
37 }
38 if (nsupp_groups == 0) {
39 LOG(INFO) << "no supplemental groups";
40 return;
41 }
42
43 gid_t *list = (gid_t*)calloc((size_t)nsupp_groups, sizeof(gid_t));
44 nsupp_groups = getgroups(nsupp_groups, list);
45 if (nsupp_groups < 0) {
46 PLOG(FATAL) << "getgroups(nsupp_groups)";
47 }
48 for (size_t i = 0; i < (size_t)nsupp_groups; i++) {
49 LOG(INFO) << "supp gid " << i + 1 << " " << list[i];
50 }
51 free(list);
52 }
53
main(void)54 int main(void) {
55 log_resugid();
56 minijail *j = minijail_new();
57 minijail_change_user(j, "system");
58 minijail_change_group(j, "system");
59 minijail_set_supplementary_gids(j, sizeof(groups) / sizeof(groups[0]), groups);
60 // minijail_use_caps(j, CAP_TO_MASK(CAP_SETUID) | CAP_TO_MASK(CAP_SETGID));
61 // minijail_use_seccomp_filter(j);
62 // minijail_log_seccomp_filter_failures(j);
63 // minijail_parse_seccomp_filters(j, "/data/filter.policy");
64 minijail_enter(j);
65 log_resugid();
66 minijail_destroy(j);
67 // minijail *j2 = minijail_new();
68 // minijail_change_uid(j2, 5000);
69 // minijail_change_gid(j2, 5000);
70 // minijail_enter(j2);
71 // log_resugid();
72 return 0;
73 }
74