if try to find problem on userspace, i used linux 5.13rc6 on old android 7 cm14.1, not aosp android 11. http://git.osdn.net/view?p=android-x86/system-core.git;a=blob;f=init/service.cpp;h=a5334f447fc2fc34453d2f6a37523bedccadc690;hb=refs/heads/cm-14.1-x86#l457 457 if (!seclabel_.empty()) { 458 if (setexeccon(seclabel_.c_str()) < 0) { 459 ERROR("cannot setexeccon('%s'): %s\n", 460 seclabel_.c_str(), strerror(errno)); 461 _exit(127); 462 } 463 } 2021-06-15 6:50 GMT+08:00, Kees Cook <keescook@xxxxxxxxxxxx>: > On Tue, Jun 15, 2021 at 02:46:19AM +0800, youling 257 wrote: >> I test this patch cause "init: cannot setexeccon(u:r:ueventd:s0) >> operation not permitted. >> init ctrl_write_limited. > > Thanks for testing! > > This appears to come from here: > https://github.com/aosp-mirror/platform_system_core/blob/master/init/service.cpp#L242 > > > In setexeccon(), I see (pid=0, attr="exec"): > > fd = openattr(pid, attr, O_RDWR | O_CLOEXEC); > ... > ret = write(fd, context2, strlen(context2) + 1); > ... > close(fd); > > > and openattr() is doing: > ... > rc = asprintf(&path, "/proc/thread-self/attr/%s", attr); > if (rc < 0) > return -1; > fd = open(path, flags | O_CLOEXEC); > ... > > I'm not sure how the above could fail. (mm_access() always allows > introspection...) > > The only way I can understand the check failing is if a process did: > > open, exec, write > > But setexeccon() is not doing anything between the open and the write... > > I will keep looking... > > -Kees > > -- > Kees Cook >
