On Tue, Jun 15, 2021 at 02:46:19AM +0800, youling 257 wrote: > I test this patch cause "init: cannot setexeccon(u:r:ueventd:s0) > operation not permitted. > init ctrl_write_limited. Thanks for testing! This appears to come from here: https://github.com/aosp-mirror/platform_system_core/blob/master/init/service.cpp#L242 In setexeccon(), I see (pid=0, attr="exec"): fd = openattr(pid, attr, O_RDWR | O_CLOEXEC); ... ret = write(fd, context2, strlen(context2) + 1); ... close(fd); and openattr() is doing: ... rc = asprintf(&path, "/proc/thread-self/attr/%s", attr); if (rc < 0) return -1; fd = open(path, flags | O_CLOEXEC); ... I'm not sure how the above could fail. (mm_access() always allows introspection...) The only way I can understand the check failing is if a process did: open, exec, write But setexeccon() is not doing anything between the open and the write... I will keep looking... -Kees -- Kees Cook
