openharmony/startup_appspawn
1
0
Fork 0
mirror of https://github.com/openharmony/startup_appspawn.git synced 2026-08-25 14:29:39 -04:00
Code Issues Packages Projects Releases Wiki Activity

!2458 merge master into master

Browse Source 
Fix:Bind the capability of fowner with APPSPAWN_SUPPORT_NOSHAREFS, and remove the capability of dac_read_seach

Created-by: wangfenging
Commit-by: wangfenging
Merged-by: openharmony_ci
Description: ### 相关的Issue
https://gitcode.com/openharmony/startup_appspawn/issues/1737
### 原因（目的、解决的问题等）
将fowner的capability能力与APPSPAWN_SUPPORT_NOSHAREFS绑定在一起，同时删除dac_read_seach的capability
### 描述（做了什么，变更了什么）
将fowner的capability能力与APPSPAWN_SUPPORT_NOSHAREFS绑定在一起，同时删除dac_read_seach的capability
### 测试用例（新增、改动、可能影响的功能）



See merge request: openharmony/startup_appspawn!2458
This commit is contained in:
openharmony_ci
2025-11-21 17:20:41 +08:00
parent b8dd307aea 0c68ce1480
commit 2ef466ec82
1 changed files with 2 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/common/appspawn_common.c
+2 -7
View File
@@ -130,7 +130,7 @@ static int SetAmbientCapability(int cap)
static int SetAmbientCapabilities(const AppSpawningCtx *property)
{
const int caps[] = {CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH, CAP_FOWNER};
const int caps[] = {CAP_DAC_OVERRIDE, CAP_FOWNER};
size_t capCount = sizeof(caps) / sizeof(caps[0]);
for (size_t i = 0; i < capCount; ++i) {
if (SetAmbientCapability(caps[i]) != 0) {
@@ -165,16 +165,11 @@ APPSPAWN_STATIC int SetCapabilities(const AppSpawnMgr *content, const AppSpawnin
#ifdef APPSPAWN_SUPPORT_NOSHAREFS
if (!CheckAppMsgFlagsSet(property, APP_FLAGS_ISOLATED_SANDBOX_TYPE) &&
(IsAppSpawnMode(content) || IsNativeSpawnMode(content))) {
baseCaps = CAP_TO_MASK(CAP_DAC_OVERRIDE) | CAP_TO_MASK(CAP_DAC_READ_SEARCH) |
CAP_TO_MASK(CAP_FOWNER);
baseCaps = CAP_TO_MASK(CAP_DAC_OVERRIDE) | CAP_TO_MASK(CAP_FOWNER);
if (CheckAppMsgFlagsSet(property, APP_FLAGS_CUSTOM_SANDBOX)) {
baseCaps |= CAP_TO_MASK(CAP_KILL);
}
}
#else
if (IsAppSpawnMode(content)) {
baseCaps = CheckAppMsgFlagsSet(property, APP_FLAGS_SET_CAPS_FOWNER) ? (1 << CAP_FOWNER) : 0;
}
#endif
const uint64_t inheriTable = baseCaps;
const uint64_t permitted = baseCaps;