tree a16b1e86f7b929d38c31ef5306f7c9f63fb63fd2
parent ae7c8db0495fc8f83ed91aba9c610a3f7fb03e67
author Martijn Coenen <maco@google.com> 1709208185 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> 1716265707 +0000

Verify UID of incoming Zygote connections.

Only the system UID should be allowed to connect to the Zygote. While
for generic Zygotes this is also covered by SELinux policy, this is not
true for App Zygotes: the preload code running in an app zygote could
connect to another app zygote socket, if it had access to its (random)
socket address.

On the Java layer, simply check the UID when the connection is made. In
the native layer, this check was already present, but it actually didn't
work in the case where we receive a new incoming connection on the
socket, and receive a 'non-fork' command: in that case, we will simply
exit the native loop, and let the Java layer handle the command, without
any further UID checking.

Modified the native logic to drop new connections with a mismatching
UID, and to keep serving the existing connection (if it was still
there).

Bug: 319081336
Test: manual
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:2ffc7cb220e4220b7e108c4043a3f0f2a85b6508)
Merged-In: I3f85a17107849e2cd3e82d6ef15c90b9e2f26532
Change-Id: I3f85a17107849e2cd3e82d6ef15c90b9e2f26532