tree bfaec9df1a54001f01648ab836cfb6082cf0e6af
parent 2ce30230560c8d0d3bc789c123080dbbc6fc09c4
author Nikita Ioffe <ioffe@google.com> 1713487129 +0000
committer Nikita Ioffe <ioffe@google.com> 1713487580 +0000

adbd: Keep CAP_SYS_NICE when dropping capabitilies

Starting with Android V, processes that want to launch a Microdroid VM
are required to have CAP_SYS_NICE in their bounding set. For apps this
is achieved by setting special AID_VIRTUALMACHINE  gid for apps that
have android.permission.MANAGE_VIRTUAL_MACHINE permission.
When zygote starts, it will add CAP_SYS_NICE to the bounding set if it
sees the AID_VIRTUALMACHINE gid.

However, since VMs started from adb shell don't go through zygote, this
approach doesn't work for them. Instead, we keep the CAP_SYS_NICE in the
adbd's bounding set.

Bug: 334980629
Test: adb shell /apex/com.android.virt/bin/vm run-microdroid
Test: atest MicrodroidHostTestCases
Change-Id: I99b01f6f53dce76d53a8b265ad571d523e19a792