Change crash-service as non root.

- crash_worker / crash_worker / System permissions needed.
- This will require following capabilities.

setcap cap_dac_override,cap_kill,cap_sys_ptrace=ei /bin/crash-manager
   cap_dac_override - create directory
   cap_kill - send signals to processes
   cap_sys_ptrace - read /proc/<pid>/ files

setcap cap_dac_override,cap_kill,cap_sys_ptrace=ei /bin/crash-service
   cap_dac_override - create directory
   cap_kill - send signals to processes
   cap_sys_ptrace - read /proc/<pid>/ files

setcap cap_dac_read_search,cap_sys_ptrace=ei /sbin/minicoredumper
   cap_dac_read_search - access to read any binary file
   cap_sys_ptrace - read /proc/<pid>/ files

setcap cap_syslog=ei /bin/dlogutil
    cap_syslog is needed because android logger returns incorrect values without this capability (this is bug in the kernel driver).

setcap cap_dac_override=ei /bin/buxton2ctl
    buxton2ctl needs access to write to /run/buxton2/ directory

setcap cap_dac_override,cap_kill,cap_sys_ptrace+ei /bin/livedumper
   cap_dac_override  - create livedump/ directory to
   cap_sys_ptrace - read /proc/<pid>/ files

setcap cap_dac_read_search,cap_sys_ptrace=ei /usr/libexec/crash-stack
   reads /proc/<pid>/{maps, task, status}, and all binary files

setcap cap_dac_read_search,cap_sys_ptrace=ei /bin/memps
   reads files from /proc/ and /sys/

setcap cap_sys_ptrace=ei /bin/top
   read /proc/<pid>/files

setcap cap_dac_read_search=ei /bin/df
   counting of disk space usage (eg /opt/usr/home/owner/media)

setcap cap_dac_read_search=ei /bin/du

Change-Id: I0073cf19f717855941b317fa1ec6b6af5793d869

diff --git a/config/group_id_setting b/config/group_id_setting
index f588b089bf740c4d7e09dfb8b3a25b780eb70dc2..aeb8a84610adebafc7632cecd3d4e45ffea23356 100755 (executable)
--- a/config/group_id_setting
+++ b/config/group_id_setting
@@ -25,6 +25,7 @@ PATH=/bin:/usr/bin:/sbin:/usr/sbin
 /usr/sbin/groupadd -g 1001 broadcasting
 /usr/sbin/groupadd -g 1026 testing
 /usr/sbin/groupadd -g 1051 system_share
+/usr/sbin/groupadd -g 2003 crash_worker
 
 /usr/sbin/groupadd -g 10012 priv_use_ir
 /usr/sbin/groupadd -g 10013 priv_tee_client
@@ -54,6 +55,7 @@ PATH=/bin:/usr/bin:/sbin:/usr/sbin
 /usr/sbin/useradd application -M -u 951 -g 951 -d /var/lib/empty -s /sbin/nologin -c "application"
 /usr/sbin/useradd broadcasting -M -u 1001 -g 1001 -d /var/lib/empty -s /sbin/nologin -c "broadcasting"
 /usr/sbin/useradd testing -M -u 1026 -g 1026 -d /var/lib/empty -s /sbin/nologin -c "testing"
+/usr/sbin/useradd crash_worker -M -u 2003 -g 2003 -d /var/lib/empty -s /sbin/nologin -c "crash worker"
 
 /usr/sbin/usermod -aG system_share system_fw
 /usr/sbin/usermod -aG system_share web_fw
@@ -89,4 +91,7 @@ PATH=/bin:/usr/bin:/sbin:/usr/sbin
 /usr/sbin/usermod -aG video multimedia_fw
 /usr/sbin/usermod -aG disk telephony
 /usr/sbin/usermod -aG display application
+/usr/sbin/usermod -aG systemd-journal crash_worker
+/usr/sbin/usermod -aG log crash_worker
+/usr/sbin/usermod -aG system_share crash_worker
 

diff --git a/config/set_capability b/config/set_capability
index 5907e40e0b2ea135cd9b0ba82622a716eec6d02f..df853d8891b92e6c8617abdd405247d365621af8 100755 (executable)
--- a/config/set_capability
+++ b/config/set_capability
@@ -514,7 +514,6 @@ fi
 # Owner                 Jaekuk Lee(juku1999@samsung.com)
 # Date                  July 4, 2017
 # Required              cap_sys_admin, cap_setgid
-# cap_sys_admin                to mount ( TODO : need to be checked) => removed as it is not needed.
 # cap_setgid           to change process gid
 # cap_sys_admin                to split mount namespace
 
@@ -591,7 +590,7 @@ fi
 # Owner                 Hyotaek Shim(hyotaek.shim@samsung.com)
 # Date                  Dec 22, 2017
 # Required              cap_syslog
-# cap_sys_log          to use syslog()
+# cap_syslog           to use syslog()
 
 if [ -e "/usr/bin/dlog_logger" ]
 then /usr/sbin/setcap cap_syslog=ei /usr/bin/dlog_logger
@@ -676,6 +675,107 @@ if [ -e "/usr/bin/ua-manager" ]
 then /usr/sbin/setcap cap_net_raw,cap_sys_rawio=ei /usr/bin/ua-manager
 fi
 
+# Package               platform/core/system/crash-worker
+# Date                  Nov 14, 2019
+# Required              cap_dac_override,cap_kill,cap_sys_ptrace
+# cap_dac_override     To create directory
+# cap_kill             To send signals to processes
+# cap_sys_ptrace       To read /proc/<pid>/
+
+if [ -e "/usr/bin/crash-manager" ]
+then /usr/sbin/setcap cap_dac_override,cap_kill,cap_sys_ptrace=ei /usr/bin/crash-manager
+fi
+
+if [ -e "/usr/bin/crash-service" ]
+then /usr/sbin/setcap cap_dac_override,cap_kill,cap_sys_ptrace=ei /usr/bin/crash-service
+fi
+
+# Package               platform/upstream/minicoredumper
+# Date                  Nov 14, 2019
+# Required              cap_dac_read_search,cap_sys_ptrace
+# cap_dac_read_search  To read any binary file
+# cap_sys_ptrace       To read /proc/<pid>/
+
+if [ -e "/usr/sbin/minicoredumper" ]
+then /usr/sbin/setcap cap_dac_read_search,cap_sys_ptrace=ei /usr/sbin/minicoredumper
+fi
+
+# Package               platform/core/system/dlog
+# Date                  Nov 14, 2019
+# Required              cap_syslog
+# cap_syslog           Android logger returns incorrect values without this capability (check : this is bug in the kernel driver).
+
+if [ -e "/usr/bin/dlogutil" ]
+then /usr/sbin/setcap cap_syslog=ei /usr/bin/dlogutil
+fi
+
+# Package               platform/core/system/buxton2
+# Date                  Nov 14, 2019
+# Required              cap_dac_override
+# cap_dac_override     To write in /run/buxton2/ and /etc/buxton2 directory
+
+if [ -e "/usr/bin/buxton2ctl" ]
+then /usr/sbin/setcap cap_dac_override=ei /usr/bin/buxton2ctl
+fi
+
+# Package               platform/core/system/crash-worker
+# Date                  Nov 14, 2019
+# Required              cap_dac_read_search
+# cap_dac_override     To create livedump directory
+# cap_sys_ptrace       To read /proc/[pid]
+
+if [ -e "/usr/bin/livedumper" ]
+then /usr/sbin/setcap cap_dac_override,cap_sys_ptrace=ei /usr/bin/livedumper
+fi
+
+# Package               platform/core/system/crash-worker
+# Date                  Nov 14, 2019
+# Required              cap_dac_read_search,cap_sys_ptrace
+# cap_dac_read_search  To read /proc/[pid]/{maps, task, status}
+# cap_sys_ptrace       To read /proc/[pid]/{maps, task, status}
+
+if [ -e "/usr/libexec/crash-stack" ]
+then /usr/sbin/setcap cap_dac_read_search,cap_sys_ptrace=ei /usr/libexec/crash-stack
+fi
+
+# Package               platform/core/system/memps
+# Date                  Nov 14, 2019
+# Required              cap_dac_read_search,cap_sys_ptrace
+# cap_dac_read_search  To read files from /proc/ and /sys/
+# cap_sys_ptrace       To read files from /proc/ and /sys/
+
+if [ -e "/usr/bin/memps" ]
+then /usr/sbin/setcap cap_dac_read_search,cap_sys_ptrace=ei /usr/bin/memps
+fi
+
+# Package               platform/upstream/procps-ng
+# Date                  Nov 14, 2019
+# Required              cap_sys_ptrace
+# cap_sys_ptrace       To read files from /proc/
+
+if [ -e "/usr/bin/top" ]
+then /usr/sbin/setcap cap_sys_ptrace=ei /usr/bin/top
+fi
+
+# Package               product/upstream/coreutils
+# Date                  Nov 14, 2019
+# Required              cap_sys_ptrace
+# cap_dac_read_search  counting of disk space usage (eg /opt/usr/home/owner)
+
+if [ -e "/usr/bin/df" ]
+then /usr/sbin/setcap cap_dac_read_search=ei /usr/bin/df
+fi
+
+# Package               product/upstream/coreutils
+# Date                  Nov 14, 2019
+# Required              cap_sys_ptrace
+# cap_dac_read_search  counting of disk space usage (eg /opt/usr/home/owner)
+
+if [ -e "/usr/bin/du" ]
+then /usr/sbin/setcap cap_dac_read_search=ei /usr/bin/du
+fi
+
+
 # TODO: MOVE TO OTHER SCRIPT OR REMOVE
 # Requested by sooyeon.kim@samsung.com (.voice) and dalton.lee@samsung.com (.multiassistant)
 dir_list=(".voice" ".multiassistant")

diff --git a/test/new_service_test/emulator/mobile/systemd_service.list b/test/new_service_test/emulator/mobile/systemd_service.list
index 089806ab6c7ca5cb3944eaf37a9b3a67ef378756..7db2b716de5bd14d56043ec50f54dfbaa4b3d356 100755 (executable)
--- a/test/new_service_test/emulator/mobile/systemd_service.list
+++ b/test/new_service_test/emulator/mobile/systemd_service.list
@@ -42,7 +42,7 @@ console-getty.service;root;root;System;
 console-shell.service;root;root;System;
 container-getty@.service;root;root;System;
 contextd.service;service_fw;service_fw;System;
-crash-service.service;root;root;System;
+crash-service.service;crash_worker;crash_worker;System;
 csr.service;security_fw;security_fw;System;
 cynara.service;cynara;cynara;System;
 data-provider-master.service;app_fw;app_fw;System;

diff --git a/test/new_service_test/emulator/tv/systemd_service.list b/test/new_service_test/emulator/tv/systemd_service.list
index cd9b6414a4d7d977da21b1bf3f4b0bed8ee982cd..f8ceda8717fc31b15b5dd6fad310098077a90d3b 100755 (executable)
--- a/test/new_service_test/emulator/tv/systemd_service.list
+++ b/test/new_service_test/emulator/tv/systemd_service.list
@@ -32,7 +32,7 @@ connman.service;network_fw;network_fw;System;
 console-getty.service;root;root;System;
 console-shell.service;root;root;System;
 container-getty@.service;root;root;System;
-crash-service.service;root;root;System;
+crash-service.service;crash_worker;crash_worker;System;
 csr.service;security_fw;security_fw;System;
 cynara.service;cynara;cynara;System;
 data-provider-master.service;app_fw;app_fw;System;

diff --git a/test/new_service_test/emulator/wearable/systemd_service.list b/test/new_service_test/emulator/wearable/systemd_service.list
index 25718c4e4aa1ad1cf6988a594cdd917cac7492db..9024aec965aec04afacc130431b9e7238a5c75ff 100755 (executable)
--- a/test/new_service_test/emulator/wearable/systemd_service.list
+++ b/test/new_service_test/emulator/wearable/systemd_service.list
@@ -35,7 +35,7 @@ console-getty.service;root;root;System;
 console-shell.service;root;root;System;
 container-getty@.service;root;root;System;
 contextd.service;service_fw;service_fw;System;
-crash-service.service;root;root;System;
+crash-service.service;crash_worker;crash_worker;System;
 csr.service;security_fw;security_fw;System;
 cynara.service;cynara;cynara;System;
 data-provider-master.service;app_fw;app_fw;System;

diff --git a/test/new_service_test/target/mobile/systemd_service.list b/test/new_service_test/target/mobile/systemd_service.list
index 5f14a03d0435265d9a5d5b75ded3f181c943cf13..129ef6936368a08120de9fdfa13818d4fda72685 100755 (executable)
--- a/test/new_service_test/target/mobile/systemd_service.list
+++ b/test/new_service_test/target/mobile/systemd_service.list
@@ -45,7 +45,7 @@ console-getty.service;root;root;System;
 console-shell.service;root;root;System;
 container-getty@.service;root;root;System;
 contextd.service;service_fw;service_fw;System;
-crash-service.service;root;root;System;
+crash-service.service;crash_worker;crash_worker;System;
 csr.service;security_fw;security_fw;System;
 cynara.service;cynara;cynara;System;
 data-provider-master.service;app_fw;app_fw;System;

diff --git a/test/new_service_test/target/tv/systemd_service.list b/test/new_service_test/target/tv/systemd_service.list
index d8b193e800a651fd4f8c131916da402d5ef37615..900c78543ee4e6f2ec62a1c411f4bc2095546a26 100755 (executable)
--- a/test/new_service_test/target/tv/systemd_service.list
+++ b/test/new_service_test/target/tv/systemd_service.list
@@ -34,7 +34,7 @@ connman.service;network_fw;network_fw;System;
 console-getty.service;root;root;System;
 console-shell.service;root;root;System;
 container-getty@.service;root;root;System;
-crash-service.service;root;root;System;
+crash-service.service;crash_worker;crash_worker;System;
 csr.service;security_fw;security_fw;System;
 cynara.service;cynara;cynara;System;
 data-provider-master.service;app_fw;app_fw;System;

diff --git a/test/new_service_test/target/wearable/systemd_service.list b/test/new_service_test/target/wearable/systemd_service.list
index 2f4f927fbf56cacb99e15dd0eb927a979e6dee3b..4c89b716820b0d6d2cdf49c4de51acbef8819a3e 100755 (executable)
--- a/test/new_service_test/target/wearable/systemd_service.list
+++ b/test/new_service_test/target/wearable/systemd_service.list
@@ -40,7 +40,7 @@ console-getty.service;root;root;System;
 console-shell.service;root;root;System;
 container-getty@.service;root;root;System;
 contextd.service;service_fw;service_fw;System;
-crash-service.service;root;root;System;
+crash-service.service;crash_worker;crash_worker;System;
 csr.service;security_fw;security_fw;System;
 cynara.service;cynara;cynara;System;
 data-provider-master.service;app_fw;app_fw;System;