racoon: Explicitly request CAP_NET_BIND_SERVICE, CAP_NET_RAW.
'racoon' was not explicitly requesting these capabilities. Add them.
This makes racoon's requested capabilities match its SELinux policy.
With racoon explicitly requesting all its capabilities, we can start
it as user 'vpn'.
Bug: 34744732
Test: 'start racoon', 'cat /proc/`pgrep racoon`/status'.
Test: "Uid" lines show 'vpn' uid (1016).
Test: "Cap" lines show correct mask: 0000000000003400
Change-Id: Ic3823de600a0b7dba9024346e17567e404a01a91
diff --git a/main.c b/main.c
index c5e6736..524155a 100644
--- a/main.c
+++ b/main.c
@@ -177,10 +177,6 @@
#ifdef ANDROID_CHANGES
shutdown(control, SHUT_WR);
- if (setuid(AID_VPN) != 0) {
- do_plog(LLV_ERROR, "setuid(AID_VPN) failed\n");
- exit(1);
- }
#endif
while (1) {
diff --git a/racoon.rc b/racoon.rc
index 2feb5ae..fdb8823 100644
--- a/racoon.rc
+++ b/racoon.rc
@@ -1,8 +1,9 @@
service racoon /system/bin/racoon
class main
socket racoon stream 600 system system
- # IKE uses UDP port 500. Racoon will setuid to vpn after binding the port.
+ # IKE uses UDP port 500.
+ user vpn
group vpn inet
- capabilities NET_ADMIN
+ capabilities NET_ADMIN NET_BIND_SERVICE NET_RAW
disabled
oneshot
