init.common.rc: set ioprio to realtime for rmt_storage
Setting ioprio to realtime within rmt_stroage requires unnecessarily
granting CAP_SYS_ADMIN, which is a highly privileged superuser
capability.
Having init set ioprio at service launch removes the need for
granting this capability and keeps rmt_storage unprivileged.
Addresses the following errors:
07-20dd 14:21:03.867 824 824 W rmt_storage: type=1400 audit(0.0:4):
avc: denied { sys_admin } for capability=21 scontext=u:r:rmt_storage:s0
tcontext=u:r:rmt_storage:s0 tclass=capability permissive=0
07-20 14:21:03.874 824 824 E rmt_storage: Error setting io priority
to CLASS_RT (1)
Test 1 and 2 below verify that my change results in the intended
behavior. Test 3 is a sanity check to show the state without
granting CAP_SYS_ADMIN and to demonstrate that my change results
in the intended state.
Test: original code with CAP_SYS_ADMIN granted
# ionice -p <rmt_storage pid>
Realtime: prio 0
Test: ioprio_set moved to init.rc script
# ionice -p <rmt_storage pid>
Realtime: prio 0
Test: original code without CAP_SYS_ADMIN granted (sanity check)
# ionice -p <rmt_storage pid>
unknown: prio 0
Bug: 63930527
Change-Id: I9bc660aaca72f3df562e8010bc23c9731f648a9e
(cherry picked from commit 64f5ed41004610942aa6d354417988e1614e809f)
diff --git a/init.common.rc b/init.common.rc
index 2035fd8..ab6e245 100644
--- a/init.common.rc
+++ b/init.common.rc
@@ -649,7 +649,7 @@
class core
user root
group root system wakelock
- ioprio rt 1
+ ioprio rt 0
shutdown critical
service port-bridge /vendor/bin/port-bridge
diff --git a/sepolicy/rmt.te b/sepolicy/rmt.te
index dc177a1..2b77c34 100644
--- a/sepolicy/rmt.te
+++ b/sepolicy/rmt.te
@@ -10,7 +10,7 @@
init_daemon_domain(rmt)
wakelock_use(rmt)
-allow rmt self:capability { setgid setpcap setuid sys_admin };
+allow rmt self:capability { setgid setpcap setuid };
allow rmt block_device:dir search;
allow rmt modem_block_device:blk_file rw_file_perms;
