security_AccountsBaseline: add chronos to arc-camera group
Chrome needs to host the unix domain named socket /run/camera/camera3.sock
on devices with camera HAL v3 to provide camera service to the system. For
security reasons the named socket has user chronos and group arc-camera,
and is only accessible by users in the arc-camera group. Adding chronos to
the arc-camera group so that Chrome can change the named socket to group
arc-camera after creating it.
BUG=b:36233258, b:32690003
CQ-DEPEND=CL:505827
TEST=Make sure Chrome starts and Mojo connection to the camera HAL
is started successfully.
Change-Id: I7063b99c9ec08eb00219124f8d2060feeb58a8a9
Reviewed-on: https://chromium-review.googlesource.com/546796
Tested-by: Ricky Liang <jcliang@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Commit-Queue: Ricky Liang <jcliang@chromium.org>
diff --git a/client/site_tests/security_AccountsBaseline/baseline.group b/client/site_tests/security_AccountsBaseline/baseline.group
index a9358e6..acc6bc8 100644
--- a/client/site_tests/security_AccountsBaseline/baseline.group
+++ b/client/site_tests/security_AccountsBaseline/baseline.group
@@ -82,7 +82,7 @@
cups:!:277:
biod:!:282:
devicejail:!:283:
-arc-camera:!:603:
+arc-camera:!:603:chronos
ntfs-3g:!:300:
avfs:!:301:
fuse-exfat:!:302:
