mediaextractor: ignore platform's profiler assist signal
Due to security constraints, platform profilers that do remote stack
unwinding need the target process' cooperation. This is implemented via
a bionic signal handler.
On debug builds, media extractor can end up being targeted by such
system-wide profiling, which can crash the process due to
seccomp/minijail (specifically, due to sendmsg that is used for sending
file descriptors over a unix socket).
Tested: synced updated binary to crosshatch-userdebug, confirmed that
sending signal 36 with si_val 1 doesn't crash mediaextractor.
Bug: 149328505
Change-Id: Idf34e08edf99a82c72146aebeb5e46e5cf5af2f3
diff --git a/services/mediaextractor/Android.bp b/services/mediaextractor/Android.bp
index e906500..16b036f 100644
--- a/services/mediaextractor/Android.bp
+++ b/services/mediaextractor/Android.bp
@@ -29,6 +29,9 @@
"liblog",
"libavservices_minijail",
],
+ header_libs: [
+ "bionic_libc_platform_headers",
+ ],
target: {
android: {
product_variables: {
diff --git a/services/mediaextractor/main_extractorservice.cpp b/services/mediaextractor/main_extractorservice.cpp
index 3c4125b..afb7692 100644
--- a/services/mediaextractor/main_extractorservice.cpp
+++ b/services/mediaextractor/main_extractorservice.cpp
@@ -28,6 +28,8 @@
#include <android-base/properties.h>
#include <utils/misc.h>
+#include <bionic/reserved_signals.h>
+
// from LOCAL_C_INCLUDES
#include "MediaExtractorService.h"
#include "MediaUtils.h"
@@ -49,6 +51,10 @@
signal(SIGPIPE, SIG_IGN);
+ // Do not assist platform profilers (relevant only on debug builds).
+ // Otherwise, the signal handler can violate the seccomp policy.
+ signal(BIONIC_SIGNAL_PROFILER, SIG_IGN);
+
//b/62255959: this forces libutis.so to dlopen vendor version of libutils.so
//before minijail is on. This is dirty but required since some syscalls such
//as pread64 are used by linker but aren't allowed in the minijail. By
