installd: reduce privileges.
Make installd run with fewer privileges. This will help make
exploitation of installd based vulnerabilities more difficult
installd now runs with the following privileges:
These two capabilities are needed to add and remove files
from application's home directories.
These permissions are needed to further drop privileges when
running dexopt as the application UID.
"installd" no longer runs with full root privileges. It cannot,
for example, mount and unmount filesystems, install modules,
perform direct I/O, etc.
2 files changed