)]}'
{
  "commit": "89df36704e48f6776d28dbaa4663f9ffd5c6f997",
  "tree": "da439712bb977bf8a3f7c577922a587075bb9f35",
  "parents": [
    "510f016c4338c24d3291075dc6bfe7f8d92c41a3"
  ],
  "author": {
    "name": "Nick Kralevich",
    "email": "nnk@google.com",
    "time": "Wed Feb 15 15:12:31 2017 -0800"
  },
  "committer": {
    "name": "android-build-team Robot",
    "email": "android-build-team-robot@google.com",
    "time": "Wed Sep 13 20:54:16 2017 +0000"
  },
  "message": "system_server: add CAP_SYS_PTRACE\n\nCommit https://android.googlesource.com/kernel/common/+/f0ce0eee added\nCAP_SYS_RESOURCE as a capability check which would allow access to\nsensitive /proc/PID files. system_server uses this capability to collect\nsmaps from managed processes. Presumably this was done to avoid the\nimplications of granting CAP_SYS_PTRACE to system_server.\n\nHowever, with SELinux enforcement, we can grant CAP_SYS_PTRACE but not\nallow ptrace attach() to other processes. The net result of this is that\nCAP_SYS_PTRACE and CAP_SYS_RESOURCE have identical security controls, as\nlong as system_server:process ptrace is never granted.\n\nAdd CAP_SYS_PTRACE to the set of capabilities granted to system_server.\n\nDon\u0027t delete CAP_SYS_RESOURCE for now. SELinux has blocked the use of\nCAP_SYS_RESOURCE, but we still want to generate audit logs if it\u0027s\ntriggered. CAP_SYS_RESOURCE can be deleted in a future commit.\n\nBug: 34951864\nBug: 38496951\nTest: Device boots, functionality remains identical, no sys_resource\ndenials from system_server.\nChange-Id: I2570266165396dba2b600eac7c42c94800d9c65b\n(cherry picked from commit 3082eb7c7253c62a06aa151a80487a4eabd49914)\n(cherry picked from commit 966619d0ab6950fb6c90127b47d493b4c8617878)\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "9c960c04d4914e016142e3ece5f86fb25ddb1361",
      "old_mode": 33188,
      "old_path": "core/java/com/android/internal/os/ZygoteInit.java",
      "new_id": "811719698eab0bff6c57623fb93535ff1b543f75",
      "new_mode": 33188,
      "new_path": "core/java/com/android/internal/os/ZygoteInit.java"
    }
  ]
}