libs/native_activity_thread/src/utils.rs - platform/frameworks/base - Git at Google

 //
 // Copyright (C) 2025 The Android Open-Source Project
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.

 use anyhow::{bail, Context, Result};
 use bitflags::bitflags;
 use libc::{
     dl_iterate_phdr, dl_phdr_info, mallopt, mprotect, size_t, PROT_EXEC, PROT_READ, PT_LOAD,
 };
 use native_activity_thread_bindgen::{tzset, PF_X};
 use nix::{
     errno::Errno,
     sys::resource::{getrlimit, setrlimit, Resource},
     unistd::{getuid, sysconf, SysconfVar},
 };
 use rustutils::android::process::android_mallopt;
 use rustutils::android::process::MalloptOpcode;
 use rustutils::android::system_properties;

 use std::ffi::{c_int, c_ulong, c_void};
 use std::io::Error;
 use std::slice;

 const AID_APP_START: u32 = 10000;

 static PROP_ZYGOTE_CORE_DUMP: &str = "persist.zygote.core_dump";
 static PROP_DEBUGGABLE: &str = "ro.debuggable";

 /// A safe wrapper around tzset()
 pub fn reset_time_zone() {
     // Refresh Bionic's timezone information.
     // SAFETY: Not passing any function parameter.
     unsafe { tzset() };
 }

 /// Since Native Zygote only forks isolated process, which cannot read the `ro.debuggable` property,
 /// we should call this function and cache the value when the Native Zygote server is initialized.
 pub fn get_or_init_debuggable() -> bool {
     static DEBUGGABLE: std::sync::OnceLock<bool> = std::sync::OnceLock::new();
     *DEBUGGABLE
         .get_or_init(|| system_properties::read_bool(PROP_DEBUGGABLE, false).unwrap_or(false))
 }

 fn get_page_size() -> usize {
     match sysconf(SysconfVar::PAGE_SIZE) {
         Ok(Some(size)) => size as usize,
         Ok(None) => panic!("sysconf(PAGE_SIZE) returned None"),
         Err(e) => panic!("sysconf(PAGE_SIZE) returned an error: {e}"),
     }
 }

 #[allow(non_camel_case_types)]
 #[cfg(target_pointer_width = "64")]
 type ElfW_Phdr = libc::Elf64_Phdr;
 #[allow(non_camel_case_types)]
 #[cfg(target_pointer_width = "32")]
 type ElfW_Phdr = libc::Elf32_Phdr;

 /// A callback function for `dl_iterate_phdr` which changes XO regions to RX.
 ///
 /// # Safety
 /// Callers must ensure that `info` is a valid pointer to `dl_phdr_info` which outlives this
 /// function and contains a shared object information.
 unsafe extern "C" fn disable_execute_only(
     info: *mut dl_phdr_info,
     _size: usize,
     _data: *mut c_void,
 ) -> c_int {
     if info.is_null() {
         return 0;
     }

     // SAFETY: `info` is a valid pointer which outlives this function and is aligned properly.
     let info_ref = unsafe { &*info };

     let phdr_ptr = info_ref.dlpi_phdr;
     let phdr_count = info_ref.dlpi_phnum as usize;

     // SAFETY: `phdr_ptr` points to a valid ElfW_Phdr array of `phdr_count` elements.
     let program_headers: &[ElfW_Phdr] = unsafe { slice::from_raw_parts(phdr_ptr, phdr_count) };

     let page_mask = !(get_page_size() - 1);

     // Search for any execute-only segments and mark them read+execute.
     // This operation only affects RWX flags because of the implementation
     // of mprotect, so other architectural flags (like PROT_BTI) will not be cleared.
     for phdr in program_headers {
         if phdr.p_type == PT_LOAD && phdr.p_flags == PF_X {
             let addr = (info_ref.dlpi_addr + phdr.p_vaddr) as usize;
             let aligned_addr = (addr & page_mask) as *mut c_void;
             let len = phdr.p_memsz as size_t;
             let adjusted_len = addr + len - aligned_addr as usize;

             // SAFETY: `aligned_addr` is aligned to a page boundary and `adjusted_len` is a valid
             // size of the region including the XO segment.
             let ret = unsafe { mprotect(aligned_addr, adjusted_len, PROT_READ | PROT_EXEC) };
             if ret != 0 {
                 log::warn!("Failed to mprotect(): {}", Error::last_os_error());
             }
         }
     }

     0
 }

 bitflags! {
     /// Runtime flag constants.
     /// Must match values in com.android.internal.os.Zygote.
     #[derive(Debug, Clone, Copy, PartialEq, Eq)]
     pub struct RuntimeFlags: u32 {
         const DEBUG_ENABLE_JDWP = 1;
         const DEBUG_ENABLE_CHECKJNI = 1 << 1;
         const DEBUG_ENABLE_ASSERT = 1 << 2;
         const DEBUG_ENABLE_SAFEMODE = 1 << 3;
         const DEBUG_ENABLE_JNI_LOGGING = 1 << 4;
         const DEBUG_GENERATE_DEBUG_INFO = 1 << 5;
         const DEBUG_ALWAYS_JIT = 1 << 6;
         const DEBUG_NATIVE_DEBUGGABLE = 1 << 7;
         const DEBUG_JAVA_DEBUGGABLE = 1 << 8;
         const DISABLE_VERIFIER = 1 << 9;
         const ONLY_USE_SYSTEM_OAT_FILES = 1 << 10;
         const DEBUG_GENERATE_MINI_DEBUG_INFO = 1 << 11;
         const API_ENFORCEMENT_POLICY_MASK = (1 << 12) | (1 << 13);
         const PROFILE_SYSTEM_SERVER = 1 << 14;
         const PROFILE_FROM_SHELL = 1 << 15;
         const USE_APP_IMAGE_STARTUP_CACHE = 1 << 16;
         const DEBUG_IGNORE_APP_SIGNAL_HANDLER = 1 << 17;
         const DISABLE_TEST_API_ENFORCEMENT_POLICY = 1 << 18;
         const MEMORY_TAG_LEVEL_MASK = (1 << 19) | (1 << 20);
         const MEMORY_TAG_LEVEL_TBI = 1 << 19;
         const MEMORY_TAG_LEVEL_ASYNC = 2 << 19;
         const MEMORY_TAG_LEVEL_SYNC = 3 << 19;
         const GWP_ASAN_LEVEL_MASK = (1 << 21) | (1 << 22);
         const GWP_ASAN_LEVEL_NEVER = 0 << 21;
         const GWP_ASAN_LEVEL_LOTTERY = 1 << 21;
         const GWP_ASAN_LEVEL_ALWAYS = 2 << 21;
         const GWP_ASAN_LEVEL_DEFAULT = 3 << 21;
         const NATIVE_HEAP_ZERO_INIT_ENABLED = 1 << 23;
         const PROFILEABLE = 1 << 24;
         const DEBUG_ENABLE_PTRACE = 1 << 25;
         const ENABLE_PAGE_SIZE_APP_COMPAT = 1 << 26;
         const ENABLE_EXECUTE_ONLY_MEMORY = 1 << 27;
     }
 }

 impl RuntimeFlags {
     pub fn get_heap_tagging_level(&self) -> c_int {
         match self.intersection(Self::MEMORY_TAG_LEVEL_MASK) {
             Self::MEMORY_TAG_LEVEL_TBI => libc::M_HEAP_TAGGING_LEVEL_TBI,
             Self::MEMORY_TAG_LEVEL_ASYNC => libc::M_HEAP_TAGGING_LEVEL_ASYNC,
             Self::MEMORY_TAG_LEVEL_SYNC => libc::M_HEAP_TAGGING_LEVEL_SYNC,
             _ => libc::M_HEAP_TAGGING_LEVEL_NONE,
         }
     }

     pub fn is_native_heap_zero_init_enabled(&self) -> bool {
         self.contains(Self::NATIVE_HEAP_ZERO_INIT_ENABLED)
     }

     pub fn is_ptrace_enabled(&self) -> bool {
         self.contains(Self::DEBUG_ENABLE_PTRACE)
     }

     pub fn is_profileable_from_shell(&self) -> bool {
         self.contains(Self::PROFILE_FROM_SHELL)
     }

     pub fn is_profileable(&self) -> bool {
         self.contains(Self::PROFILEABLE)
     }

     pub fn is_execute_only_memory_enabled(&self) -> bool {
         self.contains(Self::ENABLE_EXECUTE_ONLY_MEMORY)
     }
 }

 pub fn apply_runtime_flags(runtime_flags: u32) -> Result<()> {
     let Some(flags) = RuntimeFlags::from_bits(runtime_flags) else {
         bail!("runtime_flags doesn't have a valid representation: {:#x}", runtime_flags);
     };

     // Set process properties to enable debugging if required.
     if flags.is_ptrace_enabled() {
         if let Err(e) = enable_debugger() {
             log::warn!("Failed to enable debbuger: {e}");
         }
     }

     if flags.is_profileable_from_shell() {
         // simpleperf needs the process to be dumpable to profile it.
         prctl_set_dumpable(Dumpable::ByUser).expect("prctl(PR_SET_DUMPABLE) failed");
     }

     if get_or_init_debuggable() || flags.is_profileable() {
         // SAFETY: This opcode takes no arguments so a nullptr is passed
         //         instead.
         let ret = unsafe {
             android_mallopt(MalloptOpcode::InitZygoteChildProfiling, std::ptr::null_mut(), 0)
         };
         if ret.is_err() {
             log::error!(
                 "Failed to android_mallopt(M_INIT_ZYGOTE_CHILD_HEAP_PROFILING): {}",
                 Error::last_os_error()
             );
         }
     }

     if !flags.is_native_heap_zero_init_enabled() {
         // SAFETY: Setting configuration with valid argument (0 = disable).
         let ret = unsafe { mallopt(libc::M_BIONIC_ZERO_INIT, 0) };
         if ret == 0 {
             log::warn!("Failed to mallopt(M_BIONIC_ZERO_INIT): {}", Error::last_os_error());
         }
     }

     // SAFETY: Setting configuration with valid argument (as defined in get_heap_tagging_level).
     let ret =
         unsafe { mallopt(libc::M_BIONIC_SET_HEAP_TAGGING_LEVEL, flags.get_heap_tagging_level()) };
     if ret == 0 {
         log::warn!(
             "Failed to mallopt(M_BIONIC_SET_HEAP_TAGGING_LEVEL): {}",
             Error::last_os_error()
         );
     }

     // If the app does not support execute-only memory, then iterate through
     // the shared objects and mark them readable.
     if cfg!(feature = "build_execute_only_memory") && !flags.is_execute_only_memory_enabled() {
         // SAFETY: Passes a callback function which has the expected function signature. The
         // callback doesn't use `data`. The libc runtime guarantees to meet the safety requirements
         // of the callback.
         unsafe { dl_iterate_phdr(Some(disable_execute_only), std::ptr::null_mut()) };
     }

     Ok(())
 }

 // Enum corresponding to SUID_DUMP_* defined in linux/sched/coredump.h.
 #[derive(PartialEq)]
 enum Dumpable {
     Disable,
     ByUser,
     ByRoot,
 }

 impl TryFrom<i32> for Dumpable {
     type Error = ();

     fn try_from(value: i32) -> Result<Self, Self::Error> {
         let dumpable = match value {
             0 => Dumpable::Disable,
             1 => Dumpable::ByUser,
             2 => Dumpable::ByRoot,
             _ => return Err(()),
         };
         Ok(dumpable)
     }
 }

 impl From<Dumpable> for i32 {
     fn from(value: Dumpable) -> Self {
         match value {
             Dumpable::Disable => 0,
             Dumpable::ByUser => 1,
             Dumpable::ByRoot => 2,
         }
     }
 }

 // TODO(b/450462991): Use nix::sys::prctl::get_dumpable once `prctl` module is available to android
 // and this issue is fixed: https://github.com/nix-rust/nix/issues/2684.
 fn prctl_get_dumpable() -> nix::Result<Dumpable> {
     // SAFETY: Trivially safe. See `man PR_GET_DUMPABLE`.
     let res = unsafe { libc::prctl(libc::PR_GET_DUMPABLE) };
     if res == -1 {
         return Err(Errno::last());
     }
     Ok(Dumpable::try_from(res)
         .unwrap_or_else(|_| panic!("prctl(PR_GET_DUMPABLE) returned an unexpected value: {res}")))
 }

 // TODO(b/450462991): Use nix::sys::prctl::set_dumpable once `prctl` module is available to
 // android.
 fn prctl_set_dumpable(dumpable: Dumpable) -> nix::Result<()> {
     let val: i32 = dumpable.into();
     // SAFETY: Trivially safe. See `man PR_SET_DUMPABLE`.
     let res = unsafe { libc::prctl(libc::PR_SET_DUMPABLE, val) };
     if res == -1 {
         return Err(Errno::last());
     }
     Ok(())
 }

 fn prctl_set_ptracer(pid: c_ulong) -> nix::Result<()> {
     // SAFETY: Trivially safe. See `man PR_SET_PTRACER`.
     let res = unsafe { libc::prctl(libc::PR_SET_PTRACER, pid) };
     if res == -1 {
         return Err(Errno::last());
     }
     Ok(())
 }

 pub fn setup_process_dumpability() -> Result<()> {
     if prctl_get_dumpable().context("prctl(PR_GET_DUMPABLE) failed")? == Dumpable::ByRoot
         && getuid().as_raw() >= AID_APP_START
     {
         prctl_set_dumpable(Dumpable::Disable).context("prctl(PR_SET_DUMPABLE) failed")?;
     }
     Ok(())
 }

 fn enable_debugger() -> Result<()> {
     // To let a non-privileged gdbserver attach to this process,
     // we must set our dumpable flag.
     prctl_set_dumpable(Dumpable::ByUser).context("prctl(PR_SET_DUMPABLE) failed")?;

     // A non-privileged native debugger should be able to attach to the debuggable app,
     // even if Yama is enabled (see kernel/Documentation/security/Yama.txt).
     if let Err(errno) = prctl_set_ptracer(libc::PR_SET_PTRACER_ANY) {
         // if Yama is off prctl(PR_SET_PTRACER) returns EINVAL -
         // don't log in this case since it's expected behaviour.
         if errno != Errno::EINVAL {
             bail!("prctl(PR_SET_TRACER, PR_SET_PTRACER_ANY) failed: {errno}");
         }
     }

     // Set the core dump size to zero unless wanted
     // (see also coredump_setup in build/envsetup.sh).
     if system_properties::read_bool(PROP_ZYGOTE_CORE_DUMP, false)
         .with_context(|| format!("Failed to read {PROP_ZYGOTE_CORE_DUMP}"))?
     {
         // Set the soft limit on core dump size to 0 without changing the hard limit.
         let (_, hard_limit) =
             getrlimit(Resource::RLIMIT_CORE).context("getrlimit(RLIMIT_CORE) failed")?;
         setrlimit(Resource::RLIMIT_CORE, 0, hard_limit).context("setrlimit(RLIMIT_CORE) failed")?;
     }

     Ok(())
 }
	//
	// Copyright (C) 2025 The Android Open-Source Project
	//
	// Licensed under the Apache License, Version 2.0 (the "License");
	// you may not use this file except in compliance with the License.
	// You may obtain a copy of the License at
	//
	// http://www.apache.org/licenses/LICENSE-2.0
	//
	// Unless required by applicable law or agreed to in writing, software
	// distributed under the License is distributed on an "AS IS" BASIS,
	// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	// See the License for the specific language governing permissions and
	// limitations under the License.

	use anyhow::{bail, Context, Result};
	use bitflags::bitflags;
	use libc::{
	dl_iterate_phdr, dl_phdr_info, mallopt, mprotect, size_t, PROT_EXEC, PROT_READ, PT_LOAD,
	};
	use native_activity_thread_bindgen::{tzset, PF_X};
	use nix::{
	errno::Errno,
	sys::resource::{getrlimit, setrlimit, Resource},
	unistd::{getuid, sysconf, SysconfVar},
	};
	use rustutils::android::process::android_mallopt;
	use rustutils::android::process::MalloptOpcode;
	use rustutils::android::system_properties;

	use std::ffi::{c_int, c_ulong, c_void};
	use std::io::Error;
	use std::slice;

	const AID_APP_START: u32 = 10000;

	static PROP_ZYGOTE_CORE_DUMP: &str = "persist.zygote.core_dump";
	static PROP_DEBUGGABLE: &str = "ro.debuggable";

	/// A safe wrapper around tzset()
	pub fn reset_time_zone() {
	// Refresh Bionic's timezone information.
	// SAFETY: Not passing any function parameter.
	unsafe { tzset() };
	}

	/// Since Native Zygote only forks isolated process, which cannot read the `ro.debuggable` property,
	/// we should call this function and cache the value when the Native Zygote server is initialized.
	pub fn get_or_init_debuggable() -> bool {
	static DEBUGGABLE: std::sync::OnceLock<bool> = std::sync::OnceLock::new();
	*DEBUGGABLE
	.get_or_init(\|\| system_properties::read_bool(PROP_DEBUGGABLE, false).unwrap_or(false))
	}

	fn get_page_size() -> usize {
	match sysconf(SysconfVar::PAGE_SIZE) {
	Ok(Some(size)) => size as usize,
	Ok(None) => panic!("sysconf(PAGE_SIZE) returned None"),
	Err(e) => panic!("sysconf(PAGE_SIZE) returned an error: {e}"),
	}
	}

	#[allow(non_camel_case_types)]
	#[cfg(target_pointer_width = "64")]
	type ElfW_Phdr = libc::Elf64_Phdr;
	#[allow(non_camel_case_types)]
	#[cfg(target_pointer_width = "32")]
	type ElfW_Phdr = libc::Elf32_Phdr;

	/// A callback function for `dl_iterate_phdr` which changes XO regions to RX.
	///
	/// # Safety
	/// Callers must ensure that `info` is a valid pointer to `dl_phdr_info` which outlives this
	/// function and contains a shared object information.
	unsafe extern "C" fn disable_execute_only(
	info: *mut dl_phdr_info,
	_size: usize,
	_data: *mut c_void,
	) -> c_int {
	if info.is_null() {
	return 0;
	}

	// SAFETY: `info` is a valid pointer which outlives this function and is aligned properly.
	let info_ref = unsafe { &*info };

	let phdr_ptr = info_ref.dlpi_phdr;
	let phdr_count = info_ref.dlpi_phnum as usize;

	// SAFETY: `phdr_ptr` points to a valid ElfW_Phdr array of `phdr_count` elements.
	let program_headers: &[ElfW_Phdr] = unsafe { slice::from_raw_parts(phdr_ptr, phdr_count) };

	let page_mask = !(get_page_size() - 1);

	// Search for any execute-only segments and mark them read+execute.
	// This operation only affects RWX flags because of the implementation
	// of mprotect, so other architectural flags (like PROT_BTI) will not be cleared.
	for phdr in program_headers {
	if phdr.p_type == PT_LOAD && phdr.p_flags == PF_X {
	let addr = (info_ref.dlpi_addr + phdr.p_vaddr) as usize;
	let aligned_addr = (addr & page_mask) as *mut c_void;
	let len = phdr.p_memsz as size_t;
	let adjusted_len = addr + len - aligned_addr as usize;

	// SAFETY: `aligned_addr` is aligned to a page boundary and `adjusted_len` is a valid
	// size of the region including the XO segment.
	let ret = unsafe { mprotect(aligned_addr, adjusted_len, PROT_READ \| PROT_EXEC) };
	if ret != 0 {
	log::warn!("Failed to mprotect(): {}", Error::last_os_error());
	}
	}
	}

	0
	}

	bitflags! {
	/// Runtime flag constants.
	/// Must match values in com.android.internal.os.Zygote.
	#[derive(Debug, Clone, Copy, PartialEq, Eq)]
	pub struct RuntimeFlags: u32 {
	const DEBUG_ENABLE_JDWP = 1;
	const DEBUG_ENABLE_CHECKJNI = 1 << 1;
	const DEBUG_ENABLE_ASSERT = 1 << 2;
	const DEBUG_ENABLE_SAFEMODE = 1 << 3;
	const DEBUG_ENABLE_JNI_LOGGING = 1 << 4;
	const DEBUG_GENERATE_DEBUG_INFO = 1 << 5;
	const DEBUG_ALWAYS_JIT = 1 << 6;
	const DEBUG_NATIVE_DEBUGGABLE = 1 << 7;
	const DEBUG_JAVA_DEBUGGABLE = 1 << 8;
	const DISABLE_VERIFIER = 1 << 9;
	const ONLY_USE_SYSTEM_OAT_FILES = 1 << 10;
	const DEBUG_GENERATE_MINI_DEBUG_INFO = 1 << 11;
	const API_ENFORCEMENT_POLICY_MASK = (1 << 12) \| (1 << 13);
	const PROFILE_SYSTEM_SERVER = 1 << 14;
	const PROFILE_FROM_SHELL = 1 << 15;
	const USE_APP_IMAGE_STARTUP_CACHE = 1 << 16;
	const DEBUG_IGNORE_APP_SIGNAL_HANDLER = 1 << 17;
	const DISABLE_TEST_API_ENFORCEMENT_POLICY = 1 << 18;
	const MEMORY_TAG_LEVEL_MASK = (1 << 19) \| (1 << 20);
	const MEMORY_TAG_LEVEL_TBI = 1 << 19;
	const MEMORY_TAG_LEVEL_ASYNC = 2 << 19;
	const MEMORY_TAG_LEVEL_SYNC = 3 << 19;
	const GWP_ASAN_LEVEL_MASK = (1 << 21) \| (1 << 22);
	const GWP_ASAN_LEVEL_NEVER = 0 << 21;
	const GWP_ASAN_LEVEL_LOTTERY = 1 << 21;
	const GWP_ASAN_LEVEL_ALWAYS = 2 << 21;
	const GWP_ASAN_LEVEL_DEFAULT = 3 << 21;
	const NATIVE_HEAP_ZERO_INIT_ENABLED = 1 << 23;
	const PROFILEABLE = 1 << 24;
	const DEBUG_ENABLE_PTRACE = 1 << 25;
	const ENABLE_PAGE_SIZE_APP_COMPAT = 1 << 26;
	const ENABLE_EXECUTE_ONLY_MEMORY = 1 << 27;
	}
	}

	impl RuntimeFlags {
	pub fn get_heap_tagging_level(&self) -> c_int {
	match self.intersection(Self::MEMORY_TAG_LEVEL_MASK) {
	Self::MEMORY_TAG_LEVEL_TBI => libc::M_HEAP_TAGGING_LEVEL_TBI,
	Self::MEMORY_TAG_LEVEL_ASYNC => libc::M_HEAP_TAGGING_LEVEL_ASYNC,
	Self::MEMORY_TAG_LEVEL_SYNC => libc::M_HEAP_TAGGING_LEVEL_SYNC,
	_ => libc::M_HEAP_TAGGING_LEVEL_NONE,
	}
	}

	pub fn is_native_heap_zero_init_enabled(&self) -> bool {
	self.contains(Self::NATIVE_HEAP_ZERO_INIT_ENABLED)
	}

	pub fn is_ptrace_enabled(&self) -> bool {
	self.contains(Self::DEBUG_ENABLE_PTRACE)
	}

	pub fn is_profileable_from_shell(&self) -> bool {
	self.contains(Self::PROFILE_FROM_SHELL)
	}

	pub fn is_profileable(&self) -> bool {
	self.contains(Self::PROFILEABLE)
	}

	pub fn is_execute_only_memory_enabled(&self) -> bool {
	self.contains(Self::ENABLE_EXECUTE_ONLY_MEMORY)
	}
	}

	pub fn apply_runtime_flags(runtime_flags: u32) -> Result<()> {
	let Some(flags) = RuntimeFlags::from_bits(runtime_flags) else {
	bail!("runtime_flags doesn't have a valid representation: {:#x}", runtime_flags);
	};

	// Set process properties to enable debugging if required.
	if flags.is_ptrace_enabled() {
	if let Err(e) = enable_debugger() {
	log::warn!("Failed to enable debbuger: {e}");
	}
	}

	if flags.is_profileable_from_shell() {
	// simpleperf needs the process to be dumpable to profile it.
	prctl_set_dumpable(Dumpable::ByUser).expect("prctl(PR_SET_DUMPABLE) failed");
	}

	if get_or_init_debuggable() \|\| flags.is_profileable() {
	// SAFETY: This opcode takes no arguments so a nullptr is passed
	// instead.
	let ret = unsafe {
	android_mallopt(MalloptOpcode::InitZygoteChildProfiling, std::ptr::null_mut(), 0)
	};
	if ret.is_err() {
	log::error!(
	"Failed to android_mallopt(M_INIT_ZYGOTE_CHILD_HEAP_PROFILING): {}",
	Error::last_os_error()
	);
	}
	}

	if !flags.is_native_heap_zero_init_enabled() {
	// SAFETY: Setting configuration with valid argument (0 = disable).
	let ret = unsafe { mallopt(libc::M_BIONIC_ZERO_INIT, 0) };
	if ret == 0 {
	log::warn!("Failed to mallopt(M_BIONIC_ZERO_INIT): {}", Error::last_os_error());
	}
	}

	// SAFETY: Setting configuration with valid argument (as defined in get_heap_tagging_level).
	let ret =
	unsafe { mallopt(libc::M_BIONIC_SET_HEAP_TAGGING_LEVEL, flags.get_heap_tagging_level()) };
	if ret == 0 {
	log::warn!(
	"Failed to mallopt(M_BIONIC_SET_HEAP_TAGGING_LEVEL): {}",
	Error::last_os_error()
	);
	}

	// If the app does not support execute-only memory, then iterate through
	// the shared objects and mark them readable.
	if cfg!(feature = "build_execute_only_memory") && !flags.is_execute_only_memory_enabled() {
	// SAFETY: Passes a callback function which has the expected function signature. The
	// callback doesn't use `data`. The libc runtime guarantees to meet the safety requirements
	// of the callback.
	unsafe { dl_iterate_phdr(Some(disable_execute_only), std::ptr::null_mut()) };
	}

	Ok(())
	}

	// Enum corresponding to SUID_DUMP_* defined in linux/sched/coredump.h.
	#[derive(PartialEq)]
	enum Dumpable {
	Disable,
	ByUser,
	ByRoot,
	}

	impl TryFrom<i32> for Dumpable {
	type Error = ();

	fn try_from(value: i32) -> Result<Self, Self::Error> {
	let dumpable = match value {
	0 => Dumpable::Disable,
	1 => Dumpable::ByUser,
	2 => Dumpable::ByRoot,
	_ => return Err(()),
	};
	Ok(dumpable)
	}
	}

	impl From<Dumpable> for i32 {
	fn from(value: Dumpable) -> Self {
	match value {
	Dumpable::Disable => 0,
	Dumpable::ByUser => 1,
	Dumpable::ByRoot => 2,
	}
	}
	}

	// TODO(b/450462991): Use nix::sys::prctl::get_dumpable once `prctl` module is available to android
	// and this issue is fixed: https://github.com/nix-rust/nix/issues/2684.
	fn prctl_get_dumpable() -> nix::Result<Dumpable> {
	// SAFETY: Trivially safe. See `man PR_GET_DUMPABLE`.
	let res = unsafe { libc::prctl(libc::PR_GET_DUMPABLE) };
	if res == -1 {
	return Err(Errno::last());
	}
	Ok(Dumpable::try_from(res)
	.unwrap_or_else(\|_\| panic!("prctl(PR_GET_DUMPABLE) returned an unexpected value: {res}")))
	}

	// TODO(b/450462991): Use nix::sys::prctl::set_dumpable once `prctl` module is available to
	// android.
	fn prctl_set_dumpable(dumpable: Dumpable) -> nix::Result<()> {
	let val: i32 = dumpable.into();
	// SAFETY: Trivially safe. See `man PR_SET_DUMPABLE`.
	let res = unsafe { libc::prctl(libc::PR_SET_DUMPABLE, val) };
	if res == -1 {
	return Err(Errno::last());
	}
	Ok(())
	}

	fn prctl_set_ptracer(pid: c_ulong) -> nix::Result<()> {
	// SAFETY: Trivially safe. See `man PR_SET_PTRACER`.
	let res = unsafe { libc::prctl(libc::PR_SET_PTRACER, pid) };
	if res == -1 {
	return Err(Errno::last());
	}
	Ok(())
	}

	pub fn setup_process_dumpability() -> Result<()> {
	if prctl_get_dumpable().context("prctl(PR_GET_DUMPABLE) failed")? == Dumpable::ByRoot
	&& getuid().as_raw() >= AID_APP_START
	{
	prctl_set_dumpable(Dumpable::Disable).context("prctl(PR_SET_DUMPABLE) failed")?;
	}
	Ok(())
	}

	fn enable_debugger() -> Result<()> {
	// To let a non-privileged gdbserver attach to this process,
	// we must set our dumpable flag.
	prctl_set_dumpable(Dumpable::ByUser).context("prctl(PR_SET_DUMPABLE) failed")?;

	// A non-privileged native debugger should be able to attach to the debuggable app,
	// even if Yama is enabled (see kernel/Documentation/security/Yama.txt).
	if let Err(errno) = prctl_set_ptracer(libc::PR_SET_PTRACER_ANY) {
	// if Yama is off prctl(PR_SET_PTRACER) returns EINVAL -
	// don't log in this case since it's expected behaviour.
	if errno != Errno::EINVAL {
	bail!("prctl(PR_SET_TRACER, PR_SET_PTRACER_ANY) failed: {errno}");
	}
	}

	// Set the core dump size to zero unless wanted
	// (see also coredump_setup in build/envsetup.sh).
	if system_properties::read_bool(PROP_ZYGOTE_CORE_DUMP, false)
	.with_context(\|\| format!("Failed to read {PROP_ZYGOTE_CORE_DUMP}"))?
	{
	// Set the soft limit on core dump size to 0 without changing the hard limit.
	let (_, hard_limit) =
	getrlimit(Resource::RLIMIT_CORE).context("getrlimit(RLIMIT_CORE) failed")?;
	setrlimit(Resource::RLIMIT_CORE, 0, hard_limit).context("setrlimit(RLIMIT_CORE) failed")?;
	}

	Ok(())
	}