tree 6ab55a54d4c7588b4da4f2fe32c0c5f4b7a2b645
parent 9a22d1f28d84a0a83f0662252f198150d214d666
author Nick Kralevich <nnk@google.com> 1482245492 -0800
committer Nick Kralevich <nnk@google.com> 1482255491 -0800

FwMarkServer.cpp: Add O_CLOEXEC to received FDs

Add O_CLOEXEC to file descriptors received via the fwmark service. This
prevents netd's file descriptors from leaking across an exec() boundary,
and may address the following non-reproducible SELinux denials:

avc: denied { use } for comm="clatd" path="socket:[860297]" dev="sockfs"
ino=860297 scontext=u:r:clatd:s0 tcontext=u:r:untrusted_app:s0:c512,c768
tclass=fd permissive=0

avc: denied { read write } for comm="clatd" path="socket:[1414454]"
dev="sockfs" ino=1414454 scontext=u:r:clatd:s0
tcontext=u:r:system_server:s0 tclass=tcp_socket permissive=0

avc: denied { use } for comm="clatd" path="socket:[681600]" dev="sockfs"
ino=681600 scontext=u:r:clatd:s0 tcontext=u:r:priv_app:s0:c512,c768
tclass=fd permissive=0

Test: Device boots and no obvious problems
Test: /data/nativetest/netd_integration_test/netd_integration_test passed
Change-Id: I866b1ee0693516b46269c7106e7fc1f85b017639