libminijail_vendor was added so that OMX can depend on
it. However, OMX's dependency is actually through the
library libavservices_minijail.
Bug: 37343418
Test: (sanity) YouTube
Test: dependency error no longer shows when compiling with
BOARD_VNDK_VERSION := current
Change-Id: Ife1dc09d8d225adf592829da9cf5603f8f543709
Note, filed b/62923763 to cleanup xmlparser includes.
Bug: 37343418
Test: builds with BOARD_VNDK_VERSION=current
Test: (sanity) YouTube on a device
Test: (sanity) Camera on a device
Test: (sanity) watch (part of a) movie on a device
Test: (sanity) YouTube on marlin
Test: (sanity) Camera on marlin
Test: (sanity) watch (part of a) movie on marlin
Test: (sanity) YouTube on angler
Test: (sanity) Camera on angler
Test: (sanity) watch (part of a) movie on angler
Change-Id: I461f999122da56cabb9d4d15b182899ced3b0120
Merged-In: I461f999122da56cabb9d4d15b182899ced3b0120
arc4random is called by the linker for dlopen to randomize the library
load order, among other uses. It's becoming more widely used over time.
It calls getentropy at regular intervals to reseed itself, which uses
the getrandom system call. This wasn't noticed because it reseeds only
very rarely with typical usage in Android.
This was quickly noticed on CopperheadOS where the hardened allocator
based on OpenBSD malloc uses at least one (often more) byte of entropy
from arc4random for each call to malloc, free, realloc, etc. It's still
needed *eventually* without the hardened allocator but it would take a
lot of plugin loading / unloading, etc. with dlopen / dlclose to hit it
at the moment.
Change-Id: I0a448e833916373871edfc68274ac31e314d54f7
The new unwinder also uses process_vm_readv, so added to all policies.
Bug: 65166211
Test: Did debuggerd -b of media.extractor and media.codec process.
Change-Id: Ifad0bc505602ec4879b0a8efe27c5a12dfa28fab
* Owners are selected from top CL approvals or owners.
They will be suggested to review/approve future CLs.
* OWNERS files are recognized by the new find-owners plugin, see .md files in
https://gerrit.googlesource.com/plugins/find-owners/+/master/src/main/resources/Documentation/
Test: build/make/tools/checkowners.py -c -v OWNERS
Change-Id: I7c848855a2d7a0d7f33123ea4ef5c2d03977b495
Test: make systemimage
Change-Id: I5f83786afe3f2c65819b127b041cb74fc4c989ac
Merged-In: I5f83786afe3f2c65819b127b041cb74fc4c989ac
Signed-off-by: YOUNG HO CHA <ganadist@gmail.com>
(cherry picked from commit 2ee7aab4a3)
Update the mediacodec and mediaextractor seccomp policies to allow
getpid and gettid, which started being used after this CL:
https://android-review.googlesource.com/c/390273/
Bug: http://b/38508369
Test: debuggerd -b `pidof media.codec`
Test: debuggerd -b `pidof media.extractor`
Change-Id: I1be61f645fa475856fa814747a5740689492aa2b
This CL allows IOmx to attempt registration even when IOmxStore fails to
register.
Test: Manual use of Camera
Bug: 37657124
Bug: 37726880
Change-Id: I108c507326ee55c17acc524233e70afa5cb5a4f0
This syscall is used by the linker to detect files located on tmpfs
Bug: http://b/37245203
Bug: http://b/37590327
Test: boot an angler and check that mediacodec does not crash
Change-Id: I7147063db7d6b8ec39a25d39b60e8e6882addf6e
(cherry picked from commit 1516b02c1a)
This syscall is used by the linker to detect files located on tmpfs
Bug: http://b/37245203
Bug: http://b/37590327
Test: boot an angler and check that mediacodec does not crash
Change-Id: I7147063db7d6b8ec39a25d39b60e8e6882addf6e
This CL provides additional sandboxing to ensure that the ban on using
/dev/binder to communicate between system and vendor is enforced (even
if SE policy might otherwise permit it.) This is done only on
full-Treble devices.
b/36604251 OMX HAL (aka mediacodec) uses Binder and even exposes a
Binder service
Test: marlin
Change-Id: I344f5eb9d8719beec02207be65caca78336afff5
Signed-off-by: Iliyan Malchev <malchev@google.com>
Test: Manual use of Camera, Movies, Photos and YouTube apps.
Test: With CtsMediaTestCases.apk installed,
adb shell am instrument -e size small -w
'android.media.cts/android.support.test.runner.AndroidJUnitRunner'
Bug: 34274385
Change-Id: I5251fea337f33460d1f0db174cedc465822f2a47
Test: Camera, Photos, YouTube, and Play Movies apps.
Test: With CtsMediaTestCases.apk installed,
adb shell am instrument -e size small -w
'android.media.cts/android.support.test.runner.AndroidJUnitRunner'
Bug: 35328855
Change-Id: I0f36683b531fc645835a94e449996e5b44d0a3de
Also, merge android.hardware.media.omx@1.0-impl into libstagefright_omx.
Test: With CtsMediaTestCases.apk installed,
adb shell am instrument -e size small -w
'android.media.cts/android.support.test.runner.AndroidJUnitRunner'
Test: Manual use of Camera, Photos, Play Movies and YouTube apps.
Test: Manual use of screen mirroring.
Bug: 33854657
Change-Id: Ie927bcafd86dc7e9509bb8b76bb3b51f9a423cc7
Whitelist recvmsg so that mediaextractor and mediacodec can get an
output fd from tombstoned.
Bug: http://b/35858739
Test: debuggerd -b `pidof media.codec`
Change-Id: I2126da6c77bde739ae37c48b1a13dcefc6482a64
Previously, vendor customization to seccomp policy was combined
with the platform's policy at build time. In order to remove
frameworks dependencies on the device folder, this policy
combination is being moved to runtime.
For mediacodec and mediaextractor, platform seccomp policy specified
in the frameworks will be loaded from /system/etc/seccomp_policy.
Optional vendor customizations must reside in
/vendor/etc/seccomp_policy. If the vendor policy exists, it will be
concatenated to the end of the platform policy and loaded, otherwise
just the platform policy will be loaded.
Bug: 34723744
Test: Dragon, Marlin, Muskie build and boot.
Test: Watch videos on youtube no seccomp violations observed.
Test: For both mediacodec and mediaextractor verify
"cat proc/<pid>/status | grep Seccomp" == Seccomp: 2
Change-Id: I08b79b207785df69add31e4662e2c33fa28b4f4d
Also clean up some other dependencies.
Test: Manual testing with Camera, YouTube and Play Movies apps.
Bug: 35445903
Change-Id: I28562b5fbcc7054cf45c4ec2530bbe2ab4b5645f
A lot of media makefiles didn’t specify libui or
libgui but included headers from these libraries
directly.
It works because these headers are on the global
include path. With this change, though, rect.h
is not anymore (albeit exported from libui).
Test: built and booted device
Bug: 35164655
Change-Id: I72e8f0b7bd25c6a67eedc17afe52c4c484a147fe
1. Toggling between Treble and non-Treble OMX will now be controlled by
two properties: "persist.hal.binderization" and
"persist.media.treble_omx". (Before this CL, this was controlled by
"debug.treble_omx".)
- If persist.media.treble_omx is not set, it will assume a default value
of -1.
- If persist.media.treble_omx is -1, persist.hal.binderization will be
used to determine whether OMX will be created as a Treble or non-Treble
service.
- If persist.media.treble_omx is 1, OMX will be created as a Treble
service.
- If persist.media.treble_omx has any other value, OMX will be created
as a non-Treble service.
- persist.media.treble_omx can be changed without rebooting, but it will
only take effect after media.codec and mediaserver processes are killed.
2. Remove all dependencies on non-Treble service. This was not done for
MediaCodec, MediaPlayerService::Client, MediaRecorderClient, stagefright
command, and omx_tests command. OMXClient and media.codec process will
now pick the right version of OMX based on properties mentioned above.
Before this CL, media.codec would always present the non-Treble version
of OMX regardless of the flag.
3. Provide workarounds for some HIDL issues.
- A sequence of nested binder and hwbinder calls require many threads to
handle. (b/35283480) The workaround is to increase the number of threads
in the thread pool of media.codec process.
- android.hidl.base@1.0::IBase::unlinkToDeath takes a strong pointer
instead of a weak pointer. (b/35233970) This causes an infinite
recursion in the destructor of ServiceDeathNotifier in
MediaPlayerService::Client and MediaRecorderClient. The workaround moves
calls to unlinkToDeath() outside of the destructor.
Test: Recorded and played videos with Camera app. Ran stagefright and
omx_tests commands.
Bug: 31399200
Change-Id: Id1940ed982838e10bf10fe8ed5b7bb912a5a2d3a
That way we can modify this code in one place to take a list of seccomp
policy files.
This CL removes around 70 lines by unifying identical code. No change
in behavior.
Bug: 34723744
Test: media.codec, media.extractor start, have Seccomp.
Test: cat /proc/`pgrep .codec`/status | grep Seccomp
Seccomp: 2
Test: cat /proc/`pgrep .extractor`/status | grep Seccomp
Seccomp: 2
Change-Id: Ia8be7b9c3d6163804d2a45954f8d03315ae32e7a
To enable the Treble version of IOmx in mediacodec process, use "setprop
debug.treble_omx 1".
Test: Compiles
Bug: 31399200
Change-Id: I0935dc7943e25067f5d8e75264cf2b088498a862
The mediacodec process will attempt to load one or
more HIDL HALs. Code for retrieving a handle to HAL
services recently changed to include retrieving and
parsing a manifest from the device; this parsing code
causes the _llseek system call to be executed, which
was previously not allowed.
Since mediacodec already has lseek, adding _llseek
here should be safe.
Bug: 34692351
Test: media.codec no longer crashes
Change-Id: I7f0b173522a8e88395f54c7d2630270509f7799c
This CL whitelists the mremap() syscall for the seccomp filter for
mediacodec. We need to do this for CFI, which uses mremap
internally.
Bug: 30227045
Test: m -j40 and the device boots and works.
Change-Id: I3b95798b4c8653bd95fb1b3d54060d4a12adc5bd
This is useful if we have multiple device
layers and want to have common extensions while
supporting device specific extensions at the same time.
Change-Id: Iefbff9c1ec680963a7ea4c2db09d8e888dd87703
Signed-off-by: Alex Naidis <alex.naidis@linux.com>
Seeing the following build errors:
$ . ./build/envsetup.sh && lunch aosp_dragon-userdebug
$ m -j 50
...
Starting build with ninja
ninja: Entering directory `.'
ninja: error: 'device/google/dragon/seccomp/mediaextractor-seccomp.policy', needed by 'out/target/product/dragon/obj/ETC/mediaextractor-seccomp.policy_intermediates/mediaextractor-seccomp.policy', missing and no known rule to make it
make: *** [ninja_wrapper] Error 1
make: Leaving directory `/SDD/master'
This reverts commit 87a80ef1e3.
Change-Id: I5d039845c69b18f3a7199458c5301314d006f43b
This is useful if we have multiple device
layers and want to have common extensions while
supporting device specific extensions at the same time.
Change-Id: Iefbff9c1ec680963a7ea4c2db09d8e888dd87702
Signed-off-by: Alex Naidis <alex.naidis@linux.com>
Parcel validation will call getrlimit() approximately
once per process that uses Parcels.
Bug 26696080
Change-Id: I59c5d6d648976d9d8618f161b4164c959f191a7e
mediacodec always runs in 32 bit mode so the arm seccomp filter is also
used on arm64 devices.
Tests: mediaserver CTS for bullhead, volantis and shamu
Add policy to log blocked syscalls to syslog and allow debuggerd attach
on mediacodec crash.
Bug: 27066802, 27064966
Change-Id: I4bdbba25b8847afa98d89b4b4ca863829fa19754
Encoders and secure decoders still run in the mediaserver, while
all other codecs run in a separate codec process.
Bug: 22775369
Change-Id: Ifbcab8a8f2fe77d2567830ac88f0d982e77f7b00
Treehugger Robot
Steven Moreland
Daniel Micay
Christopher Ferris
Chih-hung Hsieh
YOUNG HO CHA
Josh Gao
Pawin Vongmasa
Dimitry Ivanov
Iliyan Malchev
Jeff Vander Stoep
Mathias Agopian
Jorge Lucangeli Obes
Marco Nelissen
Martijn Coenen
Vishwath Mohan
Mark Salyzyn
Alex Naidis
Nick Kralevich
Christopher Tate