哪些Syscalls在Android 8.0 Oreo中受限制？

編輯：Syscall過濾背景

過濾本身是Linux內核提供的標準功能,稱為seccomp.所有AOSP都使用此功能來過濾上面鏈接的應用黑名單中列出的系統調用.腳本處理將黑名單列入特定于平臺的自動生成過濾器,然后將其提供給seccomp,以啟動所有Android應用程序(即Zygote).一旦此過濾處于活動狀態,從過濾后的過程(即任何應用程序)進行匹配的系統調用將導致交付SIGKILL signal.有關Linux信號的一些一般信息,請參閱here.由您鏈接的AOSP源打印的錯誤消息只是系統在發現您的進程被終止時嘗試給您一些有用的信息 – 請注意方法名稱是dump_probable_cause.

阻止Syscalls修改ID

+--------------------------------------------------+--------------------------+

| Function | Blocked On |

+--------------------------------------------------+--------------------------+

| int setgid:setgid32(gid_t) | arm,x86 |

| int setgid:setgid(gid_t) | arm64,mips,mips64,x86_64 |

| int setuid:setuid32(uid_t) | arm,x86 |

| int setuid:setuid(uid_t) | arm64,mips,mips64,x86_64 |

| int setreuid:setreuid32(uid_t, uid_t) | arm,x86 |

| int setreuid:setreuid(uid_t, uid_t) | arm64,mips,mips64,x86_64 |

| int setresuid:setresuid32(uid_t, uid_t, uid_t) | arm,x86 |

| int setresuid:setresuid(uid_t, uid_t, uid_t) | arm64,mips,mips64,x86_64 |

| int setresgid:setresgid32(gid_t, gid_t, gid_t) | arm,x86 |

| int setresgid:setresgid(gid_t, gid_t, gid_t) | arm64,mips,mips64,x86_64 |

| int setfsgid(gid_t) | all |

| int setfsuid(uid_t) | all |

| int setgroups:setgroups32(int, const gid_t*) | arm,x86 |

| int setgroups:setgroups(int, const gid_t*) | arm64,mips,mips64,x86_64 |

+--------------------------------------------------+--------------------------+

阻止Syscalls修改時間

+--------------------------------------------------------------------+------------+

| Function | Blocked On |

+--------------------------------------------------------------------+------------+

| int adjtimex(struct timex*) | all |

| int clock_adjtime(clockid_t, struct timex*) | all |

| int clock_settime(clockid_t, const struct timespec*) | all |

| int settimeofday(const struct timeval*, const struct timezone*) | all |

| int acct(const char* filepath) | all |

| int klogctl:syslog(int, char*, int) | all |

| int capset(cap_user_header_t header, const cap_user_data_t data) | all |

| int chroot(const char*) | all |

+--------------------------------------------------------------------+------------+

阻止Syscalls改變各種機器配置

+--------------------------------------------------------------------------------+------------+

| Function | Blocked On |

+--------------------------------------------------------------------------------+------------+

| int init_module(void*, unsigned long, const char*) | all |

| int delete_module(const char*, unsigned int) | all |

| int mount(const char*, const char*, const char*, unsigned long, const void*) | all |

| int umount2(const char*, int) | all |

| int swapon(const char*, int) | all |

| int swapoff(const char*) | all |

| int setdomainname(const char*, size_t) | all |

| int sethostname(const char*, size_t) | all |

| int __reboot:reboot(int, int, int, void*) | all |

+--------------------------------------------------------------------------------+------------+

總結

以上是生活随笔為你收集整理的android oreo 源码,android – Oreo：如何在源代码中找到所有受限制的系统调用？的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。