From b64e9cba72fb223fb440c150a951bb240df8beee Mon Sep 17 00:00:00 2001
From: Nick Kralevich <nnk@google.com>
Date: Mon, 4 Mar 2013 11:38:30 -0800
Subject: [PATCH] Zygote: set PR_SET_NO_NEW_PRIVS

call prctl(PR_SET_NO_NEW_PRIVS, 1) to prevent Zygote and zygote
spawned applications from aquiring new privileges.

Change-Id: I69bbf6bb5b01b877de414ecad43d3dffbd5fcea0
---
 vm/Init.cpp | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/vm/Init.cpp b/vm/Init.cpp
index 35c108579..9169a5da6 100644
--- a/vm/Init.cpp
+++ b/vm/Init.cpp
@@ -28,6 +28,9 @@
 #include <linux/fs.h>
 #include <cutils/fs.h>
 #include <unistd.h>
+#ifdef HAVE_ANDROID_OS
+#include <sys/prctl.h>
+#endif
 
 #include "Dalvik.h"
 #include "test/Test.h"
@@ -1711,6 +1714,20 @@ static bool initZygote()
         return -1;
     }
 
+#ifdef HAVE_ANDROID_OS
+    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
+        if (errno == EINVAL) {
+            SLOGW("PR_SET_NO_NEW_PRIVS failed. "
+                  "Is your kernel compiled correctly?: %s", strerror(errno));
+            // Don't return -1 here, since it's expected that not all
+            // kernels will support this option.
+        } else {
+            SLOGW("PR_SET_NO_NEW_PRIVS failed: %s", strerror(errno));
+            return -1;
+        }
+    }
+#endif
+
     return true;
 }
 
-- 
2.11.0