Merge lp:~xnox/ubuntu/trusty/lxc-android-config/add-generic-rules into lp:ubuntu/trusty/lxc-android-config

[Dimitri John Ledkov]

Trusty is now open, re-proposing https://code.launchpad.net/~xnox/ubuntu/saucy/lxc-android-config/add-generic-rules/+merge/189792

[Martin Pitt (pitti)]

What's the purpose of setting owner and group if the permissions are 666 anyway? Is there any way the permissions could be made to not be world-writable, especially for the ttyS*? What do the qemu_* devices do, are these potentially security/robustness relevant?

review: Needs Fixing

[Dimitri John Ledkov (xnox)]

On 13 November 2013 08:00, Martin Pitt <email address hidden> wrote:
> Review: Needs Fixing
>
> What's the purpose of setting owner and group if the permissions are 666 anyway? Is there any way the permissions could be made to not be world-writable, especially for the ttyS*? What do the qemu_* devices do, are these potentially security/robustness relevant?

Well, that's just copy/paste what's done on stock android. Indeed
having them non world-writable would be better, not sure what will
break. qemu_* devices communicate with qemu devices (hypervisor?) and
host OS (adb). Not sure how the attack vector would look like, given
that it is emulator. I'll open a bug to limit the permissions on
these. Since this branch is merged already.

Regards,

Dmitrijs.

[Dimitri John Ledkov (xnox)]

opened bug: https://bugs.launchpad.net/ubuntu/+source/lxc-android-config/+bug/1250769

[Oliver Grawert (ogra)]

I think we should try to restrict them once we have the emulator going. To make it work it seems to be better to use what the android side uses in a first iteration though ...

=== modified file 'debian/changelog'
--- debian/changelog	2013-10-22 21:08:25 +0000
+++ debian/changelog	2013-10-23 13:18:56 +0000
@@ -1,3 +1,9 @@
+lxc-android-config (0.118) UNRELEASED; urgency=low
+
+  * Add udev rules for generic goldfish emulator.
+
+ -- Dmitrijs Ledkovs <[e-mail]>  Wed, 23 Oct 2013 14:17:48 +0100
+
 lxc-android-config (0.117) trusty; urgency=low
 
   * Use Mir on the goldfish emulator as well; we definitely don't care about

=== added file 'usr/lib/lxc-android-config/70-generic.rules'
--- usr/lib/lxc-android-config/70-generic.rules	1970-01-01 00:00:00 +0000
+++ usr/lib/lxc-android-config/70-generic.rules	2013-10-23 13:18:56 +0000
@@ -0,0 +1,4 @@
+# Rules for goldfish qemu emulator
+ACTION=="add", KERNEL=="qemu_trace", OWNER="system", GROUP="system", MODE="0666"
+ACTION=="add", KERNEL=="qemu_pipe", OWNER="system", GROUP="system", MODE="0666"
+ACTION=="add", KERNEL=="ttyS*", OWNER="system", GROUP="system", MODE="0666"