debian/control: add Depends on pipewire-pulse | pulseaudio

[waydroid.git] / tools / helpers / lxc.py

diff --git a/tools/helpers/lxc.py b/tools/helpers/lxc.py
index b8c0485b921c727a7ebf22192aeafa546f124dd5..79eac733a44f2258383868f2664efd185f3a46f6 100644 (file)
--- a/tools/helpers/lxc.py
+++ b/tools/helpers/lxc.py
@@ -247,6 +247,10 @@ def make_base_props(args):
     if not os.path.exists("/dev/ashmem"):
         props.append("sys.use_memfd=true")
 
+    # Added for security reasons
+    props.append("ro.adb.secure=1")
+    props.append("ro.debuggable=0")
+
     egl = tools.helpers.props.host_get(args, "ro.hardware.egl")
     dri, _ = tools.helpers.gpu.getDriNode(args)
 
@@ -434,13 +438,15 @@ def android_env_attach_options(args):
     command = ["lxc-attach", "-P", tools.config.defaults["lxc"],
                "-n", "waydroid", "--clear-env", "--",
                "/system/bin/cat" ,"/data/system/environ/classpath"]
+    allowed = ["CLASSPATH", "SYSTEMSERVER"]
     try:
         p = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL)
         out, _ = p.communicate()
         if p.returncode == 0:
             for line in out.decode().splitlines():
                 _, k, v = line.split(' ', 2)
-                local_env[k] = v
+                if any(pattern in k for pattern in allowed):
+                    local_env[k] = v
     except:
         pass
     env = [k + "=" + v for k, v in local_env.items()]