A seccomp profile for the entire container has been added.

[waydroid.git] / tools / helpers / lxc.py

diff --git a/tools/helpers/lxc.py b/tools/helpers/lxc.py
index de217e3477642450c10d377796a6ab11d23e8d4b..a13f838e1b779c97740d1b9682b90ccec14f8938 100644 (file)
--- a/tools/helpers/lxc.py
+++ b/tools/helpers/lxc.py
@@ -7,6 +7,7 @@ import logging
 import glob
 import shutil
 import platform
+import gbinder
 import tools.config
 import tools.helpers.run
 
@@ -51,7 +52,7 @@ def generate_nodes_lxc_config(args):
     make_entry("/dev/pvr_sync")
     make_entry("/dev/pmsg0")
     make_entry("/dev/dxg")
-    make_entry("/dev/dri", options="bind,create=dir,optional 0 0")
+    make_entry(tools.helpers.gpu.getDriNode(args), "dev/dri/renderD128")
 
     for n in glob.glob("/dev/fb*"):
         make_entry(n)
@@ -74,6 +75,9 @@ def generate_nodes_lxc_config(args):
     make_entry("none", "dev/pts", "devpts", "defaults,mode=644,ptmxmode=666,create=dir 0 0", False)
     make_entry("/dev/uhid")
 
+    # TUN/TAP device node for VPN
+    make_entry("/dev/net/tun", "dev/tun")
+
     # Low memory killer sys node
     make_entry("/sys/module/lowmemorykiller", options="bind,create=dir,optional 0 0")
 
@@ -118,6 +122,9 @@ def generate_nodes_lxc_config(args):
     for n in glob.glob("/tmp/run-*"):
         make_entry(n, options="rbind,create=dir,optional 0 0")
 
+    # NFC config
+    make_entry("/system/etc/libnfc-nci.conf", options="bind,optional 0 0")
+
     return nodes
 
 
@@ -130,6 +137,7 @@ def set_lxc_config(args):
     elif lxc_ver <= 2:
         config_file = "config_1"
     config_path = tools.config.tools_src + "/data/configs/" + config_file
+    seccomp_profile = tools.config.tools_src + "/data/configs/waydroid.seccomp"
 
     command = ["mkdir", "-p", lxc_path]
     tools.helpers.run.user(args, command)
@@ -137,6 +145,8 @@ def set_lxc_config(args):
     tools.helpers.run.user(args, command)
     command = ["sed", "-i", "s/LXCARCH/{}/".format(platform.machine()), lxc_path + "/config"]
     tools.helpers.run.user(args, command)
+    command = ["cp", "-fpr", seccomp_profile, lxc_path + "/waydroid.seccomp"]
+    tools.helpers.run.user(args, command)
 
     nodes = generate_nodes_lxc_config(args)
     config_nodes_tmp_path = args.work + "/config_nodes"
@@ -165,12 +175,30 @@ def make_base_props(args):
                         return prop
         return ""
 
+    def find_hidl(intf):
+        if args.vendor_type == "MAINLINE":
+            return False
+
+        try:
+            sm = gbinder.ServiceManager("/dev/hwbinder")
+            return intf in sm.list_sync()
+        except:
+            return False
+
     props = []
+
+    if not os.path.exists("/dev/ashmem"):
+        props.append("sys.use_memfd=true")
+
     egl = tools.helpers.props.host_get(args, "ro.hardware.egl")
+    dri = tools.helpers.gpu.getDriNode(args)
 
     gralloc = find_hal("gralloc")
-    if gralloc == "":
-        if os.path.exists("/dev/dri"):
+    if not gralloc:
+        if find_hidl("android.hardware.graphics.allocator@4.0::IAllocator/default"):
+            gralloc = "android"
+    if not gralloc:
+        if dri:
             gralloc = "gbm"
             egl = "mesa"
         else:
@@ -199,7 +227,9 @@ def make_base_props(args):
         props.append("ro.vendor.extension_library=" + ext_library)
 
     vulkan = find_hal("vulkan")
-    if vulkan != "":
+    if not vulkan and dri:
+        vulkan = tools.helpers.gpu.getVulkanDriver(args, os.path.basename(dri))
+    if vulkan:
         props.append("ro.hardware.vulkan=" + vulkan)
 
     treble = tools.helpers.props.host_get(args, "ro.treble.enabled")
@@ -216,13 +246,42 @@ def make_base_props(args):
         opengles = "196608"
     props.append("ro.opengles.version=" + opengles)
 
-    props.append("waydroid.system_ota=" + args.system_ota)
-    props.append("waydroid.vendor_ota=" + args.vendor_ota)
+    if args.images_path != tools.config.defaults["preinstalled_images_path"]:
+        props.append("waydroid.system_ota=" + args.system_ota)
+        props.append("waydroid.vendor_ota=" + args.vendor_ota)
+    else:
+        props.append("waydroid.updater.disabled=true")
+
     props.append("waydroid.tools_version=" + tools.config.version)
 
     if args.vendor_type == "MAINLINE":
         props.append("ro.vndk.lite=true")
 
+    for product in ["brand", "device", "manufacturer", "model", "name"]:
+        prop_product = tools.helpers.props.host_get(
+            args, "ro.product.vendor." + product)
+        if prop_product != "":
+            props.append("ro.product.waydroid." + product + "=" + prop_product)
+        else:
+            if os.path.isfile("/proc/device-tree/" + product):
+                with open("/proc/device-tree/" + product) as f:
+                    f_value = f.read().strip().rstrip('\x00')
+                    if f_value != "":
+                        props.append("ro.product.waydroid." +
+                                     product + "=" + f_value)
+
+    prop_fp = tools.helpers.props.host_get(args, "ro.vendor.build.fingerprint")
+    if prop_fp != "":
+        props.append("ro.build.fingerprint=" + prop_fp)
+
+    # now append/override with values in [properties] section of waydroid.cfg
+    cfg = tools.config.load(args)
+    for k, v in cfg["properties"].items():
+        for idx, elem in enumerate(props):
+            if (k+"=") in elem:
+                props.pop(idx)
+        props.append(k+"="+v)
+
     base_props = open(args.work + "/waydroid_base.prop", "w")
     for prop in props:
         base_props.write(prop + "\n")