StrixOS/build
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "aflags: only permit enable/disable with root access." into main

Browse Source
This commit is contained in:
Ted Bauer
2024-03-08 15:51:57 +00:00
committed by Gerrit Code Review
parent 760d21d991 a98448f4e7
commit 71287f5e6b
3 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
tools/aconfig/aflags/Android.bp
View File

@@ -12,6 +12,7 @@ rust_defaults {
"libaconfig_protos", "libaconfig_protos",
"libanyhow", "libanyhow",
"libclap", "libclap",
"libnix",
"libprotobuf", "libprotobuf",
"libregex", "libregex",
], ],

1
tools/aconfig/aflags/Cargo.toml
View File

@@ -10,3 +10,4 @@ clap = { version = "4", features = ["derive"] }
protobuf = "3.2.0" protobuf = "3.2.0"
regex = "1.10.3" regex = "1.10.3"
aconfig_protos = { path = "../aconfig_protos" } aconfig_protos = { path = "../aconfig_protos" }
nix = { version = "0.28.0", features = ["user"] }

13
tools/aconfig/aflags/src/main.rs
View File

@@ -16,13 +16,13 @@
//! `aflags` is a device binary to read and write aconfig flags. //! `aflags` is a device binary to read and write aconfig flags.
use anyhow::{anyhow, Result}; use anyhow::{anyhow, ensure, Result};
use clap::Parser; use clap::Parser;
mod device_config_source; mod device_config_source;
use device_config_source::DeviceConfigSource; use device_config_source::DeviceConfigSource;
#[derive(Clone)] #[derive(Clone, PartialEq)]
enum FlagPermission { enum FlagPermission {
ReadOnly, ReadOnly,
ReadWrite, ReadWrite,
@@ -168,16 +168,15 @@ fn format_flag_row(flag: &Flag, info: &PaddingInfo) -> String {
} }
fn set_flag(qualified_name: &str, value: &str) -> Result<()> { fn set_flag(qualified_name: &str, value: &str) -> Result<()> {
ensure!(nix::unistd::Uid::current().is_root(), "must be root to mutate flags");
let flags_binding = DeviceConfigSource::list_flags()?; let flags_binding = DeviceConfigSource::list_flags()?;
let flag = flags_binding.iter().find(|f| f.qualified_name() == qualified_name).ok_or( let flag = flags_binding.iter().find(|f| f.qualified_name() == qualified_name).ok_or(
anyhow!("no aconfig flag '{qualified_name}'. Does the flag have an .aconfig definition?"), anyhow!("no aconfig flag '{qualified_name}'. Does the flag have an .aconfig definition?"),
)?; )?;
if let FlagPermission::ReadOnly = flag.permission { ensure!(flag.permission == FlagPermission::ReadWrite,
return Err(anyhow!( format!("could not write flag '{qualified_name}', it is read-only for the current release configuration."));
"could not write flag '{qualified_name}', it is read-only for the current release configuration.",
));
}
DeviceConfigSource::override_flag(&flag.namespace, qualified_name, value)?; DeviceConfigSource::override_flag(&flag.namespace, qualified_name, value)?;