{"push_id":1131562832,"size":4,"distinct_size":4,"ref":"refs/heads/rebase","head":"c4a91e720bcfef8935a1c814cc336da46228a8ad","before":"70af82f5e76b7dbab094136211c2afedfc2ca573","commits":[{"sha":"4ea6a3aeecea0ec9fbf9b434d609e46e9334cbb9","author":{"name":"Jorge Lucangeli Obes","email":"da39a3ee5e6b4b0d3255bfef95601890afd80709"},"message":"Add more first-party Brillo system users.\n\nBrillo is converging on a set of mandatory system services to be\nincluded in all Brillo builds. We'd like these services to run as\nseparate users just like other native Android/Brillo system services.\n\nAdd users for these services:\n-Firewalld: Brillo has more granular firewall requirements (think e.g.\n  Brillo-powered router.) Firewalld exposes a (currently) D-Bus/\n  (soon to be) Binder API to broker access to IPTables rules.\n-Trunksd: Some Brillo product configs will require TPMs. Trunksd\n  manages TPMs in Chrome OS and Brillo.\n\nBug: 27299198\n\nChange-Id: Ibe3303acdd9398ea52da0a37dbef73e5c5a948f7","distinct":true,"url":"https://api.github.com/repos/osm0sis/mkbootfs/commits/4ea6a3aeecea0ec9fbf9b434d609e46e9334cbb9"},{"sha":"4bc2b0bfdcec899df63d4927ad030d8179e049d8","author":{"name":"Jorge Lucangeli Obes","email":"da39a3ee5e6b4b0d3255bfef95601890afd80709"},"message":"Add notice for adding users in AOSP.\n\nSometimes new users/groups get added in internal branches, and the list\ngets out of sync. Add a comment to prompt developers to add users in\nAOSP.\n\nBug: None\nChange-Id: I5b2df391902b842f1af8a377c8eac4cdb36a0518","distinct":true,"url":"https://api.github.com/repos/osm0sis/mkbootfs/commits/4bc2b0bfdcec899df63d4927ad030d8179e049d8"},{"sha":"87c78954f61b15ce06c27ba042103e020a77f72c","author":{"name":"Mattias Nissler","email":"da39a3ee5e6b4b0d3255bfef95601890afd80709"},"message":"Add nvram user.\n\nThis is intended to be used by user space daemons that are part of\naccess-controlled NVRAM HAL implementations for Brillo. Because there\nmight be sensitive data flowing through the daemon, we'd like to run\nit as a separate user.\n\nBUG: 27764637\nChange-Id: If6ad7923af3c650963ee9e926f732001b6a8cb5d","distinct":true,"url":"https://api.github.com/repos/osm0sis/mkbootfs/commits/87c78954f61b15ce06c27ba042103e020a77f72c"},{"sha":"c4a91e720bcfef8935a1c814cc336da46228a8ad","author":{"name":"Nick Kralevich","email":"da39a3ee5e6b4b0d3255bfef95601890afd80709"},"message":"Enable hidepid=2 on /proc\n\nAdd the following mount options to the /proc filesystem:\n\n  hidepid=2,gid=3009\n\nThis change blocks /proc access unless you're in group 3009\n(aka AID_READPROC).\n\nPlease see\n  https://github.com/torvalds/linux/blob/master/Documentation/filesystems/proc.txt\nfor documentation on the hidepid option.\n\nhidepid=2 is preferred over hidepid=1 since it leaks less information\nand doesn't generate SELinux ptrace denials when trying to access\n/proc without being in the proper group.\n\nAdd AID_READPROC to processes which need to access /proc entries for\nother UIDs.\n\nBug: 23310674\nChange-Id: I22bb55ff7b80ff722945e224845215196f09dafa","distinct":true,"url":"https://api.github.com/repos/osm0sis/mkbootfs/commits/c4a91e720bcfef8935a1c814cc336da46228a8ad"}]}
{"actor":{"display_login":"osm0sis"}}