From db929bf9b740b3b7c02cf0acc07fee94406f3b3f Mon Sep 17 00:00:00 2001
From: Paul Lawrence <paullawrence@google.com>
Date: Fri, 21 Oct 2016 13:13:02 -0700
Subject: Enable seccomp in init with generated policy

Test: Ran script to test performance - https://b.corp.google.com/issues/32313202#comment3
      Saw no significant regression with this change on or off
      Removed chroot from SYSCALLS.TXT - chroot blocked
      Boot time appears reasonable
      Device boots with no SECCOMP blockings
      Measured per syscall time of 100ns
      Empirically counted <100,000 syscalls a second under heavy load

Bug: 32313202
Change-Id: Icfcfbcb72b2de1b38f1ad6a82e8ece3bd1c9e7ec
---
 init/Android.mk | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'init/Android.mk')

diff --git a/init/Android.mk b/init/Android.mk
index 111fe895f..212288006 100644
--- a/init/Android.mk
+++ b/init/Android.mk
@@ -70,6 +70,7 @@ LOCAL_SRC_FILES:= \
     init.cpp \
     keychords.cpp \
     property_service.cpp \
+    seccomp.cpp \
     signal_handler.cpp \
     ueventd.cpp \
     ueventd_parser.cpp \
@@ -96,6 +97,7 @@ LOCAL_STATIC_LIBRARIES := \
     libbase \
     libc \
     libselinux \
+    libseccomp_policy \
     liblog \
     libcrypto_utils \
     libcrypto \
-- 
cgit v1.2.3