Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Kaschey758 #1114

Closed
kaschey77 opened this issue May 21, 2023 · 1 comment · Fixed by #1096 or #1089
Closed

Kaschey758 #1114

kaschey77 opened this issue May 21, 2023 · 1 comment · Fixed by #1096 or #1089

Comments

@kaschey77
Copy link

Copyright (C) 2017 The Android Open Source Project

Bionic loader config file.

Don't change the order here. The first pattern that matches with the

absolute path of an executable is selected.

dir.system = /system/bin/
dir.system = /system/xbin/
dir.system = /system/product/bin/

dir.vendor = /odm/bin/
dir.vendor = /vendor/bin/
dir.vendor = /data/nativetest/odm
dir.vendor = /data/nativetest64/odm
dir.vendor = /data/benchmarktest/odm
dir.vendor = /data/benchmarktest64/odm
dir.vendor = /data/nativetest/vendor
dir.vendor = /data/nativetest64/vendor
dir.vendor = /data/benchmarktest/vendor
dir.vendor = /data/benchmarktest64/vendor

dir.unrestricted = /data/nativetest/unrestricted
dir.unrestricted = /data/nativetest64/unrestricted

TODO(b/123864775): Ensure tests are run from /data/nativetest{,64} or (if

necessary) the unrestricted subdirs above. Then clean this up.

dir.unrestricted = /data/local/tmp

dir.postinstall = /postinstall

Fallback entry to provide APEX namespace lookups for binaries anywhere else.

This must be last.

dir.system = /data

[system]
additional.namespaces = runtime,conscrypt,media,resolv,sphal,vndk,rs

###############################################################################

"default" namespace

Framework-side code runs in this namespace. Libs from /vendor partition

can't be loaded in this namespace.

###############################################################################
namespace.default.isolated = true

namespace.default.search.paths = /system/${LIB}
namespace.default.search.paths += /system/product/${LIB}
#vendor auto add
namespace.default.search.paths += /oppo_product/${LIB}
#vendor auto add
namespace.default.search.paths += /oppo_custom/${LIB}
#vendor auto add
namespace.default.search.paths += /oppo_version/${LIB}
#vendor auto add
namespace.default.search.paths += /oppo_engineering/${LIB}

We can't have entire /system/${LIB} as permitted paths because doing so

makes it possible to load libs in /system/${LIB}/vndk* directories by

their absolute paths (e.g. dlopen("/system/lib/vndk/libbase.so");).

VNDK libs are built with previous versions of Android and thus must not be

loaded into this namespace where libs built with the current version of

Android are loaded. Mixing the two types of libs in the same namespace can

cause unexpected problem.

namespace.default.permitted.paths = /system/${LIB}/drm
namespace.default.permitted.paths += /system/${LIB}/oiface
namespace.default.permitted.paths += /system/${LIB}/extractors
namespace.default.permitted.paths += /system/${LIB}/hw
namespace.default.permitted.paths += /system/product/${LIB}
#vendor auto add
namespace.default.permitted.paths += /oppo_product/${LIB}
#vendor auto add
namespace.default.permitted.paths += /oppo_custom/${LIB}
#vendor auto add
namespace.default.permitted.paths += /oppo_version/${LIB}
#vendor auto add
namespace.default.permitted.paths += /oppo_engineering/${LIB}

These are where odex files are located. libart has to be able to dlopen the files

namespace.default.permitted.paths += /system/framework
namespace.default.permitted.paths += /system/app
namespace.default.permitted.paths += /system/priv-app
namespace.default.permitted.paths += /vendor/framework
namespace.default.permitted.paths += /vendor/app
namespace.default.permitted.paths += /vendor/priv-app
namespace.default.permitted.paths += /system/vendor/framework
namespace.default.permitted.paths += /system/vendor/app
namespace.default.permitted.paths += /system/vendor/priv-app
namespace.default.permitted.paths += /odm/framework
namespace.default.permitted.paths += /odm/app
namespace.default.permitted.paths += /odm/priv-app
namespace.default.permitted.paths += /oem/app
namespace.default.permitted.paths += /system/product/framework
namespace.default.permitted.paths += /system/product/app
namespace.default.permitted.paths += /system/product/priv-app
namespace.default.permitted.paths += /data
namespace.default.permitted.paths += /mnt/expand
namespace.default.permitted.paths += /apex/com.android.runtime/${LIB}/bionic
namespace.default.permitted.paths += /system/${LIB}/bootstrap

namespace.default.asan.search.paths = /data/asan/system/${LIB}
namespace.default.asan.search.paths += /system/${LIB}
namespace.default.asan.search.paths += /data/asan/system/product/${LIB}
namespace.default.asan.search.paths += /system/product/${LIB}
#vendor auto add
namespace.default.asan.search.paths += /oppo_product/${LIB}
#vendor auto add
namespace.default.asan.search.paths += /oppo_custom/${LIB}
#vendor auto add
namespace.default.asan.search.paths += /oppo_version/${LIB}
#vendor auto add
namespace.default.asan.search.paths += /oppo_engineering/${LIB}

namespace.default.asan.permitted.paths = /data
namespace.default.asan.permitted.paths += /system/${LIB}/drm
namespace.default.asan.permitted.paths += /system/${LIB}/extractors
namespace.default.asan.permitted.paths += /system/${LIB}/hw
namespace.default.asan.permitted.paths += /system/framework
namespace.default.asan.permitted.paths += /system/app
namespace.default.asan.permitted.paths += /system/priv-app
namespace.default.asan.permitted.paths += /vendor/framework
namespace.default.asan.permitted.paths += /vendor/app
namespace.default.asan.permitted.paths += /vendor/priv-app
namespace.default.asan.permitted.paths += /system/vendor/framework
namespace.default.asan.permitted.paths += /system/vendor/app
namespace.default.asan.permitted.paths += /system/vendor/priv-app
namespace.default.asan.permitted.paths += /odm/framework
namespace.default.asan.permitted.paths += /odm/app
namespace.default.asan.permitted.paths += /odm/priv-app
namespace.default.asan.permitted.paths += /oem/app
namespace.default.asan.permitted.paths += /system/product/${LIB}
#vendor auto add
namespace.default.asan.permitted.paths += /oppo_product/${LIB}
#vendor auto add
namespace.default.asan.permitted.paths += /oppo_custom/${LIB}
#vendor auto add
namespace.default.asan.permitted.paths += /oppo_version/${LIB}
#vendor auto add
namespace.default.asan.permitted.paths += /oppo_engineering/${LIB}
namespace.default.asan.permitted.paths += /system/product/framework
namespace.default.asan.permitted.paths += /system/product/app
namespace.default.asan.permitted.paths += /system/product/priv-app
namespace.default.asan.permitted.paths += /mnt/expand
namespace.default.asan.permitted.paths += /apex/com.android.runtime/${LIB}/bionic
namespace.default.asan.permitted.paths += /system/${LIB}/bootstrap

Keep in sync with ld.config.txt in the com.android.runtime APEX.

If a shared library or an executable requests a shared library that

cannot be loaded into the default namespace, the dynamic linker tries

to load the shared library from the runtime namespace. And then, if the

shared library cannot be loaded from the runtime namespace either, the

dynamic linker tries to load the shared library from the resolv namespace.

Finally, if all attempts fail, the dynamic linker returns an error.

namespace.default.links = runtime,resolv

Visible because some libraries are dlopen'ed, e.g. libopenjdk is dlopen'ed by

libart.

namespace.default.visible = true
namespace.default.link.runtime.shared_libs = libdexfile_external.so

libicuuc.so and libicui18n.so are kept for app compat reason. http://b/130788466

namespace.default.link.runtime.shared_libs += libicui18n.so
namespace.default.link.runtime.shared_libs += libicuuc.so
namespace.default.link.runtime.shared_libs += libnativebridge.so
namespace.default.link.runtime.shared_libs += libnativehelper.so
namespace.default.link.runtime.shared_libs += libnativeloader.so
namespace.default.link.runtime.shared_libs += libandroidicu.so

TODO(b/122876336): Remove libpac.so once it's migrated to Webview

namespace.default.link.runtime.shared_libs += libpac.so

When libnetd_resolv.so can't be found in the default namespace, search for it

in the resolv namespace. Don't allow any other libraries from the resolv namespace

to be loaded in the default namespace.

namespace.default.link.resolv.shared_libs = libnetd_resolv.so

###############################################################################

"runtime" APEX namespace

This namespace exposes externally accessible libraries from the Runtime APEX.

###############################################################################
namespace.runtime.isolated = true
namespace.runtime.visible = true

Keep in sync with ld.config.txt in the com.android.runtime APEX.

namespace.runtime.search.paths = /apex/com.android.runtime/${LIB}
namespace.runtime.asan.search.paths = /apex/com.android.runtime/${LIB}
namespace.runtime.links = default

TODO(b/119867084): Restrict to Bionic dlopen dependencies and PALette library

when it exists.

namespace.runtime.link.default.allow_all_shared_libs = true

###############################################################################

"media" APEX namespace

This namespace is for libraries within the media APEX.

###############################################################################
namespace.media.isolated = true
namespace.media.visible = true

namespace.media.search.paths = /apex/com.android.media/${LIB}
namespace.media.asan.search.paths = /apex/com.android.media/${LIB}

namespace.media.permitted.paths = /apex/com.android.media/${LIB}/extractors
namespace.media.asan.permitted.paths = /apex/com.android.media/${LIB}/extractors

namespace.media.links = default
namespace.media.link.default.shared_libs = libEGL.so:libGLESv1_CM.so:libGLESv2.so:libGLESv3.so:libRS.so:libandroid_net.so:libc.so:libcgrouprc.so:libclang_rt.asan-aarch64-android.so:libclang_rt.asan-arm-android.so:libclang_rt.hwasan-aarch64-android.so:libdl.so:libft2.so:liblog.so:libm.so:libmediandk.so:libnativewindow.so:libneuralnetworks.so:libsync.so:libvndksupport.so:libvulkan.so
namespace.media.link.default.shared_libs += libbinder_ndk.so
namespace.media.link.default.shared_libs += libcgrouprc.so
namespace.media.link.default.shared_libs += libmediametrics.so
namespace.media.link.default.shared_libs += libclang_rt.asan-aarch64-android.so:libclang_rt.hwasan-aarch64-android.so:libclang_rt.ubsan_standalone-aarch64-android.so:libclang_rt.tsan-aarch64-android.so:libclang_rt.asan-arm-android.so:libclang_rt.hwasan-arm-android.so:libclang_rt.ubsan_standalone-arm-android.so:libclang_rt.tsan-arm-android.so

###############################################################################

"conscrypt" APEX namespace

This namespace is for libraries within the conscrypt APEX.

###############################################################################
namespace.conscrypt.isolated = true
namespace.conscrypt.visible = true

Keep in sync with ld.config.txt in the com.android.runtime APEX.

namespace.conscrypt.search.paths = /apex/com.android.conscrypt/${LIB}
namespace.conscrypt.asan.search.paths = /apex/com.android.conscrypt/${LIB}
namespace.conscrypt.links = runtime,default
namespace.conscrypt.link.runtime.shared_libs = libandroidio.so
namespace.conscrypt.link.default.shared_libs = libc.so
namespace.conscrypt.link.default.shared_libs += libm.so
namespace.conscrypt.link.default.shared_libs += libdl.so
namespace.conscrypt.link.default.shared_libs += liblog.so

###############################################################################

"resolv" APEX namespace

This namespace is for libraries within the resolv APEX.

###############################################################################
namespace.resolv.isolated = true
namespace.resolv.visible = true

namespace.resolv.search.paths = /apex/com.android.resolv/${LIB}
namespace.resolv.asan.search.paths = /apex/com.android.resolv/${LIB}
namespace.resolv.links = default
namespace.resolv.link.default.shared_libs = libc.so
namespace.resolv.link.default.shared_libs += libcgrouprc.so
namespace.resolv.link.default.shared_libs += libm.so
namespace.resolv.link.default.shared_libs += libdl.so
namespace.resolv.link.default.shared_libs += libbinder_ndk.so
namespace.resolv.link.default.shared_libs += liblog.so
namespace.resolv.link.default.shared_libs += libvndksupport.so

###############################################################################

"sphal" namespace

SP-HAL(Sameprocess-HAL)s are the only vendor libraries that are allowed to be

loaded inside system processes. libEGL_.so, libGLESv2_.so,

[email protected], etc are SP-HALs.

This namespace is exclusivly for SP-HALs. When the framework tries to dynami-

cally load SP-HALs, android_dlopen_ext() is used to explicitly specifying

that they should be searched and loaded from this namespace.

Note that there is no link from the default namespace to this namespace.

###############################################################################
namespace.sphal.isolated = true
namespace.sphal.visible = true

namespace.sphal.search.paths = /odm/${LIB}
#vendor auto add
namespace.sphal.search.paths += /oppo_product/${LIB}
#vendor auto add
namespace.sphal.search.paths += /oppo_custom/${LIB}
#vendor auto add
namespace.sphal.search.paths += /oppo_version/${LIB}
#vendor auto add
namespace.sphal.search.paths += /oppo_engineering/${LIB}
namespace.sphal.search.paths += /vendor/${LIB}
namespace.sphal.search.paths += /vendor/${LIB}/hw

namespace.sphal.permitted.paths = /odm/${LIB}
#vendor auto add
namespace.sphal.permitted.paths += /oppo_product/${LIB}
#vendor auto add
namespace.sphal.permitted.paths += /oppo_custom/${LIB}
#vendor auto add
namespace.sphal.permitted.paths += /oppo_version/${LIB}
#vendor auto add
namespace.sphal.permitted.paths += /oppo_engineering/${LIB}
namespace.sphal.permitted.paths += /vendor/${LIB}
namespace.sphal.permitted.paths += /system/vendor/${LIB}

namespace.sphal.asan.search.paths = /data/asan/odm/${LIB}
namespace.sphal.asan.search.paths += /odm/${LIB}
#vendor auto add
namespace.sphal.asan.search.paths += /oppo_product/${LIB}
#vendor auto add
namespace.sphal.asan.search.paths += /oppo_custom/${LIB}
#vendor auto add
namespace.sphal.asan.search.paths += /oppo_version/${LIB}
#vendor auto add
namespace.sphal.asan.search.paths += /oppo_engineering/${LIB}
namespace.sphal.asan.search.paths += /data/asan/vendor/${LIB}
namespace.sphal.asan.search.paths += /vendor/${LIB}

namespace.sphal.asan.permitted.paths = /data/asan/odm/${LIB}
namespace.sphal.asan.permitted.paths += /odm/${LIB}
#vendor auto add
namespace.sphal.asan.permitted.paths += /oppo_product/${LIB}
#vendor auto add
namespace.sphal.asan.permitted.paths += /oppo_custom/${LIB}
#vendor auto add
namespace.sphal.asan.permitted.paths += /oppo_version/${LIB}
#vendor auto add
namespace.sphal.asan.permitted.paths += /oppo_engineering/${LIB}
namespace.sphal.asan.permitted.paths += /data/asan/vendor/${LIB}
namespace.sphal.asan.permitted.paths += /vendor/${LIB}

Once in this namespace, access to libraries in /system/lib is restricted. Only

libs listed here can be used. Order is important here as the namespaces are

tried in this order. rs should be before vndk because both are capable

of loading libRS_internal.so

namespace.sphal.links = rs,default,vndk

Renderscript gets separate namespace

namespace.sphal.link.rs.shared_libs = libRS_internal.so

namespace.sphal.link.default.shared_libs = libEGL.so:libGLESv1_CM.so:libGLESv2.so:libGLESv3.so:libRS.so:libandroid_net.so:libc.so:libcgrouprc.so:libclang_rt.asan-aarch64-android.so:libclang_rt.asan-arm-android.so:libclang_rt.hwasan-aarch64-android.so:libdl.so:libft2.so:liblog.so:libm.so:libmediandk.so:libnativewindow.so:libneuralnetworks.so:libsync.so:libvndksupport.so:libvulkan.so
namespace.sphal.link.default.shared_libs += libclang_rt.asan-aarch64-android.so:libclang_rt.hwasan-aarch64-android.so:libclang_rt.ubsan_standalone-aarch64-android.so:libclang_rt.tsan-aarch64-android.so:libclang_rt.asan-arm-android.so:libclang_rt.hwasan-arm-android.so:libclang_rt.ubsan_standalone-arm-android.so:libclang_rt.tsan-arm-android.so

namespace.sphal.link.vndk.shared_libs = [email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:libRSCpuRef.so:libRSDriver.so:libRS_internal.so:libbacktrace.so:libbase.so:libbcinfo.so:libbinderthreadstate.so:libblas.so:libc++.so:libcompiler_rt.so:libcutils.so:libhardware.so:libhidlbase.so:libhidlmemory.so:libhidltransport.so:libhwbinder.so:libhwbinder_noltopgo.so:libion.so:libjsoncpp.so:liblzma.so:libprocessgroup.so:libunwindstack.so:libutils.so:libutilscallstack.so:libz.so

###############################################################################

"rs" namespace

This namespace is exclusively for Renderscript internal libraries.

This namespace has slightly looser restriction than the vndk namespace because

of the genuine characteristics of Renderscript; /data is in the permitted path

to load the compiled *.so file and libmediandk.so can be used here.

###############################################################################
namespace.rs.isolated = true
namespace.rs.visible = true

namespace.rs.search.paths = /odm/${LIB}/vndk-sp
namespace.rs.search.paths += /vendor/${LIB}/vndk-sp
namespace.rs.search.paths += /system/${LIB}/vndk-sp-29
namespace.rs.search.paths += /odm/${LIB}
#vendor auto add
namespace.rs.search.paths += /oppo_product/${LIB}
#vendor auto add
namespace.rs.search.paths += /oppo_custom/${LIB}
#vendor auto add
namespace.rs.search.paths += /oppo_version/${LIB}
#vendor auto add
namespace.rs.search.paths += /oppo_engineering/${LIB}
namespace.rs.search.paths += /vendor/${LIB}

namespace.rs.permitted.paths = /odm/${LIB}
#vendor auto add
namespace.rs.permitted.paths += /oppo_product/${LIB}
#vendor auto add
namespace.rs.permitted.paths += /oppo_custom/${LIB}
#vendor auto add
namespace.rs.permitted.paths += /oppo_version/${LIB}
#vendor auto add
namespace.rs.permitted.paths += /oppo_engineering/${LIB}
namespace.rs.permitted.paths += /vendor/${LIB}
namespace.rs.permitted.paths += /system/vendor/${LIB}
namespace.rs.permitted.paths += /data

namespace.rs.asan.search.paths = /data/asan/odm/${LIB}/vndk-sp
namespace.rs.asan.search.paths += /odm/${LIB}/vndk-sp
namespace.rs.asan.search.paths += /data/asan/vendor/${LIB}/vndk-sp
namespace.rs.asan.search.paths += /vendor/${LIB}/vndk-sp
namespace.rs.asan.search.paths += /data/asan/system/${LIB}/vndk-sp-29
namespace.rs.asan.search.paths += /system/${LIB}/vndk-sp-29
namespace.rs.asan.search.paths += /data/asan/odm/${LIB}
namespace.rs.asan.search.paths += /odm/${LIB}
#vendor auto add
namespace.rs.asan.search.paths += /oppo_product/${LIB}
#vendor auto add
namespace.rs.asan.search.paths += /oppo_custom/${LIB}
#vendor auto add
namespace.rs.asan.search.paths += /oppo_version/${LIB}
#vendor auto add
namespace.rs.asan.search.paths += /oppo_engineering/${LIB}
namespace.rs.asan.search.paths += /data/asan/vendor/${LIB}
namespace.rs.asan.search.paths += /vendor/${LIB}

namespace.rs.asan.permitted.paths = /data/asan/odm/${LIB}
namespace.rs.asan.permitted.paths += /odm/${LIB}
#vendor auto add
namespace.rs.asan.permitted.paths += /oppo_product/${LIB}
#vendor auto add
namespace.rs.asan.permitted.paths += /oppo_custom/${LIB}
#vendor auto add
namespace.rs.asan.permitted.paths += /oppo_version/${LIB}
#vendor auto add
namespace.rs.asan.permitted.paths += /oppo_engineering/${LIB}
namespace.rs.asan.permitted.paths += /data/asan/vendor/${LIB}
namespace.rs.asan.permitted.paths += /vendor/${LIB}
namespace.rs.asan.permitted.paths += /data

namespace.rs.links = default,vndk

namespace.rs.link.default.shared_libs = libEGL.so:libGLESv1_CM.so:libGLESv2.so:libGLESv3.so:libRS.so:libandroid_net.so:libc.so:libcgrouprc.so:libclang_rt.asan-aarch64-android.so:libclang_rt.asan-arm-android.so:libclang_rt.hwasan-aarch64-android.so:libdl.so:libft2.so:liblog.so:libm.so:libmediandk.so:libnativewindow.so:libneuralnetworks.so:libsync.so:libvndksupport.so:libvulkan.so
namespace.rs.link.default.shared_libs += libclang_rt.asan-aarch64-android.so:libclang_rt.hwasan-aarch64-android.so:libclang_rt.ubsan_standalone-aarch64-android.so:libclang_rt.tsan-aarch64-android.so:libclang_rt.asan-arm-android.so:libclang_rt.hwasan-arm-android.so:libclang_rt.ubsan_standalone-arm-android.so:libclang_rt.tsan-arm-android.so

Private LLNDK libs (e.g. libft2.so) are exceptionally allowed to this

namespace because RS framework libs are using them.

namespace.rs.link.default.shared_libs +=

namespace.rs.link.vndk.shared_libs = [email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:libRSCpuRef.so:libRSDriver.so:libRS_internal.so:libbacktrace.so:libbase.so:libbcinfo.so:libbinderthreadstate.so:libblas.so:libc++.so:libcompiler_rt.so:libcutils.so:libhardware.so:libhidlbase.so:libhidlmemory.so:libhidltransport.so:libhwbinder.so:libhwbinder_noltopgo.so:libion.so:libjsoncpp.so:liblzma.so:libprocessgroup.so:libunwindstack.so:libutils.so:libutilscallstack.so:libz.so

###############################################################################

"vndk" namespace

This namespace is exclusively for vndk-sp libs.

###############################################################################
namespace.vndk.isolated = true
namespace.vndk.visible = true

namespace.vndk.search.paths = /odm/${LIB}/vndk-sp
namespace.vndk.search.paths += /vendor/${LIB}/vndk-sp
namespace.vndk.search.paths += /system/${LIB}/vndk-sp-29

namespace.vndk.permitted.paths = /odm/${LIB}/hw
namespace.vndk.permitted.paths += /odm/${LIB}/egl
namespace.vndk.permitted.paths += /vendor/${LIB}/hw
namespace.vndk.permitted.paths += /vendor/${LIB}/egl
namespace.vndk.permitted.paths += /system/vendor/${LIB}/hw
namespace.vndk.permitted.paths += /system/vendor/${LIB}/egl

This is exceptionally required since [email protected] is here

namespace.vndk.permitted.paths += /system/${LIB}/vndk-sp-29/hw

namespace.vndk.asan.search.paths = /data/asan/odm/${LIB}/vndk-sp
namespace.vndk.asan.search.paths += /odm/${LIB}/vndk-sp
namespace.vndk.asan.search.paths += /data/asan/vendor/${LIB}/vndk-sp
namespace.vndk.asan.search.paths += /vendor/${LIB}/vndk-sp
namespace.vndk.asan.search.paths += /data/asan/system/${LIB}/vndk-sp-29
namespace.vndk.asan.search.paths += /system/${LIB}/vndk-sp-29

namespace.vndk.asan.permitted.paths = /data/asan/odm/${LIB}/hw
namespace.vndk.asan.permitted.paths += /odm/${LIB}/hw
namespace.vndk.asan.permitted.paths += /data/asan/odm/${LIB}/egl
namespace.vndk.asan.permitted.paths += /odm/${LIB}/egl
namespace.vndk.asan.permitted.paths += /data/asan/vendor/${LIB}/hw
namespace.vndk.asan.permitted.paths += /vendor/${LIB}/hw
namespace.vndk.asan.permitted.paths += /data/asan/vendor/${LIB}/egl
namespace.vndk.asan.permitted.paths += /vendor/${LIB}/egl

namespace.vndk.asan.permitted.paths += /data/asan/system/${LIB}/vndk-sp-29/hw
namespace.vndk.asan.permitted.paths += /system/${LIB}/vndk-sp-29/hw

The "vndk" namespace links to "default" namespace for LLNDK libs and links to

"sphal" namespace for vendor libs. The ordering matters. The "default"

namespace has higher priority than the "sphal" namespace.

namespace.vndk.links = default,sphal

When these NDK libs are required inside this namespace, then it is redirected

to the default namespace. This is possible since their ABI is stable across

Android releases.

namespace.vndk.link.default.shared_libs = libEGL.so:libGLESv1_CM.so:libGLESv2.so:libGLESv3.so:libRS.so:libandroid_net.so:libc.so:libcgrouprc.so:libclang_rt.asan-aarch64-android.so:libclang_rt.asan-arm-android.so:libclang_rt.hwasan-aarch64-android.so:libdl.so:libft2.so:liblog.so:libm.so:libmediandk.so:libnativewindow.so:libneuralnetworks.so:libsync.so:libvndksupport.so:libvulkan.so
namespace.vndk.link.default.shared_libs += libclang_rt.asan-aarch64-android.so:libclang_rt.hwasan-aarch64-android.so:libclang_rt.ubsan_standalone-aarch64-android.so:libclang_rt.tsan-aarch64-android.so:libclang_rt.asan-arm-android.so:libclang_rt.hwasan-arm-android.so:libclang_rt.ubsan_standalone-arm-android.so:libclang_rt.tsan-arm-android.so

Allow VNDK-SP extensions to use vendor libraries

namespace.vndk.link.sphal.allow_all_shared_libs = true

###############################################################################

Namespace config for vendor processes. In O, no restriction is enforced for

them. However, in O-MR1, access to /system/${LIB} will not be allowed to

the default namespace. 'system' namespace will be added to give limited

(LL-NDK only) access.

###############################################################################
[vendor]
additional.namespaces = runtime,system,vndk

###############################################################################

"default" namespace

This is the default linker namespace for a vendor process (a process started

from /vendor/bin/*). The main executable and the libs under /vendor/lib[64]

are loaded directly into this namespace. However, other libs under the system

partition (VNDK and LLNDK libraries) are not loaded here but from the

separate namespace 'system'. The delegation to the system namespace is done

via the 'namespace.default.link.system.shared_libs' property below.

'#VNDK27#' TAG is only for building ld.config.27.txt for backward

compatibility. (TODO:b/123390078) Move them to a separate file.

###############################################################################
namespace.default.isolated = true
namespace.default.visible = true

namespace.default.search.paths = /odm/${LIB}
#vendor auto add
namespace.default.search.paths += /oppo_product/${LIB}
#vendor auto add
namespace.default.search.paths += /oppo_custom/${LIB}
#vendor auto add
namespace.default.search.paths += /oppo_version/${LIB}
#vendor auto add
namespace.default.search.paths += /oppo_engineering/${LIB}
namespace.default.search.paths += /vendor/${LIB}

namespace.default.permitted.paths = /odm
namespace.default.permitted.paths += /vendor
namespace.default.permitted.paths += /system/vendor

namespace.default.asan.search.paths = /data/asan/odm/${LIB}
namespace.default.asan.search.paths += /odm/${LIB}
#vendor auto add
namespace.default.asan.search.paths += /oppo_product/${LIB}
#vendor auto add
namespace.default.asan.search.paths += /oppo_custom/${LIB}
#vendor auto add
namespace.default.asan.search.paths += /oppo_version/${LIB}
#vendor auto add
namespace.default.asan.search.paths += /oppo_engineering/${LIB}
namespace.default.asan.search.paths += /data/asan/vendor/${LIB}
namespace.default.asan.search.paths += /vendor/${LIB}

namespace.default.asan.permitted.paths = /data/asan/odm
namespace.default.asan.permitted.paths += /odm
namespace.default.asan.permitted.paths += /data/asan/vendor
namespace.default.asan.permitted.paths += /vendor

namespace.default.links = system,vndk
namespace.default.link.system.shared_libs = libEGL.so:libGLESv1_CM.so:libGLESv2.so:libGLESv3.so:libRS.so:libandroid_net.so:libc.so:libcgrouprc.so:libclang_rt.asan-aarch64-android.so:libclang_rt.asan-arm-android.so:libclang_rt.hwasan-aarch64-android.so:libdl.so:libft2.so:liblog.so:libm.so:libmediandk.so:libnativewindow.so:libneuralnetworks.so:libsync.so:libvndksupport.so:libvulkan.so

namespace.default.link.vndk.shared_libs = [email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:libRSCpuRef.so:libRSDriver.so:libRS_internal.so:libbacktrace.so:libbase.so:libbcinfo.so:libbinderthreadstate.so:libblas.so:libc++.so:libcompiler_rt.so:libcutils.so:libhardware.so:libhidlbase.so:libhidlmemory.so:libhidltransport.so:libhwbinder.so:libhwbinder_noltopgo.so:libion.so:libjsoncpp.so:liblzma.so:libprocessgroup.so:libunwindstack.so:libutils.so:libutilscallstack.so:libz.so
namespace.default.link.vndk.shared_libs += [email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:android.hardware.configstore-utils.so:[email protected]:[email protected]:android.hardware.confirmationui-support-lib.so:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:libadf.so:libaudioroute.so:libaudioutils.so:libbinder.so:libcamera_metadata.so:libcap.so:libclang_rt.scudo-aarch64-android.so:libclang_rt.scudo-arm-android.so:libclang_rt.scudo_minimal-aarch64-android.so:libclang_rt.scudo_minimal-arm-android.so:libclang_rt.ubsan_minimal-aarch64-android.so:libclang_rt.ubsan_minimal-arm-android.so:libclang_rt.ubsan_standalone-aarch64-android.so:libclang_rt.ubsan_standalone-arm-android.so:libcn-cbor.so:libcodec2.so:libcrypto.so:libcrypto_utils.so:libcurl.so:libdiskconfig.so:libdumpstateutil.so:libevent.so:libexif.so:libexpat.so:libfmq.so:libgatekeeper.so:libgui.so:libhardware_legacy.so:libhidlallocatorutils.so:libhidlcache.so:libjpeg.so:libkeymaster_messages.so:libkeymaster_portable.so:libldacBT_abr.so:libldacBT_enc.so:liblz4.so:libmedia_helper.so:libmedia_omx.so:libmemtrack.so:libminijail.so:libmkbootimg_abi_check.so:libnetutils.so:libnl.so:libpcre2.so:libpiex.so:libpng.so:libpower.so:libprocinfo.so:libprotobuf-cpp-full.so:libprotobuf-cpp-lite.so:libpuresoftkeymasterdevice.so:libradio_metadata.so:libselinux.so:libsoftkeymasterdevice.so:libspeexresampler.so:libsqlite.so:libssl.so:[email protected]:libstagefright_bufferqueue_helper.so:libstagefright_foundation.so:libstagefright_omx.so:libstagefright_omx_utils.so:libstagefright_xmlparser.so:libsysutils.so:libtinyalsa.so:libtinyxml2.so:libui.so:libusbhost.so:libwifi-system-iface.so:libxml2.so:libyuv.so:libziparchive.so

###############################################################################

"runtime" APEX namespace

This namespace exposes externally accessible libraries from the Runtime APEX.

###############################################################################
namespace.runtime.isolated = true

Keep in sync with ld.config.txt in the com.android.runtime APEX.

namespace.runtime.search.paths = /apex/com.android.runtime/${LIB}
namespace.runtime.asan.search.paths = /apex/com.android.runtime/${LIB}
namespace.runtime.links = system

TODO(b/119867084): Restrict to Bionic dlopen dependencies and PALette library

when it exists.

namespace.runtime.link.system.allow_all_shared_libs = true

###############################################################################

"vndk" namespace

This namespace is where VNDK and VNDK-SP libraries are loaded for

a vendor process.

###############################################################################
namespace.vndk.isolated = false

namespace.vndk.search.paths = /odm/${LIB}/vndk
namespace.vndk.search.paths += /odm/${LIB}/vndk-sp
namespace.vndk.search.paths += /vendor/${LIB}/vndk
namespace.vndk.search.paths += /vendor/${LIB}/vndk-sp
namespace.vndk.search.paths += /system/${LIB}/vndk-sp-29
namespace.vndk.search.paths += /system/${LIB}/vndk-29

namespace.vndk.asan.search.paths = /data/asan/odm/${LIB}/vndk
namespace.vndk.asan.search.paths += /odm/${LIB}/vndk
namespace.vndk.asan.search.paths += /data/asan/odm/${LIB}/vndk-sp
namespace.vndk.asan.search.paths += /odm/${LIB}/vndk-sp
namespace.vndk.asan.search.paths += /data/asan/vendor/${LIB}/vndk
namespace.vndk.asan.search.paths += /vendor/${LIB}/vndk
namespace.vndk.asan.search.paths += /data/asan/vendor/${LIB}/vndk-sp
namespace.vndk.asan.search.paths += /vendor/${LIB}/vndk-sp
namespace.vndk.asan.search.paths += /data/asan/system/${LIB}/vndk-sp-29
namespace.vndk.asan.search.paths += /system/${LIB}/vndk-sp-29
namespace.vndk.asan.search.paths += /data/asan/system/${LIB}/vndk-29
namespace.vndk.asan.search.paths += /system/${LIB}/vndk-29

When these NDK libs are required inside this namespace, then it is redirected

to the system namespace. This is possible since their ABI is stable across

Android releases. The links here should be identical to that of the

'vndk_in_system' namespace, except for the link between 'vndk' and

'vndk_in_system'.

namespace.vndk.links = system,default

namespace.vndk.link.system.shared_libs = libEGL.so:libGLESv1_CM.so:libGLESv2.so:libGLESv3.so:libRS.so:libandroid_net.so:libc.so:libcgrouprc.so:libclang_rt.asan-aarch64-android.so:libclang_rt.asan-arm-android.so:libclang_rt.hwasan-aarch64-android.so:libdl.so:libft2.so:liblog.so:libm.so:libmediandk.so:libnativewindow.so:libneuralnetworks.so:libsync.so:libvndksupport.so:libvulkan.so
namespace.vndk.link.system.shared_libs += libclang_rt.asan-aarch64-android.so:libclang_rt.hwasan-aarch64-android.so:libclang_rt.ubsan_standalone-aarch64-android.so:libclang_rt.tsan-aarch64-android.so:libclang_rt.asan-arm-android.so:libclang_rt.hwasan-arm-android.so:libclang_rt.ubsan_standalone-arm-android.so:libclang_rt.tsan-arm-android.so

namespace.vndk.link.default.allow_all_shared_libs = true

###############################################################################

"system" namespace

This namespace is where system libs (VNDK and LLNDK libs) are loaded for

a vendor process.

###############################################################################
namespace.system.isolated = false

namespace.system.search.paths = /system/${LIB}
namespace.system.search.paths += /system/product/${LIB}
#vendor auto add
namespace.system.search.paths += /oppo_product/${LIB}
#vendor auto add
namespace.system.search.paths += /oppo_custom/${LIB}
#vendor auto add
namespace.system.search.paths += /oppo_version/${LIB}
#vendor auto add
namespace.system.search.paths += /oppo_engineering/${LIB}

namespace.system.asan.search.paths = /data/asan/system/${LIB}
namespace.system.asan.search.paths += /system/${LIB}
namespace.system.asan.search.paths += /data/asan/product/${LIB}
namespace.system.asan.search.paths += /system/product/${LIB}
#vendor auto add
namespace.system.asan.search.paths += /oppo_product/${LIB}
#vendor auto add
namespace.system.asan.search.paths += /oppo_custom/${LIB}
#vendor auto add
namespace.system.asan.search.paths += /oppo_version/${LIB}
#vendor auto add
namespace.system.asan.search.paths += /oppo_engineering/${LIB}
namespace.system.asan.search.paths += /data/asan/product_services/${LIB}

namespace.system.links = runtime
namespace.system.link.runtime.shared_libs = libdexfile_external.so

libicuuc.so and libicui18n.so are kept for app compat reason. http://b/130788466

namespace.system.link.runtime.shared_libs += libicui18n.so
namespace.system.link.runtime.shared_libs += libicuuc.so
namespace.system.link.runtime.shared_libs += libnativebridge.so
namespace.system.link.runtime.shared_libs += libnativehelper.so
namespace.system.link.runtime.shared_libs += libnativeloader.so

Workaround for b/124772622

namespace.system.link.runtime.shared_libs += libandroidicu.so

###############################################################################

"vndk_in_system" namespace

This namespace is where no-vendor-variant VNDK libraries are loaded for a

vendor process. Note that we do not simply export these libraries from

"system" namespace, because in some case both the core variant and the

vendor variant of a VNDK library may be loaded. In such case, we do not

want to eliminate double-loading because doing so means the global states

of the library would be shared.

Only the no-vendor-variant VNDK libraries are whitelisted in this namespace.

This is to ensure that we do not load libraries needed by no-vendor-variant

VNDK libraries into vndk_in_system namespace.

###############################################################################
namespace.vndk_in_system.isolated = true
namespace.vndk_in_system.visible = true

The search paths here should be kept the same as that of the 'system'

namespace.

namespace.vndk_in_system.search.paths = /system/${LIB}
namespace.vndk_in_system.search.paths += /system/product/${LIB}
#vendor auto add
namespace.vndk_in_system.search.paths += /oppo_product/${LIB}
#vendor auto add
namespace.vndk_in_system.search.paths += /oppo_custom/${LIB}
#vendor auto add
namespace.vndk_in_system.search.paths += /oppo_version/${LIB}
#vendor auto add
namespace.vndk_in_system.search.paths += /oppo_engineering/${LIB}

namespace.vndk_in_system.asan.search.paths = /data/asan/system/${LIB}
namespace.vndk_in_system.asan.search.paths += /system/${LIB}
namespace.vndk_in_system.asan.search.paths += /data/asan/product/${LIB}
namespace.vndk_in_system.asan.search.paths += /system/product/${LIB}
#vendor auto add
namespace.vndk_in_system.asan.search.paths += /oppo_product/${LIB}
#vendor auto add
namespace.vndk_in_system.asan.search.paths += /oppo_custom/${LIB}
#vendor auto add
namespace.vndk_in_system.asan.search.paths += /oppo_version/${LIB}
#vendor auto add
namespace.vndk_in_system.asan.search.paths += /oppo_engineering/${LIB}
namespace.vndk_in_system.asan.search.paths += /data/asan/product_services/${LIB}

The links here should be identical to that of the 'vndk' namespace, with the

following exception:

1. 'vndk_in_system' needs to be freely linked back to 'vndk'.

2. 'vndk_in_system' does not need to link to 'default', as any library that

requires anything vendor would not be a vndk_in_system library.

namespace.vndk_in_system.links = vndk,system

namespace.vndk_in_system.link.system.shared_libs = libEGL.so:libGLESv1_CM.so:libGLESv2.so:libGLESv3.so:libRS.so:libandroid_net.so:libc.so:libcgrouprc.so:libclang_rt.asan-aarch64-android.so:libclang_rt.asan-arm-android.so:libclang_rt.hwasan-aarch64-android.so:libdl.so:libft2.so:liblog.so:libm.so:libmediandk.so:libnativewindow.so:libneuralnetworks.so:libsync.so:libvndksupport.so:libvulkan.so
namespace.vndk_in_system.link.system.shared_libs += libclang_rt.asan-aarch64-android.so:libclang_rt.hwasan-aarch64-android.so:libclang_rt.ubsan_standalone-aarch64-android.so:libclang_rt.tsan-aarch64-android.so:libclang_rt.asan-arm-android.so:libclang_rt.hwasan-arm-android.so:libclang_rt.ubsan_standalone-arm-android.so:libclang_rt.tsan-arm-android.so

namespace.vndk_in_system.link.vndk.allow_all_shared_libs = true

###############################################################################

Namespace config for native tests that need access to both system and vendor

libraries. This replicates the default linker config (done by

init_default_namespace_no_config in bionic/linker/linker.cpp), except that it

includes the requisite namespace setup for APEXes.

###############################################################################
[unrestricted]
additional.namespaces = runtime,media,conscrypt,resolv

namespace.default.search.paths = /system/${LIB}
namespace.default.search.paths += /odm/${LIB}
#vendor auto add
namespace.default.search.paths += /oppo_product/${LIB}
#vendor auto add
namespace.default.search.paths += /oppo_custom/${LIB}
#vendor auto add
namespace.default.search.paths += /oppo_version/${LIB}
#vendor auto add
namespace.default.search.paths += /oppo_engineering/${LIB}
namespace.default.search.paths += /vendor/${LIB}

namespace.default.asan.search.paths = /data/asan/system/${LIB}
namespace.default.asan.search.paths += /system/${LIB}
namespace.default.asan.search.paths += /data/asan/odm/${LIB}
namespace.default.asan.search.paths += /odm/${LIB}
#vendor auto add
namespace.default.asan.search.paths += /oppo_product/${LIB}
#vendor auto add
namespace.default.asan.search.paths += /oppo_custom/${LIB}
#vendor auto add
namespace.default.asan.search.paths += /oppo_version/${LIB}
#vendor auto add
namespace.default.asan.search.paths += /oppo_engineering/${LIB}
namespace.default.asan.search.paths += /data/asan/vendor/${LIB}
namespace.default.asan.search.paths += /vendor/${LIB}

Keep in sync with ld.config.txt in the com.android.runtime APEX.

namespace.default.links = runtime,resolv
namespace.default.visible = true

namespace.default.link.runtime.shared_libs = libdexfile_external.so

libicuuc.so and libicui18n.so are kept for app compat reason. http://b/130788466

namespace.default.link.runtime.shared_libs += libicui18n.so
namespace.default.link.runtime.shared_libs += libicuuc.so
namespace.default.link.runtime.shared_libs += libnativebridge.so
namespace.default.link.runtime.shared_libs += libnativehelper.so
namespace.default.link.runtime.shared_libs += libnativeloader.so
namespace.default.link.runtime.shared_libs += libandroidicu.so

TODO(b/122876336): Remove libpac.so once it's migrated to Webview

namespace.default.link.runtime.shared_libs += libpac.so

namespace.default.link.resolv.shared_libs = libnetd_resolv.so

###############################################################################

"runtime" APEX namespace

This namespace exposes externally accessible libraries from the Runtime APEX.

###############################################################################
namespace.runtime.isolated = true
namespace.runtime.visible = true

Keep in sync with ld.config.txt in the com.android.runtime APEX.

namespace.runtime.search.paths = /apex/com.android.runtime/${LIB}
namespace.runtime.asan.search.paths = /apex/com.android.runtime/${LIB}
namespace.runtime.links = default

TODO(b/119867084): Restrict to Bionic dlopen dependencies and PALette library

when it exists.

namespace.runtime.link.default.allow_all_shared_libs = true

###############################################################################

"media" APEX namespace

This namespace is for libraries within the media APEX.

###############################################################################
namespace.media.isolated = true
namespace.media.visible = true

namespace.media.search.paths = /apex/com.android.media/${LIB}
namespace.media.asan.search.paths = /apex/com.android.media/${LIB}

namespace.media.permitted.paths = /apex/com.android.media/${LIB}/extractors
namespace.media.asan.permitted.paths = /apex/com.android.media/${LIB}/extractors

namespace.media.links = default
namespace.media.link.default.shared_libs = libEGL.so:libGLESv1_CM.so:libGLESv2.so:libGLESv3.so:libRS.so:libandroid_net.so:libc.so:libcgrouprc.so:libclang_rt.asan-aarch64-android.so:libclang_rt.asan-arm-android.so:libclang_rt.hwasan-aarch64-android.so:libdl.so:libft2.so:liblog.so:libm.so:libmediandk.so:libnativewindow.so:libneuralnetworks.so:libsync.so:libvndksupport.so:libvulkan.so
namespace.media.link.default.shared_libs += libbinder_ndk.so
namespace.media.link.default.shared_libs += libmediametrics.so
namespace.media.link.default.shared_libs += libclang_rt.asan-aarch64-android.so:libclang_rt.hwasan-aarch64-android.so:libclang_rt.ubsan_standalone-aarch64-android.so:libclang_rt.tsan-aarch64-android.so:libclang_rt.asan-arm-android.so:libclang_rt.hwasan-arm-android.so:libclang_rt.ubsan_standalone-arm-android.so:libclang_rt.tsan-arm-android.so

###############################################################################

"conscrypt" APEX namespace

This namespace is for libraries within the conscrypt APEX.

###############################################################################
namespace.conscrypt.isolated = true
namespace.conscrypt.visible = true

Keep in sync with ld.config.txt in the com.android.runtime APEX.

namespace.conscrypt.search.paths = /apex/com.android.conscrypt/${LIB}
namespace.conscrypt.asan.search.paths = /apex/com.android.conscrypt/${LIB}
namespace.conscrypt.links = runtime,default
namespace.conscrypt.link.runtime.shared_libs = libandroidio.so
namespace.conscrypt.link.default.shared_libs = libc.so
namespace.conscrypt.link.default.shared_libs += libm.so
namespace.conscrypt.link.default.shared_libs += libdl.so
namespace.conscrypt.link.default.shared_libs += liblog.so

###############################################################################

"resolv" APEX namespace

This namespace is for libraries within the resolv APEX.

###############################################################################
namespace.resolv.isolated = true
namespace.resolv.visible = true

namespace.resolv.search.paths = /apex/com.android.resolv/${LIB}
namespace.resolv.asan.search.paths = /apex/com.android.resolv/${LIB}
namespace.resolv.links = default
namespace.resolv.link.default.shared_libs = libc.so
namespace.resolv.link.default.shared_libs += libm.so
namespace.resolv.link.default.shared_libs += libdl.so
namespace.resolv.link.default.shared_libs += libbinder_ndk.so
namespace.resolv.link.default.shared_libs += liblog.so

###############################################################################

Namespace config for binaries under /postinstall.

Only default namespace is defined and default has no directories

other than /system/lib in the search paths. This is because linker calls

realpath on the search paths and this causes selinux denial if the paths

(/vendor, /odm) are not allowed to the postinstall binaries. There is no

reason to allow the binaries to access the paths.

###############################################################################
[postinstall]
namespace.default.isolated = false
namespace.default.search.paths = /system/${LIB}
namespace.default.search.paths += /system/product/${LIB}
#vendor auto add
namespace.default.search.paths += /oppo_product/${LIB}
#vendor auto add
namespace.default.search.paths += /oppo_custom/${LIB}
#vendor auto add
namespace.default.search.paths += /oppo_version/${LIB}
#vendor auto add
namespace.default.search.paths += /oppo_engineering/${LIB}

@FranknittyV
Copy link

FranknittyV commented May 22, 2023 via email

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment