Protect runtime storage mount points.

We have a bunch of magic that mounts the correct view of storage
access based on the runtime permissions of an app, but we forgot to
protect the real underlying data sources; oops.

This series of changes just bumps the directory heirarchy one level
to give us /mnt/runtime which we can mask off as 0700 to prevent
people from jumping to the exposed internals.

Also add CTS tests to verify that we're protecting access to
internal mount points like this.

Bug: 22964288
Change-Id: I32068e63a3362b37e8ebca1418f900bb8537b498

1 files changed, 4 insertions, 4 deletions

diff --git a/sdcard/sdcard.c b/sdcard/sdcard.c
index 41bf045..a79e2dd 100644
--- a/sdcard/sdcard.c
+++ b/sdcard/sdcard.c
@@ -1735,7 +1735,7 @@ static int usage() {
             "    -g: specify GID to run as\n"
             "    -U: specify user ID that owns device\n"
             "    -m: source_path is multi-user\n"
-            "    -w: runtime_write mount has full write access\n"
+            "    -w: runtime write mount has full write access\n"
             "\n");
     return 1;
 }
@@ -1822,9 +1822,9 @@ static void run(const char* source_path, const char* label, uid_t uid,
     global.fuse_read = &fuse_read;
     global.fuse_write = &fuse_write;
 
-    snprintf(fuse_default.dest_path, PATH_MAX, "/mnt/runtime_default/%s", label);
-    snprintf(fuse_read.dest_path, PATH_MAX, "/mnt/runtime_read/%s", label);
-    snprintf(fuse_write.dest_path, PATH_MAX, "/mnt/runtime_write/%s", label);
+    snprintf(fuse_default.dest_path, PATH_MAX, "/mnt/runtime/default/%s", label);
+    snprintf(fuse_read.dest_path, PATH_MAX, "/mnt/runtime/read/%s", label);
+    snprintf(fuse_write.dest_path, PATH_MAX, "/mnt/runtime/write/%s", label);
 
     handler_default.fuse = &fuse_default;
     handler_read.fuse = &fuse_read;