[thomasbuilds]

DISABLE_HARDENED_MALLOC isn't removed under AT_SECURE, so a process can make a program it executes across a security transition use scudo instead of hardened_malloc, such as an app executing crash_dump or the RenderScript compiler, or the shell executing run-as.

[thestinger]

This will currently break each place we use this which is why we haven't done it.

[thomasbuilds]

I tried to keep the existing uses working: it's still kept when the program was executed by init (/proc/self/attr/prev is u:r:init:s0), which should cover the disable_hardened_malloc service option used for zygote_compat. As far as I can tell, the only other place it's set is exec spawning, and since the zygote executes app_process64 and zygote_next without a domain transition, AT_SECURE isn't set there. Children of apps with it disabled should still get scudo via the GrapheneOS SELinux flag.