Magisk/native/jni/utils/file.cpp

404 lines
9.7 KiB
C++
Raw Normal View History

2019-06-23 12:53:41 +02:00
#include <sys/sendfile.h>
#include <linux/fs.h>
2017-10-11 20:57:18 +02:00
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
2017-11-15 14:00:52 +01:00
#include <errno.h>
#include <string.h>
2017-11-27 08:37:28 +01:00
#include <libgen.h>
2017-10-14 15:10:22 +02:00
2020-03-09 09:50:30 +01:00
#include <utils.hpp>
#include <selinux.hpp>
2017-10-11 20:57:18 +02:00
2019-01-20 05:59:37 +01:00
using namespace std;
2019-03-14 11:34:22 +01:00
ssize_t fd_path(int fd, char *path, size_t size) {
2017-10-14 15:10:22 +02:00
snprintf(path, size, "/proc/self/fd/%d", fd);
2019-03-14 11:34:22 +01:00
return xreadlink(path, path, size);
}
2019-03-14 11:34:22 +01:00
int fd_pathat(int dirfd, const char *name, char *path, size_t size) {
2020-04-02 11:17:45 +02:00
if (fd_path(dirfd, path, size) < 0)
2019-03-14 11:34:22 +01:00
return -1;
2020-04-02 11:17:45 +02:00
auto len = strlen(path);
2019-03-14 11:34:22 +01:00
path[len] = '/';
2020-04-02 11:17:45 +02:00
strlcpy(path + len + 1, name, size - len - 1);
2018-09-27 06:09:59 +02:00
return 0;
2017-10-14 15:10:22 +02:00
}
2020-04-02 11:17:45 +02:00
int mkdirs(string path, mode_t mode) {
2017-10-11 20:57:18 +02:00
errno = 0;
2020-04-02 11:17:45 +02:00
for (char *p = path.data() + 1; *p; ++p) {
2017-10-11 20:57:18 +02:00
if (*p == '/') {
*p = '\0';
2020-04-02 11:17:45 +02:00
if (mkdir(path.data(), mode) == -1) {
2017-10-11 20:57:18 +02:00
if (errno != EEXIST)
return -1;
}
*p = '/';
}
}
2020-04-02 11:17:45 +02:00
if (mkdir(path.data(), mode) == -1) {
2017-10-11 20:57:18 +02:00
if (errno != EEXIST)
return -1;
}
return 0;
}
2020-04-02 11:17:45 +02:00
#define SKIP_DOTS {\
if (entry->d_name == "."sv || entry->d_name == ".."sv) \
continue;\
}
static void post_order_walk(int dirfd, const function<int(int, dirent *)> &&fn) {
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 13:39:28 +02:00
auto dir = xopen_dir(dirfd);
if (!dir) return;
2017-10-11 20:57:18 +02:00
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 13:39:28 +02:00
for (dirent *entry; (entry = xreaddir(dir.get()));) {
2020-04-02 11:17:45 +02:00
SKIP_DOTS
2020-04-02 08:37:11 +02:00
if (entry->d_type == DT_DIR)
post_order_walk(xopenat(dirfd, entry->d_name, O_RDONLY | O_CLOEXEC), std::move(fn));
2019-02-14 06:52:59 +01:00
fn(dirfd, entry);
}
}
2019-03-31 12:32:33 +02:00
static int remove_at(int dirfd, struct dirent *entry) {
return unlinkat(dirfd, entry->d_name, entry->d_type == DT_DIR ? AT_REMOVEDIR : 0);
}
void rm_rf(const char *path) {
2019-02-12 08:44:46 +01:00
struct stat st;
if (lstat(path, &st) < 0)
return;
2020-04-02 08:37:11 +02:00
if (S_ISDIR(st.st_mode))
frm_rf(xopen(path, O_RDONLY | O_CLOEXEC));
2017-12-15 19:02:17 +01:00
remove(path);
}
2020-04-02 08:37:11 +02:00
void frm_rf(int dirfd) {
post_order_walk(dirfd, remove_at);
}
2020-04-02 11:17:45 +02:00
void mv_path(const char *src, const char *dest) {
file_attr a;
getattr(src, &a);
if (S_ISDIR(a.st.st_mode)) {
xmkdirs(dest, 0);
setattr(dest, &a);
mv_dir(xopen(src, O_RDONLY | O_CLOEXEC), xopen(dest, O_RDONLY | O_CLOEXEC));
2017-10-11 20:57:18 +02:00
} else{
2020-04-02 11:17:45 +02:00
xrename(src, dest);
2017-10-11 20:57:18 +02:00
}
2020-04-02 11:17:45 +02:00
rmdir(src);
2017-10-11 20:57:18 +02:00
}
void mv_dir(int src, int dest) {
2020-04-02 11:17:45 +02:00
auto dir = xopen_dir(src);
run_finally f([&]{ close(dest); });
for (dirent *entry; (entry = xreaddir(dir.get()));) {
SKIP_DOTS
2017-10-11 20:57:18 +02:00
switch (entry->d_type) {
case DT_DIR:
2020-04-02 11:17:45 +02:00
if (faccessat(dest, entry->d_name, F_OK, 0) == 0) {
// Destination folder exists, needs recursive move
int newsrc = xopenat(src, entry->d_name, O_RDONLY | O_CLOEXEC);
int newdest = xopenat(dest, entry->d_name, O_RDONLY | O_CLOEXEC);
mv_dir(newsrc, newdest);
unlinkat(src, entry->d_name, AT_REMOVEDIR);
break;
}
// Else fall through
2017-10-11 20:57:18 +02:00
case DT_LNK:
case DT_REG:
renameat(src, entry->d_name, dest, entry->d_name);
break;
}
}
}
2020-04-02 11:17:45 +02:00
void cp_afc(const char *src, const char *dest) {
file_attr a;
getattr(src, &a);
2017-10-11 20:57:18 +02:00
if (S_ISDIR(a.st.st_mode)) {
2020-04-02 11:17:45 +02:00
xmkdirs(dest, 0);
clone_dir(xopen(src, O_RDONLY | O_CLOEXEC), xopen(dest, O_RDONLY | O_CLOEXEC));
2017-10-11 20:57:18 +02:00
} else{
2020-04-02 11:17:45 +02:00
unlink(dest);
2017-10-11 20:57:18 +02:00
if (S_ISREG(a.st.st_mode)) {
2020-04-02 11:17:45 +02:00
int sfd = xopen(src, O_RDONLY | O_CLOEXEC);
2020-04-11 13:05:34 +02:00
int dfd = xopen(dest, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, 0);
2020-04-02 11:17:45 +02:00
xsendfile(dfd, sfd, nullptr, a.st.st_size);
close(sfd);
close(dfd);
2017-10-11 20:57:18 +02:00
} else if (S_ISLNK(a.st.st_mode)) {
2020-04-02 11:17:45 +02:00
char buf[4096];
xreadlink(src, buf, sizeof(buf));
xsymlink(buf, dest);
2017-10-11 20:57:18 +02:00
}
}
2020-04-02 11:17:45 +02:00
setattr(dest, &a);
2017-10-11 20:57:18 +02:00
}
2020-04-02 11:17:45 +02:00
void clone_dir(int src, int dest) {
auto dir = xopen_dir(src);
run_finally f([&]{ close(dest); });
for (dirent *entry; (entry = xreaddir(dir.get()));) {
SKIP_DOTS
file_attr a;
2017-10-11 20:57:18 +02:00
getattrat(src, entry->d_name, &a);
switch (entry->d_type) {
2020-04-02 11:17:45 +02:00
case DT_DIR: {
xmkdirat(dest, entry->d_name, 0);
setattrat(dest, entry->d_name, &a);
int sfd = xopenat(src, entry->d_name, O_RDONLY | O_CLOEXEC);
int dst = xopenat(dest, entry->d_name, O_RDONLY | O_CLOEXEC);
clone_dir(sfd, dst);
break;
}
case DT_REG: {
int sfd = xopenat(src, entry->d_name, O_RDONLY | O_CLOEXEC);
2020-04-11 13:05:34 +02:00
int dfd = xopenat(dest, entry->d_name, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, 0);
2020-04-02 11:17:45 +02:00
xsendfile(dfd, sfd, nullptr, a.st.st_size);
fsetattr(dfd, &a);
close(dfd);
close(sfd);
break;
}
case DT_LNK: {
char buf[4096];
xreadlinkat(src, entry->d_name, buf, sizeof(buf));
xsymlinkat(buf, dest, entry->d_name);
setattrat(dest, entry->d_name, &a);
break;
}
2017-10-11 20:57:18 +02:00
}
}
}
2020-04-02 11:17:45 +02:00
void link_path(const char *src, const char *dest) {
link_dir(xopen(src, O_RDONLY | O_CLOEXEC), xopen(dest, O_RDONLY | O_CLOEXEC));
}
2018-02-01 20:22:38 +01:00
void link_dir(int src, int dest) {
2020-04-02 11:17:45 +02:00
auto dir = xopen_dir(src);
run_finally f([&]{ close(dest); });
for (dirent *entry; (entry = xreaddir(dir.get()));) {
SKIP_DOTS
2018-02-01 20:22:38 +01:00
if (entry->d_type == DT_DIR) {
2020-04-02 11:17:45 +02:00
file_attr a;
2018-02-01 20:22:38 +01:00
getattrat(src, entry->d_name, &a);
2020-04-02 11:17:45 +02:00
xmkdirat(dest, entry->d_name, 0);
2018-02-01 20:22:38 +01:00
setattrat(dest, entry->d_name, &a);
2020-04-02 11:17:45 +02:00
int sfd = xopenat(src, entry->d_name, O_RDONLY | O_CLOEXEC);
int dfd = xopenat(dest, entry->d_name, O_RDONLY | O_CLOEXEC);
link_dir(sfd, dfd);
2018-02-01 20:22:38 +01:00
} else {
xlinkat(src, entry->d_name, dest, entry->d_name, 0);
2018-02-01 20:22:38 +01:00
}
}
}
2020-04-02 11:17:45 +02:00
int getattr(const char *path, file_attr *a) {
2017-10-14 15:10:22 +02:00
if (xlstat(path, &a->st) == -1)
2017-10-11 20:57:18 +02:00
return -1;
2018-09-27 06:09:59 +02:00
char *con;
2017-10-14 15:10:22 +02:00
if (lgetfilecon(path, &con) == -1)
return -1;
strcpy(a->con, con);
freecon(con);
return 0;
2017-10-11 20:57:18 +02:00
}
2020-04-02 11:17:45 +02:00
int getattrat(int dirfd, const char *name, file_attr *a) {
2019-03-14 11:34:22 +01:00
char path[4096];
fd_pathat(dirfd, name, path, sizeof(path));
return getattr(path, a);
2017-10-11 20:57:18 +02:00
}
2020-04-02 11:17:45 +02:00
int fgetattr(int fd, file_attr *a) {
2019-03-14 11:34:22 +01:00
if (xfstat(fd, &a->st) < 0)
return -1;
char *con;
if (fgetfilecon(fd, &con) < 0)
return -1;
strcpy(a->con, con);
freecon(con);
return 0;
2017-10-11 20:57:18 +02:00
}
2020-04-02 11:17:45 +02:00
int setattr(const char *path, file_attr *a) {
2017-10-14 15:10:22 +02:00
if (chmod(path, a->st.st_mode & 0777) < 0)
2017-10-11 20:57:18 +02:00
return -1;
2017-10-14 15:10:22 +02:00
if (chown(path, a->st.st_uid, a->st.st_gid) < 0)
return -1;
2019-03-14 11:34:22 +01:00
if (a->con[0] && lsetfilecon(path, a->con) < 0)
2017-10-14 15:10:22 +02:00
return -1;
return 0;
2017-10-11 20:57:18 +02:00
}
2020-04-02 11:17:45 +02:00
int setattrat(int dirfd, const char *name, file_attr *a) {
2019-03-14 11:34:22 +01:00
char path[4096];
fd_pathat(dirfd, name, path, sizeof(path));
return setattr(path, a);
2017-10-11 20:57:18 +02:00
}
2020-04-02 11:17:45 +02:00
int fsetattr(int fd, file_attr *a) {
2019-03-14 11:34:22 +01:00
if (fchmod(fd, a->st.st_mode & 0777) < 0)
return -1;
if (fchown(fd, a->st.st_uid, a->st.st_gid) < 0)
return -1;
if (a->con[0] && fsetfilecon(fd, a->con) < 0)
return -1;
return 0;
2017-10-11 20:57:18 +02:00
}
2020-04-02 11:17:45 +02:00
void clone_attr(const char *src, const char *dest) {
file_attr a;
getattr(src, &a);
setattr(dest, &a);
2017-10-11 20:57:18 +02:00
}
2020-04-02 11:17:45 +02:00
void fclone_attr(int src, int dest) {
file_attr a;
fgetattr(src, &a);
fsetattr(dest, &a);
2017-10-11 20:57:18 +02:00
}
2017-10-11 21:39:39 +02:00
2019-02-25 05:09:34 +01:00
void *__mmap(const char *filename, size_t *size, bool rw) {
2017-11-19 20:40:37 +01:00
struct stat st;
2019-02-25 05:09:34 +01:00
void *buf;
2018-04-14 21:18:18 +02:00
int fd = xopen(filename, (rw ? O_RDWR : O_RDONLY) | O_CLOEXEC);
2017-12-06 05:51:16 +01:00
fstat(fd, &st);
2017-11-19 20:40:37 +01:00
if (S_ISBLK(st.st_mode))
ioctl(fd, BLKGETSIZE64, size);
else
*size = st.st_size;
2019-02-25 05:09:34 +01:00
buf = *size > 0 ? xmmap(nullptr, *size, PROT_READ | (rw ? PROT_WRITE : 0), MAP_SHARED, fd, 0) : nullptr;
2017-11-09 18:51:41 +01:00
close(fd);
2019-02-25 05:09:34 +01:00
return buf;
2017-11-09 18:51:41 +01:00
}
void fd_full_read(int fd, void **buf, size_t *size) {
*size = lseek(fd, 0, SEEK_END);
lseek(fd, 0, SEEK_SET);
*buf = xmalloc(*size + 1);
xxread(fd, *buf, *size);
((char *) *buf)[*size] = '\0';
}
2017-12-06 18:30:48 +01:00
void full_read(const char *filename, void **buf, size_t *size) {
2018-04-14 21:18:18 +02:00
int fd = xopen(filename, O_RDONLY | O_CLOEXEC);
2017-12-06 18:30:48 +01:00
if (fd < 0) {
2018-11-03 08:06:01 +01:00
*buf = nullptr;
2017-12-06 18:30:48 +01:00
*size = 0;
return;
}
fd_full_read(fd, buf, size);
close(fd);
}
2017-11-09 18:51:41 +01:00
void write_zero(int fd, size_t size) {
char buf[4096] = {0};
size_t len;
while (size > 0) {
len = sizeof(buf) > size ? size : sizeof(buf);
write(fd, buf, len);
size -= len;
}
2017-11-09 18:51:41 +01:00
}
2018-11-03 08:06:01 +01:00
2020-04-02 11:17:45 +02:00
void file_readline(bool trim, const char *file, const function<bool(string_view)> &fn) {
2019-03-06 02:27:09 +01:00
FILE *fp = xfopen(file, "re");
2018-11-03 08:06:01 +01:00
if (fp == nullptr)
return;
size_t len = 1024;
char *buf = (char *) malloc(len);
char *start;
ssize_t read;
while ((read = getline(&buf, &len, fp)) >= 0) {
start = buf;
if (trim) {
2019-03-09 10:27:04 +01:00
while (read && (buf[read - 1] == '\n' || buf[read - 1] == ' '))
--read;
buf[read] = '\0';
while (*start == ' ')
++start;
}
2019-03-06 02:27:09 +01:00
if (!fn(start))
break;
2018-11-03 08:06:01 +01:00
}
fclose(fp);
free(buf);
2018-11-03 08:06:01 +01:00
}
2019-03-06 02:27:09 +01:00
2020-04-02 11:17:45 +02:00
void parse_prop_file(const char *file, const function<bool(string_view, string_view)> &&fn) {
2019-12-13 06:37:06 +01:00
file_readline(true, file, [&](string_view line_view) -> bool {
2019-03-06 02:27:09 +01:00
char *line = (char *) line_view.data();
if (line[0] == '#')
return true;
char *eql = strchr(line, '=');
if (eql == nullptr || eql == line)
return true;
*eql = '\0';
return fn(line, eql + 1);
2019-12-13 06:37:06 +01:00
});
2019-03-06 02:27:09 +01:00
}
2019-06-23 12:53:41 +02:00
2020-04-02 11:17:45 +02:00
void parse_mnt(const char *file, const function<bool(mntent*)> &fn) {
2020-04-02 08:37:11 +02:00
auto fp = sFILE(setmntent(file, "re"), endmntent);
2019-06-23 12:53:41 +02:00
if (fp) {
2019-06-23 23:54:48 +02:00
mntent mentry{};
char buf[4096];
while (getmntent_r(fp.get(), &mentry, buf, sizeof(buf))) {
if (!fn(&mentry))
2019-06-23 12:53:41 +02:00
break;
}
}
}
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 13:39:28 +02:00
void backup_folder(const char *dir, vector<raw_file> &files) {
char path[4096];
2020-04-11 13:05:34 +02:00
xrealpath(dir, path);
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 13:39:28 +02:00
int len = strlen(path);
2020-04-02 08:37:11 +02:00
post_order_walk(xopen(dir, O_RDONLY), [&](int dfd, dirent *entry) -> int {
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 13:39:28 +02:00
int fd = xopenat(dfd, entry->d_name, O_RDONLY);
if (fd < 0)
return -1;
2020-04-02 08:37:11 +02:00
run_finally f([&]{ close(fd); });
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 13:39:28 +02:00
if (fd_path(fd, path, sizeof(path)) < 0)
return -1;
raw_file file;
file.path = path + len + 1;
if (fgetattr(fd, &file.attr) < 0)
return -1;
if (entry->d_type == DT_REG) {
fd_full_read(fd, file.buf, file.sz);
} else if (entry->d_type == DT_LNK) {
xreadlinkat(dfd, entry->d_name, path, sizeof(path));
file.sz = strlen(path) + 1;
file.buf = (uint8_t *) xmalloc(file.sz);
memcpy(file.buf, path, file.sz);
}
files.emplace_back(std::move(file));
return 0;
});
}
void restore_folder(const char *dir, vector<raw_file> &files) {
string base(dir);
// Reversed post-order means folders will always be first
for (raw_file &file : reversed(files)) {
string path = base + "/" + file.path;
if (S_ISDIR(file.attr.st.st_mode)) {
mkdirs(path.data(), 0);
} else if (S_ISREG(file.attr.st.st_mode)) {
2020-04-02 08:37:11 +02:00
auto fp = xopen_file(path.data(), "we");
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 13:39:28 +02:00
fwrite(file.buf, 1, file.sz, fp.get());
} else if (S_ISLNK(file.attr.st.st_mode)) {
symlink((char *)file.buf, path.data());
}
setattr(path.data(), &file.attr);
}
}