Magisk/native/jni/magiskhide/proc_monitor.cpp

332 lines
7.9 KiB
C++
Raw Normal View History

2018-11-01 18:23:12 +01:00
/* proc_monitor.cpp - Monitor am_proc_start events and unmount
2017-08-01 09:34:16 +02:00
*
* We monitor the listed APK files from /data/app until they get opened
* via inotify to detect a new app launch.
*
* If it's a target we pause it ASAP, and fork a new process to join
* its mount namespace and do all the unmounting/mocking.
2017-04-06 00:12:29 +02:00
*/
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
2018-07-13 16:14:32 +02:00
#include <fcntl.h>
2017-04-06 00:12:29 +02:00
#include <signal.h>
#include <pthread.h>
#include <sys/inotify.h>
2017-04-06 00:12:29 +02:00
#include <sys/types.h>
#include <sys/wait.h>
2017-07-10 17:39:33 +02:00
#include <sys/mount.h>
2019-01-20 05:59:37 +01:00
#include <vector>
#include <string>
#include <map>
2017-04-06 00:12:29 +02:00
#include <magisk.h>
#include <utils.h>
2016-12-30 19:44:24 +01:00
#include "magiskhide.h"
2019-01-20 05:59:37 +01:00
using namespace std;
extern char *system_block, *vendor_block, *data_block;
2017-04-07 01:50:02 +02:00
static int inotify_fd = -1;
2017-04-06 00:12:29 +02:00
// Workaround for the lack of pthread_cancel
2018-11-01 18:23:12 +01:00
static void term_thread(int) {
LOGD("proc_monitor: running cleanup\n");
2019-01-20 05:59:37 +01:00
hide_list.clear();
hide_uid.clear();
2018-11-16 06:37:41 +01:00
hide_enabled = false;
2018-11-01 18:23:12 +01:00
pthread_mutex_destroy(&list_lock);
close(inotify_fd);
inotify_fd = -1;
2018-11-01 18:23:12 +01:00
LOGD("proc_monitor: terminating\n");
2018-11-07 08:10:38 +01:00
pthread_exit(nullptr);
2017-04-06 00:12:29 +02:00
}
2017-01-01 11:54:13 +01:00
static inline int read_ns(const int pid, struct stat *st) {
2017-07-02 19:02:11 +02:00
char path[32];
sprintf(path, "/proc/%d/ns/mnt", pid);
2018-07-11 17:41:38 +02:00
return stat(path, st);
2017-07-02 19:02:11 +02:00
}
2018-11-23 20:32:33 +01:00
static inline void lazy_unmount(const char* mountpoint) {
2018-01-11 17:23:38 +01:00
if (umount2(mountpoint, MNT_DETACH) != -1)
2017-07-10 17:39:33 +02:00
LOGD("hide_daemon: Unmounted (%s)\n", mountpoint);
}
/* APK monitoring doesn't seem to require checking namespace
* separation from PPID. Preserve this function just in case */
#if 0
static inline int parse_ppid(const int pid) {
2018-11-23 20:32:33 +01:00
char path[32];
int ppid;
sprintf(path, "/proc/%d/stat", pid);
2018-11-24 21:53:15 +01:00
FILE *stat = fopen(path, "re");
2018-11-23 20:32:33 +01:00
if (stat == nullptr)
return -1;
/* PID COMM STATE PPID ..... */
2018-11-23 20:32:33 +01:00
fscanf(stat, "%*d %*s %*c %d", &ppid);
2018-11-24 03:15:44 +01:00
fclose(stat);
return ppid;
}
#endif
static bool is_pid_safetynet_process(const int pid) {
char path[32];
char buf[64];
int fd;
ssize_t len;
sprintf(path, "/proc/%d/cmdline", pid);
fd = open(path, O_RDONLY);
if (fd == -1)
return false;
len = read(fd, buf, sizeof(buf));
close(fd);
if (len == -1)
return false;
return !strcmp(buf, SAFETYNET_PROCESS);
}
static void hide_daemon(int pid) {
LOGD("hide_daemon: handling PID=[%d]\n", pid);
2017-07-10 17:39:33 +02:00
2018-11-23 20:32:33 +01:00
char buffer[4096];
2019-01-20 05:59:37 +01:00
vector<string> mounts;
2017-07-10 17:39:33 +02:00
manage_selinux();
2017-07-18 06:26:23 +02:00
clean_magisk_props();
2017-07-10 17:39:33 +02:00
if (switch_mnt_ns(pid))
goto exit;
2017-07-10 17:39:33 +02:00
2018-11-13 08:07:02 +01:00
snprintf(buffer, sizeof(buffer), "/proc/%d", pid);
chdir(buffer);
2017-07-10 17:39:33 +02:00
2019-01-20 05:59:37 +01:00
mounts = file_to_vector("mounts");
2018-06-16 23:16:52 +02:00
// Unmount dummy skeletons and /sbin links
2018-11-01 18:23:12 +01:00
for (auto &s : mounts) {
2019-01-20 05:59:37 +01:00
if (str_contains(s, "tmpfs /system/") || str_contains(s, "tmpfs /vendor/") ||
str_contains(s, "tmpfs /sbin")) {
sscanf(s.c_str(), "%*s %4096s", buffer);
2017-07-10 17:39:33 +02:00
lazy_unmount(buffer);
}
}
// Re-read mount infos
2019-01-20 05:59:37 +01:00
mounts = file_to_vector("mounts");
2017-07-10 17:39:33 +02:00
// Unmount everything under /system, /vendor, and data mounts
2018-11-01 18:23:12 +01:00
for (auto &s : mounts) {
2019-01-20 05:59:37 +01:00
if ((str_contains(s, " /system/") || str_contains(s, " /vendor/")) &&
(str_contains(s, system_block) || str_contains(s, vendor_block) || str_contains(s, data_block))) {
2019-01-20 05:59:37 +01:00
sscanf(s.c_str(), "%*s %4096s", buffer);
2017-07-10 17:39:33 +02:00
lazy_unmount(buffer);
}
}
exit:
// Send resume signal
kill(pid, SIGCONT);
_exit(0);
2017-07-10 17:39:33 +02:00
}
// A mapping from pid to namespace inode to avoid time-consuming GC
static map<int, uint64_t> pid_ns_map;
static bool process_pid(int pid) {
// We're only interested in PIDs > 1000
if (pid <= 1000)
return true;
struct stat ns;
int uid = get_uid(pid);
if (hide_uid.count(uid)) {
// Make sure we can read mount namespace
if (read_ns(pid, &ns))
return true;
// Check if it's a process we haven't already hijacked
auto pos = pid_ns_map.find(pid);
if (pos != pid_ns_map.end() && pos->second == ns.st_ino)
return true;
if (uid == gms_uid) {
// Check /proc/uid/cmdline to see if it's SAFETYNET_PROCESS
if (!is_pid_safetynet_process(pid))
return true;
LOGD("proc_monitor: " SAFETYNET_PROCESS "\n");
}
// Send pause signal ASAP
if (kill(pid, SIGSTOP) == -1)
return true;
pid_ns_map[pid] = ns.st_ino;
LOGI("proc_monitor: UID=[%d] PID=[%d] ns=[%llu]\n", uid, pid, ns.st_ino);
/*
* The setns system call do not support multithread processes
* We have to fork a new process, setns, then do the unmounts
*/
if (fork_dont_care() == 0)
hide_daemon(pid);
}
return true;
}
2019-02-14 06:52:59 +01:00
static int xinotify_add_watch(int fd, const char* path, uint32_t mask) {
int ret = inotify_add_watch(fd, path, mask);
if (ret >= 0) {
2019-02-16 08:30:48 +01:00
LOGD("proc_monitor: Monitoring %s\n", path);
2019-02-14 06:52:59 +01:00
} else {
PLOGE("proc_monitor: Monitor %s", path);
}
return ret;
}
static char *append_path(char *eof, const char *name) {
*(eof++) = '/';
char c;
while ((c = *(name++)))
*(eof++) = c;
*eof = '\0';
return eof;
}
2019-02-14 06:52:59 +01:00
#define DATA_APP "/data/app"
static int new_inotify;
static int data_app_wd;
static vector<bool> app_in_data;
2019-02-14 06:52:59 +01:00
static void find_apks(char *path, char *eof) {
DIR *dir = opendir(path);
if (dir == nullptr)
return;
2019-02-14 06:52:59 +01:00
struct dirent *entry;
char *dash;
for (; (entry = xreaddir(dir)); *eof = '\0') {
2019-02-14 06:52:59 +01:00
if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0)
continue;
if (entry->d_type == DT_DIR) {
2019-02-14 06:52:59 +01:00
find_apks(path, append_path(eof, entry->d_name));
} else if (strend(entry->d_name, ".apk") == 0) {
append_path(eof, entry->d_name);
/* Supported path will be in either format:
* /data/app/[pkg]-[hash or 1 or 2]/base.apk
* /data/app/[pkg]-[1 or 2].apk */
if ((dash = strchr(path, '-')) == nullptr)
continue;
2019-02-14 06:52:59 +01:00
*dash = '\0';
for (int i = 0; i < hide_list.size(); ++i) {
if (hide_list[i] == path + sizeof(DATA_APP)) {
2019-02-14 06:52:59 +01:00
*dash = '-';
append_path(eof, entry->d_name);
xinotify_add_watch(new_inotify, path, IN_OPEN | IN_DELETE);
app_in_data[i] = true;
2019-02-14 06:52:59 +01:00
break;
}
}
2019-02-14 06:52:59 +01:00
*dash = '-';
break;
}
}
closedir(dir);
}
// Iterate through /data/app and search all .apk files
void update_inotify_mask(bool refresh) {
2019-02-14 06:52:59 +01:00
char buf[4096];
new_inotify = inotify_init();
if (new_inotify < 0) {
LOGE("proc_monitor: Cannot initialize inotify: %s\n", strerror(errno));
term_thread(TERM_THREAD);
}
2019-02-16 08:30:48 +01:00
LOGD("proc_monitor: Updating inotify list\n");
2019-02-14 06:52:59 +01:00
strcpy(buf, DATA_APP);
app_in_data.clear();
bool reinstall = false;
{
MutexGuard lock(list_lock);
app_in_data.resize(hide_list.size(), false);
find_apks(buf, buf + sizeof(DATA_APP) - 1);
// Stop monitoring /data/app
if (inotify_fd >= 0)
inotify_rm_watch(inotify_fd, data_app_wd);
// All apps on the hide list should be installed in data
auto it = hide_list.begin();
for (bool in_data : app_in_data) {
if (!in_data) {
if (reinstall_apk(it->c_str()) != 0) {
// Reinstallation failed, remove from hide list
hide_list.erase(it);
refresh = true;
continue;
}
reinstall = true;
}
it++;
}
if (refresh && !reinstall)
refresh_uid();
}
if (reinstall) {
// Rerun detection
close(new_inotify);
update_inotify_mask(refresh);
return;
}
// Add /data/app itself to the watch list to detect app (un)installations/updates
data_app_wd = xinotify_add_watch(new_inotify, DATA_APP, IN_CLOSE_WRITE | IN_MOVED_TO | IN_DELETE);
2019-02-14 10:24:30 +01:00
int tmp = inotify_fd;
inotify_fd = new_inotify;
if (tmp >= 0)
close(tmp);
}
2017-04-21 18:54:08 +02:00
void proc_monitor() {
// Unblock user signals
sigset_t block_set;
sigemptyset(&block_set);
sigaddset(&block_set, TERM_THREAD);
2019-01-20 05:59:37 +01:00
pthread_sigmask(SIG_UNBLOCK, &block_set, nullptr);
2017-04-06 00:12:29 +02:00
// Register the cancel signal
2019-01-20 05:59:37 +01:00
struct sigaction act{};
act.sa_handler = term_thread;
2019-01-20 05:59:37 +01:00
sigaction(TERM_THREAD, &act, nullptr);
2017-05-07 21:11:14 +02:00
// Read inotify events
ssize_t len;
char buf[4096];
2019-02-16 08:49:36 +01:00
auto event = reinterpret_cast<inotify_event *>(buf);
while ((len = read(inotify_fd, buf, sizeof(buf))) >= 0) {
2019-02-16 08:49:36 +01:00
if (len < sizeof(*event))
continue;
2018-10-12 06:50:47 +02:00
2019-02-16 08:49:36 +01:00
if (event->mask & IN_OPEN) {
// Since we're just watching files,
// extracting file name is not possible from querying event
MutexGuard lock(list_lock);
crawl_procfs(process_pid);
} else if (!(event->mask & IN_IGNORED)) {
LOGD("proc_monitor: inotify: /data/app change detected\n");
update_inotify_mask(true);
}
2017-06-02 22:31:01 +02:00
}
PLOGE("proc_monitor: read inotify");
}