2019-05-27 09:29:43 +02:00
|
|
|
#include <sys/stat.h>
|
|
|
|
#include <sys/types.h>
|
|
|
|
#include <sys/mount.h>
|
|
|
|
#include <sys/sysmacros.h>
|
|
|
|
#include <stdio.h>
|
|
|
|
#include <stdlib.h>
|
|
|
|
#include <unistd.h>
|
|
|
|
#include <string.h>
|
|
|
|
#include <fcntl.h>
|
|
|
|
#include <libgen.h>
|
|
|
|
|
|
|
|
#include <xz.h>
|
|
|
|
#include <magisk.h>
|
|
|
|
#include <cpio.h>
|
|
|
|
#include <utils.h>
|
|
|
|
#include <flags.h>
|
|
|
|
|
|
|
|
#include "binaries.h"
|
|
|
|
#ifdef USE_64BIT
|
|
|
|
#include "binaries_arch64.h"
|
|
|
|
#else
|
|
|
|
#include "binaries_arch.h"
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#include "init.h"
|
|
|
|
|
|
|
|
using namespace std;
|
|
|
|
|
2019-06-22 12:14:33 +02:00
|
|
|
constexpr const char *init_applet[] =
|
|
|
|
{ "magiskpolicy", "supolicy", "magisk", nullptr };
|
|
|
|
constexpr int (*init_applet_main[])(int, char *[]) =
|
|
|
|
{ magiskpolicy_main, magiskpolicy_main, magisk_proxy_main, nullptr };
|
|
|
|
|
2019-05-27 09:29:43 +02:00
|
|
|
#ifdef MAGISK_DEBUG
|
|
|
|
static FILE *kmsg;
|
|
|
|
static int vprintk(const char *fmt, va_list ap) {
|
|
|
|
fprintf(kmsg, "magiskinit: ");
|
|
|
|
return vfprintf(kmsg, fmt, ap);
|
|
|
|
}
|
|
|
|
static void setup_klog() {
|
|
|
|
mknod("/kmsg", S_IFCHR | 0666, makedev(1, 11));
|
|
|
|
int fd = xopen("/kmsg", O_WRONLY | O_CLOEXEC);
|
|
|
|
kmsg = fdopen(fd, "w");
|
|
|
|
setbuf(kmsg, nullptr);
|
|
|
|
unlink("/kmsg");
|
|
|
|
log_cb.d = log_cb.i = log_cb.w = log_cb.e = vprintk;
|
|
|
|
log_cb.ex = nop_ex;
|
2019-06-25 12:34:54 +02:00
|
|
|
|
|
|
|
// Prevent file descriptor confusion
|
|
|
|
mknod("/null", S_IFCHR | 0666, makedev(1, 3));
|
|
|
|
int null = open("/null", O_RDWR | O_CLOEXEC);
|
|
|
|
unlink("/null");
|
|
|
|
xdup3(null, STDIN_FILENO, O_CLOEXEC);
|
|
|
|
xdup3(null, STDOUT_FILENO, O_CLOEXEC);
|
|
|
|
xdup3(null, STDERR_FILENO, O_CLOEXEC);
|
|
|
|
if (null > STDERR_FILENO)
|
|
|
|
close(null);
|
2019-05-27 09:29:43 +02:00
|
|
|
}
|
|
|
|
#else
|
|
|
|
#define setup_klog(...)
|
|
|
|
#endif
|
|
|
|
|
|
|
|
static bool unxz(int fd, const uint8_t *buf, size_t size) {
|
|
|
|
uint8_t out[8192];
|
|
|
|
xz_crc32_init();
|
|
|
|
struct xz_dec *dec = xz_dec_init(XZ_DYNALLOC, 1 << 26);
|
|
|
|
struct xz_buf b = {
|
|
|
|
.in = buf,
|
|
|
|
.in_pos = 0,
|
|
|
|
.in_size = size,
|
|
|
|
.out = out,
|
|
|
|
.out_pos = 0,
|
|
|
|
.out_size = sizeof(out)
|
|
|
|
};
|
|
|
|
enum xz_ret ret;
|
|
|
|
do {
|
|
|
|
ret = xz_dec_run(dec, &b);
|
|
|
|
if (ret != XZ_OK && ret != XZ_STREAM_END)
|
|
|
|
return false;
|
|
|
|
write(fd, out, b.out_pos);
|
|
|
|
b.out_pos = 0;
|
|
|
|
} while (b.in_pos != size);
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void decompress_ramdisk() {
|
|
|
|
constexpr char tmp[] = "tmp.cpio";
|
|
|
|
constexpr char ramdisk_xz[] = "ramdisk.cpio.xz";
|
|
|
|
if (access(ramdisk_xz, F_OK))
|
|
|
|
return;
|
|
|
|
LOGD("Decompressing ramdisk from %s\n", ramdisk_xz);
|
|
|
|
uint8_t *buf;
|
|
|
|
size_t sz;
|
|
|
|
mmap_ro(ramdisk_xz, buf, sz);
|
|
|
|
int fd = open(tmp, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC);
|
|
|
|
unxz(fd, buf, sz);
|
|
|
|
munmap(buf, sz);
|
|
|
|
close(fd);
|
|
|
|
cpio_mmap cpio(tmp);
|
|
|
|
cpio.extract();
|
|
|
|
unlink(tmp);
|
|
|
|
unlink(ramdisk_xz);
|
|
|
|
}
|
|
|
|
|
|
|
|
int dump_magisk(const char *path, mode_t mode) {
|
|
|
|
int fd = open(path, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, mode);
|
|
|
|
if (fd < 0)
|
|
|
|
return 1;
|
|
|
|
if (!unxz(fd, magisk_xz, sizeof(magisk_xz)))
|
|
|
|
return 1;
|
|
|
|
close(fd);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int dump_manager(const char *path, mode_t mode) {
|
|
|
|
int fd = open(path, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, mode);
|
|
|
|
if (fd < 0)
|
|
|
|
return 1;
|
|
|
|
if (!unxz(fd, manager_xz, sizeof(manager_xz)))
|
|
|
|
return 1;
|
|
|
|
close(fd);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2019-06-22 12:14:33 +02:00
|
|
|
void BaseInit::cleanup() {
|
|
|
|
umount("/sys");
|
|
|
|
umount("/proc");
|
2019-06-25 11:47:16 +02:00
|
|
|
umount("/dev");
|
2019-06-22 12:14:33 +02:00
|
|
|
}
|
|
|
|
|
2019-06-16 21:45:32 +02:00
|
|
|
void BaseInit::re_exec_init() {
|
2019-05-27 09:29:43 +02:00
|
|
|
LOGD("Re-exec /init\n");
|
|
|
|
cleanup();
|
|
|
|
execv("/init", argv);
|
|
|
|
exit(1);
|
|
|
|
}
|
|
|
|
|
2019-06-24 00:14:47 +02:00
|
|
|
void RootFSInit::start() {
|
2019-05-27 09:29:43 +02:00
|
|
|
early_mount();
|
|
|
|
setup_rootfs();
|
|
|
|
re_exec_init();
|
|
|
|
}
|
|
|
|
|
Logical Resizable Android Partitions support
The way how logical partition, or "Logical Resizable Android Partitions"
as they say in AOSP source code, is setup makes it impossible to early
mount the partitions from the shared super partition with just
a few lines of code; in fact, AOSP has a whole "fs_mgr" folder which
consist of multiple complex libraries, with 15K lines of code just
to deal with the device mapper shenanigans.
In order to keep the already overly complicated MagiskInit more
managable, I chose NOT to go the route of including fs_mgr directly
into MagiskInit. Luckily, starting from Android Q, Google decided to
split init startup into 3 stages, with the first stage doing _only_
early mount. This is great news, because we can simply let the stock
init do its own thing for us, and we intercept the bootup sequence.
So the workflow can be visualized roughly below:
Magisk First Stage --> First Stage Mount --> Magisk Second Stage --+
(MagiskInit) (Original Init) (MagiskInit) +
+
+
...Rest of the boot... <-- Second Stage <-- Selinux Setup <--+
(__________________ Original Init ____________________)
The catch here is that after doing all the first stage mounting, /init
will pivot /system as root directory (/), leaving us impossible to
regain control after we hand it over. So the solution here is to patch
fstab in /first_stage_ramdisk on-the-fly to redirect /system to
/system_root, making the original init do all the hard work for
us and mount required early mount partitions, but skips the step of
switching root directory. It will also conveniently hand over execution
back to MagiskInit, which we will reuse the routine for patching
root directory in normal system-as-root situations.
2019-06-29 09:47:29 +02:00
|
|
|
void SARCommon::start() {
|
2019-06-24 00:14:47 +02:00
|
|
|
early_mount();
|
2019-06-24 10:21:33 +02:00
|
|
|
patch_rootdir();
|
2019-06-24 00:14:47 +02:00
|
|
|
re_exec_init();
|
|
|
|
}
|
|
|
|
|
Logical Resizable Android Partitions support
The way how logical partition, or "Logical Resizable Android Partitions"
as they say in AOSP source code, is setup makes it impossible to early
mount the partitions from the shared super partition with just
a few lines of code; in fact, AOSP has a whole "fs_mgr" folder which
consist of multiple complex libraries, with 15K lines of code just
to deal with the device mapper shenanigans.
In order to keep the already overly complicated MagiskInit more
managable, I chose NOT to go the route of including fs_mgr directly
into MagiskInit. Luckily, starting from Android Q, Google decided to
split init startup into 3 stages, with the first stage doing _only_
early mount. This is great news, because we can simply let the stock
init do its own thing for us, and we intercept the bootup sequence.
So the workflow can be visualized roughly below:
Magisk First Stage --> First Stage Mount --> Magisk Second Stage --+
(MagiskInit) (Original Init) (MagiskInit) +
+
+
...Rest of the boot... <-- Second Stage <-- Selinux Setup <--+
(__________________ Original Init ____________________)
The catch here is that after doing all the first stage mounting, /init
will pivot /system as root directory (/), leaving us impossible to
regain control after we hand it over. So the solution here is to patch
fstab in /first_stage_ramdisk on-the-fly to redirect /system to
/system_root, making the original init do all the hard work for
us and mount required early mount partitions, but skips the step of
switching root directory. It will also conveniently hand over execution
back to MagiskInit, which we will reuse the routine for patching
root directory in normal system-as-root situations.
2019-06-29 09:47:29 +02:00
|
|
|
void FirstStageInit::start() {
|
|
|
|
patch_fstab();
|
|
|
|
cleanup();
|
|
|
|
execv("/system/bin/init", argv);
|
|
|
|
exit(1);
|
|
|
|
}
|
|
|
|
|
2019-06-16 21:45:32 +02:00
|
|
|
class RecoveryInit : public BaseInit {
|
|
|
|
public:
|
|
|
|
RecoveryInit(char *argv[], cmdline *cmd) : BaseInit(argv, cmd) {};
|
|
|
|
void start() override {
|
|
|
|
LOGD("Ramdisk is recovery, abort\n");
|
|
|
|
rename("/.backup/init", "/init");
|
|
|
|
rm_rf("/.backup");
|
|
|
|
re_exec_init();
|
|
|
|
}
|
|
|
|
};
|
|
|
|
|
2019-06-24 00:14:47 +02:00
|
|
|
class TestInit : public SARInit {
|
2019-06-16 21:45:32 +02:00
|
|
|
public:
|
2019-06-24 00:14:47 +02:00
|
|
|
TestInit(char *argv[], cmdline *cmd) : SARInit(argv, cmd) {};
|
2019-06-16 21:45:32 +02:00
|
|
|
void start() override {
|
|
|
|
early_mount();
|
2019-06-24 10:50:47 +02:00
|
|
|
patch_rootdir();
|
2019-06-16 21:45:32 +02:00
|
|
|
cleanup();
|
|
|
|
}
|
|
|
|
};
|
2019-05-27 09:29:43 +02:00
|
|
|
|
2019-06-25 12:34:54 +02:00
|
|
|
static void setup_test(const char *dir) {
|
|
|
|
// Log to console
|
|
|
|
cmdline_logging();
|
|
|
|
log_cb.ex = nop_ex;
|
|
|
|
|
|
|
|
// Switch to isolate namespace
|
|
|
|
xunshare(CLONE_NEWNS);
|
|
|
|
xmount(nullptr, "/", nullptr, MS_PRIVATE | MS_REC, nullptr);
|
|
|
|
|
|
|
|
// Unmount everything in reverse
|
|
|
|
vector<string> mounts;
|
|
|
|
parse_mnt("/proc/mounts", [&](mntent *me) {
|
|
|
|
if (me->mnt_dir != "/"sv)
|
|
|
|
mounts.emplace_back(me->mnt_dir);
|
|
|
|
return true;
|
|
|
|
});
|
|
|
|
for (auto m = mounts.rbegin(); m != mounts.rend(); ++m)
|
|
|
|
xumount(m->data());
|
|
|
|
|
|
|
|
// chroot jail
|
|
|
|
chdir(dir);
|
|
|
|
chroot(".");
|
|
|
|
chdir("/");
|
|
|
|
}
|
|
|
|
|
2019-05-27 09:29:43 +02:00
|
|
|
int main(int argc, char *argv[]) {
|
|
|
|
umask(0);
|
|
|
|
|
|
|
|
for (int i = 0; init_applet[i]; ++i) {
|
|
|
|
if (strcmp(basename(argv[0]), init_applet[i]) == 0)
|
|
|
|
return (*init_applet_main[i])(argc, argv);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (argc > 1 && strcmp(argv[1], "-x") == 0) {
|
|
|
|
if (strcmp(argv[2], "magisk") == 0)
|
|
|
|
return dump_magisk(argv[3], 0755);
|
|
|
|
else if (strcmp(argv[2], "manager") == 0)
|
|
|
|
return dump_manager(argv[3], 0644);
|
|
|
|
}
|
|
|
|
|
Logical Resizable Android Partitions support
The way how logical partition, or "Logical Resizable Android Partitions"
as they say in AOSP source code, is setup makes it impossible to early
mount the partitions from the shared super partition with just
a few lines of code; in fact, AOSP has a whole "fs_mgr" folder which
consist of multiple complex libraries, with 15K lines of code just
to deal with the device mapper shenanigans.
In order to keep the already overly complicated MagiskInit more
managable, I chose NOT to go the route of including fs_mgr directly
into MagiskInit. Luckily, starting from Android Q, Google decided to
split init startup into 3 stages, with the first stage doing _only_
early mount. This is great news, because we can simply let the stock
init do its own thing for us, and we intercept the bootup sequence.
So the workflow can be visualized roughly below:
Magisk First Stage --> First Stage Mount --> Magisk Second Stage --+
(MagiskInit) (Original Init) (MagiskInit) +
+
+
...Rest of the boot... <-- Second Stage <-- Selinux Setup <--+
(__________________ Original Init ____________________)
The catch here is that after doing all the first stage mounting, /init
will pivot /system as root directory (/), leaving us impossible to
regain control after we hand it over. So the solution here is to patch
fstab in /first_stage_ramdisk on-the-fly to redirect /system to
/system_root, making the original init do all the hard work for
us and mount required early mount partitions, but skips the step of
switching root directory. It will also conveniently hand over execution
back to MagiskInit, which we will reuse the routine for patching
root directory in normal system-as-root situations.
2019-06-29 09:47:29 +02:00
|
|
|
if (argc > 1 && argv[1] == "selinux_setup"sv) {
|
|
|
|
auto init = make_unique<SecondStageInit>(argv);
|
|
|
|
init->start();
|
|
|
|
}
|
|
|
|
|
2019-06-16 21:45:32 +02:00
|
|
|
#ifdef MAGISK_DEBUG
|
|
|
|
bool run_test = getenv("INIT_TEST") != nullptr;
|
|
|
|
#else
|
|
|
|
constexpr bool run_test = false;
|
|
|
|
#endif
|
2019-05-27 09:29:43 +02:00
|
|
|
|
2019-06-16 21:45:32 +02:00
|
|
|
if (run_test) {
|
2019-06-25 12:34:54 +02:00
|
|
|
setup_test(dirname(argv[0]));
|
2019-06-16 21:45:32 +02:00
|
|
|
} else {
|
|
|
|
if (getpid() != 1)
|
|
|
|
return 1;
|
|
|
|
setup_klog();
|
|
|
|
}
|
2019-06-16 07:25:09 +02:00
|
|
|
|
|
|
|
cmdline cmd{};
|
|
|
|
load_kernel_info(&cmd);
|
|
|
|
|
2019-06-16 21:45:32 +02:00
|
|
|
unique_ptr<BaseInit> init;
|
|
|
|
if (run_test) {
|
|
|
|
init = make_unique<TestInit>(argv, &cmd);
|
Logical Resizable Android Partitions support
The way how logical partition, or "Logical Resizable Android Partitions"
as they say in AOSP source code, is setup makes it impossible to early
mount the partitions from the shared super partition with just
a few lines of code; in fact, AOSP has a whole "fs_mgr" folder which
consist of multiple complex libraries, with 15K lines of code just
to deal with the device mapper shenanigans.
In order to keep the already overly complicated MagiskInit more
managable, I chose NOT to go the route of including fs_mgr directly
into MagiskInit. Luckily, starting from Android Q, Google decided to
split init startup into 3 stages, with the first stage doing _only_
early mount. This is great news, because we can simply let the stock
init do its own thing for us, and we intercept the bootup sequence.
So the workflow can be visualized roughly below:
Magisk First Stage --> First Stage Mount --> Magisk Second Stage --+
(MagiskInit) (Original Init) (MagiskInit) +
+
+
...Rest of the boot... <-- Second Stage <-- Selinux Setup <--+
(__________________ Original Init ____________________)
The catch here is that after doing all the first stage mounting, /init
will pivot /system as root directory (/), leaving us impossible to
regain control after we hand it over. So the solution here is to patch
fstab in /first_stage_ramdisk on-the-fly to redirect /system to
/system_root, making the original init do all the hard work for
us and mount required early mount partitions, but skips the step of
switching root directory. It will also conveniently hand over execution
back to MagiskInit, which we will reuse the routine for patching
root directory in normal system-as-root situations.
2019-06-29 09:47:29 +02:00
|
|
|
} else if (cmd.force_normal_boot) {
|
|
|
|
init = make_unique<FirstStageInit>(argv, &cmd);
|
2019-06-16 21:45:32 +02:00
|
|
|
} else if (cmd.system_as_root) {
|
2019-06-24 00:14:47 +02:00
|
|
|
if (access("/overlay", F_OK) == 0) /* Compatible mode */
|
|
|
|
init = make_unique<SARCompatInit>(argv, &cmd);
|
|
|
|
else
|
|
|
|
init = make_unique<SARInit>(argv, &cmd);
|
2019-06-16 21:45:32 +02:00
|
|
|
} else {
|
|
|
|
decompress_ramdisk();
|
|
|
|
if (access("/sbin/recovery", F_OK) == 0)
|
|
|
|
init = make_unique<RecoveryInit>(argv, &cmd);
|
|
|
|
else
|
|
|
|
init = make_unique<LegacyInit>(argv, &cmd);
|
|
|
|
}
|
2019-05-27 09:29:43 +02:00
|
|
|
|
|
|
|
// Run the main routine
|
2019-06-16 21:45:32 +02:00
|
|
|
init->start();
|
Logical Resizable Android Partitions support
The way how logical partition, or "Logical Resizable Android Partitions"
as they say in AOSP source code, is setup makes it impossible to early
mount the partitions from the shared super partition with just
a few lines of code; in fact, AOSP has a whole "fs_mgr" folder which
consist of multiple complex libraries, with 15K lines of code just
to deal with the device mapper shenanigans.
In order to keep the already overly complicated MagiskInit more
managable, I chose NOT to go the route of including fs_mgr directly
into MagiskInit. Luckily, starting from Android Q, Google decided to
split init startup into 3 stages, with the first stage doing _only_
early mount. This is great news, because we can simply let the stock
init do its own thing for us, and we intercept the bootup sequence.
So the workflow can be visualized roughly below:
Magisk First Stage --> First Stage Mount --> Magisk Second Stage --+
(MagiskInit) (Original Init) (MagiskInit) +
+
+
...Rest of the boot... <-- Second Stage <-- Selinux Setup <--+
(__________________ Original Init ____________________)
The catch here is that after doing all the first stage mounting, /init
will pivot /system as root directory (/), leaving us impossible to
regain control after we hand it over. So the solution here is to patch
fstab in /first_stage_ramdisk on-the-fly to redirect /system to
/system_root, making the original init do all the hard work for
us and mount required early mount partitions, but skips the step of
switching root directory. It will also conveniently hand over execution
back to MagiskInit, which we will reuse the routine for patching
root directory in normal system-as-root situations.
2019-06-29 09:47:29 +02:00
|
|
|
exit(1);
|
2019-05-27 09:29:43 +02:00
|
|
|
}
|