Magisk/native/jni/init/rootdir.cpp

365 lines
9.5 KiB
C++
Raw Normal View History

2019-05-27 09:29:43 +02:00
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
2019-07-16 10:08:28 +02:00
#include <vector>
2020-04-19 11:35:28 +02:00
#include <libgen.h>
2019-05-27 09:29:43 +02:00
2020-03-09 09:50:30 +01:00
#include <magisk.hpp>
#include <magiskpolicy.hpp>
#include <utils.hpp>
2020-04-12 14:34:56 +02:00
#include <socket.hpp>
2019-05-27 09:29:43 +02:00
2020-03-09 09:50:30 +01:00
#include "init.hpp"
#include "magiskrc.inc"
2019-05-27 09:29:43 +02:00
#ifdef USE_64BIT
#define LIBNAME "lib64"
#else
#define LIBNAME "lib"
#endif
using namespace std;
2020-04-26 08:19:36 +02:00
static vector<string> rc_list;
2019-07-16 10:08:28 +02:00
2020-04-19 11:35:28 +02:00
static void patch_init_rc(const char *src, const char *dest, const char *tmp_dir) {
FILE *rc = xfopen(dest, "we");
file_readline(src, [=](string_view line) -> bool {
2019-06-26 08:31:59 +02:00
// Do not start vaultkeeper
if (str_contains(line, "start vaultkeeper")) {
LOGD("Remove vaultkeeper\n");
return true;
}
// Do not run flash_recovery
if (str_starts(line, "service flash_recovery")) {
LOGD("Remove flash_recovery\n");
fprintf(rc, "service flash_recovery /system/bin/xxxxx\n");
return true;
}
// Else just write the line
fprintf(rc, "%s", line.data());
return true;
});
2019-07-16 10:08:28 +02:00
fprintf(rc, "\n");
// Inject custom rc scripts
2020-04-26 08:19:36 +02:00
for (auto &script : rc_list) {
// Replace template arguments of rc scripts with dynamic paths
replace_all(script, "${MAGISKTMP}", tmp_dir);
fprintf(rc, "\n%s\n", script.data());
}
2019-07-16 10:08:28 +02:00
rc_list.clear();
// Inject Magisk rc scripts
char pfd_svc[16], ls_svc[16], bc_svc[16];
gen_rand_str(pfd_svc, sizeof(pfd_svc));
gen_rand_str(ls_svc, sizeof(ls_svc));
gen_rand_str(bc_svc, sizeof(bc_svc));
2019-06-26 08:31:59 +02:00
LOGD("Inject magisk services: [%s] [%s] [%s]\n", pfd_svc, ls_svc, bc_svc);
2020-04-26 08:19:36 +02:00
fprintf(rc, MAGISK_RC, tmp_dir, pfd_svc, ls_svc, bc_svc);
2020-04-19 11:35:28 +02:00
fclose(rc);
clone_attr(src, dest);
2019-06-26 08:31:59 +02:00
}
2019-05-27 09:29:43 +02:00
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 13:39:28 +02:00
static void load_overlay_rc(const char *overlay) {
auto dir = open_dir(overlay);
if (!dir) return;
int dfd = dirfd(dir.get());
2019-07-16 10:08:28 +02:00
// Do not allow overwrite init.rc
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 13:39:28 +02:00
unlinkat(dfd, "init.rc", 0);
2020-04-26 08:19:36 +02:00
for (dirent *entry; (entry = xreaddir(dir.get()));) {
2019-07-16 10:08:28 +02:00
if (strend(entry->d_name, ".rc") == 0) {
LOGD("Found rc script [%s]\n", entry->d_name);
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 13:39:28 +02:00
int rc = xopenat(dfd, entry->d_name, O_RDONLY | O_CLOEXEC);
2020-04-26 08:19:36 +02:00
rc_list.push_back(fd_full_read(rc));
2019-07-16 10:08:28 +02:00
close(rc);
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 13:39:28 +02:00
unlinkat(dfd, entry->d_name, 0);
2019-07-16 10:08:28 +02:00
}
}
}
2020-05-04 07:49:54 +02:00
int raw_data_patch(void *addr, size_t sz, str_pairs list) {
int count = 0;
for (uint8_t *p = (uint8_t *)addr, *eof = (uint8_t *)addr + sz; p < eof; ++p) {
for (auto &[from, to] : list) {
if (memcmp(p, from.data(), from.length() + 1) == 0) {
LOGD("Replace [%s] -> [%s]\n", from.data(), to.data());
memset(p, 0, from.length());
memcpy(p, to.data(), to.length());
++count;
p += from.length();
}
}
}
return count;
}
2019-12-12 09:25:48 +01:00
void RootFSInit::setup_rootfs() {
2020-04-19 13:56:56 +02:00
if (patch_sepolicy("/sepolicy")) {
2019-05-27 09:29:43 +02:00
char *addr;
size_t size;
mmap_rw("/init", addr, size);
2020-05-04 07:49:54 +02:00
raw_data_patch(addr, size, {make_pair(SPLIT_PLAT_CIL, "xxx")});
2019-05-27 09:29:43 +02:00
munmap(addr, size);
}
2019-07-16 10:08:28 +02:00
// Handle overlays
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 13:39:28 +02:00
if (access("/overlay.d", F_OK) == 0) {
2019-07-16 10:08:28 +02:00
LOGD("Merge overlay.d\n");
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 13:39:28 +02:00
load_overlay_rc("/overlay.d");
2020-04-02 11:17:45 +02:00
mv_path("/overlay.d", "/");
2019-07-16 10:08:28 +02:00
}
2020-04-19 11:35:28 +02:00
patch_init_rc("/init.rc", "/init.p.rc", "/sbin");
2019-05-27 09:29:43 +02:00
rename("/init.p.rc", "/init.rc");
// Create hardlink mirror of /sbin to /root
mkdir("/root", 0750);
clone_attr("/sbin", "/root");
2020-04-02 11:17:45 +02:00
link_path("/sbin", "/root");
2019-05-27 09:29:43 +02:00
2019-06-22 12:14:33 +02:00
// Dump magiskinit as magisk
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 13:39:28 +02:00
int fd = xopen("/sbin/magisk", O_WRONLY | O_CREAT, 0755);
2019-05-27 09:29:43 +02:00
write(fd, self.buf, self.sz);
close(fd);
}
2019-06-26 06:34:02 +02:00
bool MagiskInit::patch_sepolicy(const char *file) {
bool patch_init = false;
2019-05-27 09:29:43 +02:00
if (access(SPLIT_PLAT_CIL, R_OK) == 0) {
LOGD("sepol: split policy\n");
patch_init = true;
2019-05-27 09:29:43 +02:00
} else if (access("/sepolicy", R_OK) == 0) {
LOGD("sepol: monolithic policy\n");
load_policydb("/sepolicy");
} else {
LOGD("sepol: no selinux\n");
return false;
}
if (access(SELINUX_VERSION, F_OK) != 0) {
// Mount selinuxfs to communicate with kernel
xmount("selinuxfs", SELINUX_MNT, "selinuxfs", 0, nullptr);
mount_list.emplace_back(SELINUX_MNT);
}
if (patch_init)
load_split_cil();
2019-05-27 09:29:43 +02:00
sepol_magisk_rules();
sepol_allow(SEPOL_PROC_DOMAIN, ALL, ALL, ALL);
// Custom rules
2020-04-23 08:01:11 +02:00
if (auto dir = open_dir(persist_dir.data()); dir) {
for (dirent *entry; (entry = xreaddir(dir.get()));) {
2020-04-12 14:34:56 +02:00
auto rule = persist_dir + "/" + entry->d_name + "/sepolicy.rule";
if (access(rule.data(), R_OK) == 0) {
LOGD("Loading custom sepolicy patch: %s\n", rule.data());
load_rule_file(rule.data());
}
}
}
2019-06-26 06:34:02 +02:00
dump_policydb(file);
destroy_policydb();
2019-05-27 09:29:43 +02:00
// Remove OnePlus stupid debug sepolicy and use our own
if (access("/sepolicy_debug", F_OK) == 0) {
unlink("/sepolicy_debug");
link("/sepolicy", "/sepolicy_debug");
}
return patch_init;
2019-05-27 09:29:43 +02:00
}
2019-06-22 12:14:33 +02:00
2020-01-09 16:42:27 +01:00
static void recreate_sbin(const char *mirror, bool use_bind_mount) {
auto dp = xopen_dir(mirror);
int src = dirfd(dp.get());
char buf[4096];
for (dirent *entry; (entry = xreaddir(dp.get()));) {
string sbin_path = "/sbin/"s + entry->d_name;
2019-12-06 21:31:49 +01:00
struct stat st;
fstatat(src, entry->d_name, &st, AT_SYMLINK_NOFOLLOW);
if (S_ISLNK(st.st_mode)) {
xreadlinkat(src, entry->d_name, buf, sizeof(buf));
2020-01-09 16:42:27 +01:00
xsymlink(buf, sbin_path.data());
2019-12-06 21:31:49 +01:00
} else {
sprintf(buf, "%s/%s", mirror, entry->d_name);
if (use_bind_mount) {
2020-01-09 16:42:27 +01:00
auto mode = st.st_mode & 0777;
2019-12-06 21:31:49 +01:00
// Create dummy
if (S_ISDIR(st.st_mode))
2020-01-09 16:42:27 +01:00
xmkdir(sbin_path.data(), mode);
2019-12-06 21:31:49 +01:00
else
2020-01-09 16:42:27 +01:00
close(xopen(sbin_path.data(), O_CREAT | O_WRONLY | O_CLOEXEC, mode));
2019-12-06 21:31:49 +01:00
2020-01-09 16:42:27 +01:00
xmount(buf, sbin_path.data(), nullptr, MS_BIND, nullptr);
} else {
xsymlink(buf, sbin_path.data());
}
2019-12-06 21:31:49 +01:00
}
}
}
static string magic_mount_list;
static void magic_mount(const string &sdir, const string &ddir = "") {
auto dir = xopen_dir(sdir.data());
2020-04-19 11:35:28 +02:00
for (dirent *entry; (entry = xreaddir(dir.get()));) {
string src = sdir + "/" + entry->d_name;
string dest = ddir + "/" + entry->d_name;
2019-07-16 10:08:28 +02:00
if (access(dest.data(), F_OK) == 0) {
if (entry->d_type == DT_DIR) {
// Recursive
magic_mount(src, dest);
2019-07-16 10:08:28 +02:00
} else {
LOGD("Mount [%s] -> [%s]\n", src.data(), dest.data());
xmount(src.data(), dest.data(), nullptr, MS_BIND, nullptr);
magic_mount_list += dest;
magic_mount_list += '\n';
2019-07-16 10:08:28 +02:00
}
}
}
}
2020-04-19 11:35:28 +02:00
#define ROOTMIR MIRRDIR "/system_root"
#define ROOTBLK BLOCKDIR "/system_root"
2020-04-12 14:34:56 +02:00
#define MONOPOLICY "/sepolicy"
#define LIBSELINUX "/system/" LIBNAME "/libselinux.so"
2020-04-19 11:35:28 +02:00
#define NEW_INITRC "/system/etc/init/hw/init.rc"
2020-04-12 14:34:56 +02:00
2019-09-22 11:20:51 +02:00
void SARBase::patch_rootdir() {
char tmp_dir[16];
const char *sepol;
2020-04-19 03:50:25 +02:00
char *p;
if (access("/sbin", F_OK) == 0) {
p = tmp_dir + sprintf(tmp_dir, "%s", "/sbin");
sepol = "/sbin/.se";
} else {
2020-04-19 11:35:28 +02:00
p = tmp_dir + sprintf(tmp_dir, "%s", "/dev/");
p += gen_rand_str(p, 8);
xmkdir(tmp_dir, 0);
sepol = "/dev/.se";
}
2020-04-12 14:34:56 +02:00
2020-04-19 03:50:25 +02:00
setup_tmp(tmp_dir, self, config);
2020-04-23 08:01:11 +02:00
persist_dir = MIRRDIR "/persist/magisk";
2020-04-12 14:34:56 +02:00
2020-04-19 03:50:25 +02:00
chdir(tmp_dir);
2019-06-24 10:21:33 +02:00
// Mount system_root mirror
2020-04-01 07:41:25 +02:00
struct stat st;
xstat("/", &st);
xmkdir(ROOTMIR, 0755);
2020-04-01 07:41:25 +02:00
mknod(ROOTBLK, S_IFBLK | 0600, st.st_dev);
2020-04-19 03:50:25 +02:00
strcpy(p, "/" ROOTBLK);
if (xmount(tmp_dir, ROOTMIR, "ext4", MS_RDONLY, nullptr))
xmount(tmp_dir, ROOTMIR, "erofs", MS_RDONLY, nullptr);
*p = '\0';
2019-06-24 10:21:33 +02:00
2020-04-12 14:34:56 +02:00
// Recreate original sbin structure if necessary
2020-04-19 03:50:25 +02:00
if (tmp_dir == "/sbin"sv)
2020-04-12 14:34:56 +02:00
recreate_sbin(ROOTMIR "/sbin", true);
2019-06-26 06:34:02 +02:00
2019-07-16 10:08:28 +02:00
// Patch init
raw_data init;
2019-12-06 21:31:49 +01:00
int src = xopen("/init", O_RDONLY | O_CLOEXEC);
2019-07-16 10:08:28 +02:00
fd_full_read(src, init.buf, init.sz);
2020-05-04 07:49:54 +02:00
int patch_count = raw_data_patch(init.buf, init.sz, {
make_pair(SPLIT_PLAT_CIL, "xxx"), /* Force loading monolithic sepolicy */
make_pair(MONOPOLICY, sepol) /* Redirect /sepolicy to custom path */
});
2019-07-16 10:08:28 +02:00
xmkdir(ROOTOVL, 0);
2020-05-04 07:49:54 +02:00
int dest = xopen(ROOTOVL "/init", O_CREAT | O_WRONLY | O_CLOEXEC, 0);
2019-07-16 10:08:28 +02:00
xwrite(dest, init.buf, init.sz);
2020-04-19 11:35:28 +02:00
fclone_attr(src, dest);
close(src);
2019-06-26 06:34:02 +02:00
close(dest);
2020-05-04 07:49:54 +02:00
if (patch_count != 2 && access(LIBSELINUX, F_OK) == 0) {
2019-06-26 06:34:02 +02:00
// init is dynamically linked, need to patch libselinux
raw_data lib;
2019-07-16 10:08:28 +02:00
full_read(LIBSELINUX, lib.buf, lib.sz);
2020-05-04 07:49:54 +02:00
raw_data_patch(lib.buf, lib.sz, {make_pair(MONOPOLICY, sepol)});
2020-04-19 11:35:28 +02:00
xmkdirs(dirname(ROOTOVL LIBSELINUX), 0755);
2020-05-04 07:49:54 +02:00
dest = xopen(ROOTOVL LIBSELINUX, O_CREAT | O_WRONLY | O_CLOEXEC, 0);
2019-07-16 10:08:28 +02:00
xwrite(dest, lib.buf, lib.sz);
2019-06-26 06:34:02 +02:00
close(dest);
2020-04-19 11:35:28 +02:00
clone_attr(LIBSELINUX, ROOTOVL LIBSELINUX);
2019-06-26 06:34:02 +02:00
}
2019-07-16 10:08:28 +02:00
// sepolicy
patch_sepolicy(sepol);
2019-06-26 08:31:59 +02:00
2020-04-26 08:19:36 +02:00
// Restore backup files
2020-04-12 14:34:56 +02:00
struct sockaddr_un sun;
int sockfd = xsocket(AF_LOCAL, SOCK_STREAM | SOCK_CLOEXEC, 0);
if (connect(sockfd, (struct sockaddr*) &sun, setup_sockaddr(&sun, INIT_SOCKET)) == 0) {
LOGD("ACK init daemon to write backup files\n");
// Let daemon know where tmp_dir is
2020-04-19 03:50:25 +02:00
write_string(sockfd, tmp_dir);
// Wait for daemon to finish restoring files
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 13:39:28 +02:00
int ack;
2020-04-12 14:34:56 +02:00
read(sockfd, &ack, sizeof(ack));
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 13:39:28 +02:00
} else {
LOGD("Restore backup files locally\n");
restore_folder(ROOTOVL, overlays);
overlays.clear();
}
2020-04-12 14:34:56 +02:00
close(sockfd);
2020-04-26 08:19:36 +02:00
// Handle overlay.d
load_overlay_rc(ROOTOVL);
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 13:39:28 +02:00
if (access(ROOTOVL "/sbin", F_OK) == 0) {
2020-04-26 08:19:36 +02:00
// Move files in overlay.d/sbin into Magisk's tmp_dir
mv_path(ROOTOVL "/sbin", tmp_dir);
2019-07-16 10:08:28 +02:00
}
// Patch init.rc
2020-04-19 11:35:28 +02:00
if (access("/init.rc", F_OK) == 0) {
patch_init_rc("/init.rc", ROOTOVL "/init.rc", tmp_dir);
} else {
// Android 11's new init.rc
xmkdirs(dirname(ROOTOVL NEW_INITRC), 0755);
patch_init_rc(NEW_INITRC, ROOTOVL NEW_INITRC, tmp_dir);
}
2019-07-16 10:08:28 +02:00
// Mount rootdir
magic_mount(ROOTOVL);
2020-04-12 14:34:56 +02:00
dest = xopen(ROOTMNT, O_WRONLY | O_CREAT | O_CLOEXEC, 0);
write(dest, magic_mount_list.data(), magic_mount_list.length());
close(dest);
2020-04-12 14:34:56 +02:00
chdir("/");
2019-06-24 10:21:33 +02:00
}
2019-06-22 12:14:33 +02:00
int magisk_proxy_main(int argc, char *argv[]) {
setup_klog();
raw_data config;
raw_data self;
2019-07-16 10:08:28 +02:00
full_read("/sbin/magisk", self.buf, self.sz);
full_read("/.backup/.magisk", config.buf, config.sz);
2019-06-22 12:14:33 +02:00
xmount(nullptr, "/", nullptr, MS_REMOUNT, nullptr);
unlink("/sbin/magisk");
rm_rf("/.backup");
2020-04-12 14:34:56 +02:00
setup_tmp("/sbin", self, config);
2019-06-22 12:14:33 +02:00
// Create symlinks pointing back to /root
2020-01-09 16:42:27 +01:00
recreate_sbin("/root", false);
2019-06-22 12:14:33 +02:00
setenv("REMOUNT_ROOT", "1", 1);
execv("/sbin/magisk", argv);
return 1;
}