Magisk/su_daemon.c

413 lines
9.4 KiB
C
Raw Normal View History

/* su_daemon.c - The entrypoint for su, connect to daemon and send correct info
2017-04-14 21:21:31 +02:00
*/
2017-07-07 19:12:47 +02:00
#define _GNU_SOURCE
2017-04-14 21:21:31 +02:00
#include <limits.h>
#include <unistd.h>
#include <pthread.h>
#include <stdlib.h>
#include <fcntl.h>
#include <string.h>
#include <signal.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include "magisk.h"
#include "daemon.h"
#include "utils.h"
#include "su.h"
#include "pts.h"
#include "list.h"
2017-04-14 21:21:31 +02:00
2017-04-15 20:28:12 +02:00
// Constants for the atty bitfield
#define ATTY_IN 1
#define ATTY_OUT 2
#define ATTY_ERR 4
2017-04-14 21:21:31 +02:00
#define TIMEOUT 3
2017-07-16 09:31:40 +02:00
#define LOCK_LIST() pthread_mutex_lock(&list_lock)
#define LOCK_UID() pthread_mutex_lock(&info->lock)
#define UNLOCK_LIST() pthread_mutex_unlock(&list_lock)
#define UNLOCK_UID() pthread_mutex_unlock(&info->lock)
static struct list_head active_list, waiting_list;
static pthread_t su_collector = 0;
static pthread_mutex_t list_lock = PTHREAD_MUTEX_INITIALIZER;
int pipefd[2];
2017-04-14 21:21:31 +02:00
static void sighandler(int sig) {
restore_stdin();
// Assume we'll only be called before death
// See note before sigaction() in set_stdin_raw()
//
// Now, close all standard I/O to cause the pumps
// to exit so we can continue and retrieve the exit
// code
close(STDIN_FILENO);
close(STDOUT_FILENO);
close(STDERR_FILENO);
// Put back all the default handlers
struct sigaction act;
memset(&act, 0, sizeof(act));
act.sa_handler = SIG_DFL;
for (int i = 0; quit_signals[i]; ++i) {
sigaction(quit_signals[i], &act, NULL);
}
}
// Maintain the lists periodically
static void *collector(void *args) {
LOGD("su: collector started\n");
2017-05-31 21:19:45 +02:00
struct su_info *node;
while(1) {
sleep(1);
2017-07-16 09:31:40 +02:00
LOCK_LIST();
2017-07-02 11:46:30 +02:00
list_for_each(node, &active_list, struct su_info, pos) {
if (--node->clock == 0) {
// Timeout, move to waiting list
__ = list_pop(&node->pos);
list_insert_end(&waiting_list, &node->pos);
}
}
2017-07-02 11:46:30 +02:00
list_for_each(node, &waiting_list, struct su_info, pos) {
2017-07-16 09:31:40 +02:00
if (node->ref == 0) {
2017-07-02 11:46:30 +02:00
// Nothing is using the info, remove it
__ = list_pop(&node->pos);
pthread_mutex_destroy(&node->lock);
free(node);
}
}
2017-07-16 09:31:40 +02:00
UNLOCK_LIST();
}
2017-05-07 21:08:34 +02:00
}
2017-04-15 20:28:12 +02:00
void su_daemon_receiver(int client, struct ucred *credential) {
LOGD("su: request from client: %d\n", client);
2017-05-31 21:19:45 +02:00
struct su_info *info = NULL, *node;
int new_request = 0;
2017-07-16 09:31:40 +02:00
LOCK_LIST();
if (!su_collector) {
init_list_head(&active_list);
init_list_head(&waiting_list);
xpthread_create(&su_collector, NULL, collector, NULL);
}
// Search for existing in the active list
2017-07-02 11:46:30 +02:00
list_for_each(node, &active_list, struct su_info, pos) {
if (node->uid == credential->uid) {
info = node;
2017-07-16 09:31:40 +02:00
break;
}
}
// If no exist, create a new request
if (info == NULL) {
new_request = 1;
info = malloc(sizeof(*info));
info->uid = credential->uid;
info->policy = QUERY;
2017-07-16 09:31:40 +02:00
info->ref = 0;
info->count = 0;
pthread_mutex_init(&info->lock, NULL);
list_insert_end(&active_list, &info->pos);
}
info->clock = TIMEOUT; /* Reset timer */
2017-07-16 09:31:40 +02:00
++info->ref; /* Increment reference count */
2017-07-16 09:31:40 +02:00
UNLOCK_LIST();
2017-07-16 09:31:40 +02:00
LOGD("su: request from uid=[%d] (#%d)\n", info->uid, ++info->count);
// Default values
struct su_context ctx = {
.info = info,
.to = {
.uid = UID_ROOT,
.login = 0,
.keepenv = 0,
.shell = DEFAULT_SHELL,
.command = NULL,
},
.pid = credential->pid,
.notify = new_request,
};
2017-07-16 09:31:40 +02:00
// Lock before the policy is determined
LOCK_UID();
// Not cached, do the checks
if (info->policy == QUERY) {
2017-05-31 21:19:45 +02:00
// Get data from database
2017-10-28 10:03:39 +02:00
database_check(&ctx);
2017-08-11 19:09:02 +02:00
2017-10-28 10:03:39 +02:00
// Check requester
if (info->policy == QUERY) {
if (info->st.st_gid != info->st.st_uid) {
LOGE("Bad uid/gid %d/%d for Superuser Requestor", info->st.st_gid, info->st.st_uid);
2017-10-28 10:03:39 +02:00
info->policy = DENY;
ctx.notify = 0;
} else if ((info->uid % 100000) == (info->st.st_uid % 100000)) {
2017-10-28 10:03:39 +02:00
info->policy = ALLOW;
info->root_access = ROOT_ACCESS_APPS_AND_ADB;
ctx.notify = 0;
}
}
// always allow if it's root
if (info->uid == UID_ROOT) {
info->policy = ALLOW;
2017-05-31 21:19:45 +02:00
info->root_access = ROOT_ACCESS_APPS_AND_ADB;
2017-10-28 10:03:39 +02:00
ctx.notify = 0;
}
// If still not determined, open a pipe and wait for results
if (info->policy == QUERY)
2017-10-28 10:03:39 +02:00
xpipe2(ctx.pipefd, O_CLOEXEC);
}
2017-04-15 20:28:12 +02:00
2017-04-14 21:21:31 +02:00
// Fork a new process, the child process will need to setsid,
2017-05-07 21:08:34 +02:00
// open a pseudo-terminal if needed, and will eventually run exec
2017-04-15 20:28:12 +02:00
// The parent process will wait for the result and
2017-04-14 21:21:31 +02:00
// send the return code back to our client
int child = fork();
if (child < 0)
2017-04-15 20:28:12 +02:00
PLOGE("fork");
2017-04-14 21:21:31 +02:00
if (child) {
// Wait for results
if (info->policy == QUERY) {
2017-10-28 10:03:39 +02:00
xxread(ctx.pipefd[0], &info->policy, sizeof(info->policy));
close(ctx.pipefd[0]);
close(ctx.pipefd[1]);
}
// The policy is determined, unlock
2017-07-16 09:31:40 +02:00
UNLOCK_UID();
2017-04-15 20:28:12 +02:00
// Wait result
2017-07-16 09:31:40 +02:00
LOGD("su: waiting child: [%d]\n", child);
2017-04-15 20:28:12 +02:00
int status, code;
2017-04-14 21:21:31 +02:00
2017-04-15 20:28:12 +02:00
if (waitpid(child, &status, 0) > 0)
code = WEXITSTATUS(status);
else
code = -1;
2017-07-16 09:31:40 +02:00
/* Passing the return code back to the client:
* The client might be closed unexpectedly (e.g. swipe a root app out of recents)
* In that case, writing to the client (which doesn't exist) will result in SIGPIPE
* Here we simply just ignore the situation.
*/
struct sigaction act;
memset(&act, 0, sizeof(act));
act.sa_handler = SIG_IGN;
sigaction(SIGPIPE, &act, NULL);
LOGD("su: return code: [%d]\n", code);
write(client, &code, sizeof(code));
2017-04-15 20:28:12 +02:00
close(client);
2017-07-16 09:31:40 +02:00
// Restore default handler for SIGPIPE
act.sa_handler = SIG_DFL;
sigaction(SIGPIPE, &act, NULL);
// Decrement reference count
2017-07-16 09:31:40 +02:00
LOCK_LIST();
--info->ref;
UNLOCK_LIST();
2017-05-07 21:08:34 +02:00
return;
2017-04-14 21:21:31 +02:00
}
LOGD("su: child process started\n");
2017-07-16 09:31:40 +02:00
UNLOCK_UID();
2017-04-14 21:21:31 +02:00
// ack
write_int(client, 1);
// Become session leader
xsetsid();
// Migrate environment from client
char path[32], buf[4096];
snprintf(path, sizeof(path), "/proc/%d/cwd", ctx.pid);
xreadlink(path, ctx.cwd, sizeof(ctx.cwd));
snprintf(path, sizeof(path), "/proc/%d/environ", ctx.pid);
memset(buf, 0, sizeof(buf));
int fd = open(path, O_RDONLY);
read(fd, buf, sizeof(buf));
clearenv();
for (size_t pos = 0; buf[pos];) {
putenv(buf + pos);
pos += strlen(buf + pos) + 1;
}
2017-04-14 21:21:31 +02:00
// Let's read some info from the socket
int argc = read_int(client);
if (argc < 0 || argc > 512) {
LOGE("unable to allocate args: %d", argc);
exit2(1);
2017-04-14 21:21:31 +02:00
}
LOGD("su: argc=[%d]\n", argc);
char **argv = (char**) xmalloc(sizeof(char*) * (argc + 1));
argv[argc] = NULL;
for (int i = 0; i < argc; i++) {
argv[i] = read_string(client);
LOGD("su: argv[%d]=[%s]\n", i, argv[i]);
2017-07-07 19:12:47 +02:00
// Replace -cn with -z, -mm with -M for supporting getopt_long
if (strcmp(argv[i], "-cn") == 0)
strcpy(argv[i], "-z");
else if (strcmp(argv[i], "-mm") == 0)
strcpy(argv[i], "-M");
2017-04-14 21:21:31 +02:00
}
// Get pts_slave
char *pts_slave = read_string(client);
LOGD("su: pts_slave=[%s]\n", pts_slave);
2017-04-15 20:28:12 +02:00
// The the FDs for each of the streams
int infd = recv_fd(client);
int outfd = recv_fd(client);
int errfd = recv_fd(client);
2017-05-07 21:08:34 +02:00
int ptsfd = -1;
2017-04-15 20:28:12 +02:00
2017-04-14 21:21:31 +02:00
// We no longer need the access to socket in the child, close it
close(client);
2017-04-15 20:28:12 +02:00
if (pts_slave[0]) {
//Check pts_slave file is owned by daemon_from_uid
struct stat stbuf;
xstat(pts_slave, &stbuf);
//If caller is not root, ensure the owner of pts_slave is the caller
2017-10-28 10:03:39 +02:00
if(stbuf.st_uid != info->uid && info->uid != 0) {
2017-04-15 20:28:12 +02:00
LOGE("su: Wrong permission of pts_slave");
exit2(1);
2017-04-15 20:28:12 +02:00
}
// Opening the TTY has to occur after the
// fork() and setsid() so that it becomes
// our controlling TTY and not the daemon's
2017-05-07 21:08:34 +02:00
ptsfd = xopen(pts_slave, O_RDWR);
2017-04-15 20:28:12 +02:00
if (infd < 0) {
LOGD("su: stdin using PTY");
infd = ptsfd;
}
if (outfd < 0) {
LOGD("su: stdout using PTY");
outfd = ptsfd;
}
if (errfd < 0) {
LOGD("su: stderr using PTY");
errfd = ptsfd;
}
2017-04-14 21:21:31 +02:00
}
free(pts_slave);
// Swap out stdin, stdout, stderr
2017-04-15 20:28:12 +02:00
xdup2(infd, STDIN_FILENO);
xdup2(outfd, STDOUT_FILENO);
xdup2(errfd, STDERR_FILENO);
2017-04-14 21:21:31 +02:00
2017-05-07 21:08:34 +02:00
close(ptsfd);
2017-10-28 10:03:39 +02:00
// Give main the reference
su_ctx = &ctx;
2017-04-14 21:21:31 +02:00
su_daemon_main(argc, argv);
}
2017-08-06 18:31:27 +02:00
/*
2017-04-14 21:21:31 +02:00
* Connect daemon, send argc, argv, cwd, pts slave
*/
int su_client_main(int argc, char *argv[]) {
char buffer[PATH_MAX];
int ptmx, socketfd;
// Connect to client
socketfd = connect_daemon();
// Tell the daemon we are su
write_int(socketfd, SUPERUSER);
// Number of command line arguments
write_int(socketfd, argc);
// Command line arguments
for (int i = 0; i < argc; i++) {
write_string(socketfd, argv[i]);
}
2017-04-15 20:28:12 +02:00
// Determine which one of our streams are attached to a TTY
int atty = 0;
if (isatty(STDIN_FILENO)) atty |= ATTY_IN;
if (isatty(STDOUT_FILENO)) atty |= ATTY_OUT;
if (isatty(STDERR_FILENO)) atty |= ATTY_ERR;
if (atty) {
// We need a PTY. Get one.
ptmx = pts_open(buffer, sizeof(buffer));
} else {
buffer[0] = '\0';
}
2017-04-14 21:21:31 +02:00
2017-04-15 20:28:12 +02:00
// Send the pts_slave path to the daemon
2017-04-14 21:21:31 +02:00
write_string(socketfd, buffer);
2017-04-15 20:28:12 +02:00
// Send stdin
if (atty & ATTY_IN) {
// Using PTY
send_fd(socketfd, -1);
} else {
send_fd(socketfd, STDIN_FILENO);
}
// Send stdout
if (atty & ATTY_OUT) {
// Forward SIGWINCH
watch_sigwinch_async(STDOUT_FILENO, ptmx);
// Using PTY
send_fd(socketfd, -1);
} else {
send_fd(socketfd, STDOUT_FILENO);
}
// Send stderr
if (atty & ATTY_ERR) {
// Using PTY
send_fd(socketfd, -1);
} else {
send_fd(socketfd, STDERR_FILENO);
}
2017-04-14 21:21:31 +02:00
// Wait for acknowledgement from daemon
read_int(socketfd);
2017-04-15 20:28:12 +02:00
if (atty & ATTY_IN) {
setup_sighandlers(sighandler);
pump_stdin_async(ptmx);
}
if (atty & ATTY_OUT) {
pump_stdout_blocking(ptmx);
}
2017-04-14 21:21:31 +02:00
// Get the exit code
int code = read_int(socketfd);
close(socketfd);
return code;
}