1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <dirent.h>
17 #include <fcntl.h>
18 #include <sched.h>
19 #include <signal.h>
20 #include <stdio.h>
21 #include <stdlib.h>
22 #include <unistd.h>
23
24 #include "appspawn_hook.h"
25 #include "appspawn_manager.h"
26 #include "appspawn_utils.h"
27 #include "securec.h"
28 #ifdef WITH_SELINUX
29 #include "selinux/selinux.h"
30 #endif
31
32 #define PID_NS_INIT_UID 100000 // reserved for pid_ns_init process, avoid app, render proc, etc.
33 #define PID_NS_INIT_GID 100000
34
35 typedef struct {
36 AppSpawnExtData extData;
37 int nsSelfPidFd; // ns pid fd of appspawn
38 int nsInitPidFd; // ns pid fd of pid_ns_init
39 } AppSpawnNamespace;
40
41 static pid_t GetPidByName(const char *name);
AppSpawnExtDataCompareDataId(ListNode * node,void * data)42 static int AppSpawnExtDataCompareDataId(ListNode *node, void *data)
43 {
44 AppSpawnExtData *extData = (AppSpawnExtData *)ListEntry(node, AppSpawnExtData, node);
45 return extData->dataId - *(uint32_t *)data;
46 }
47
GetAppSpawnNamespace(const AppSpawnMgr * content)48 static AppSpawnNamespace *GetAppSpawnNamespace(const AppSpawnMgr *content)
49 {
50 APPSPAWN_CHECK_ONLY_EXPER(content != NULL, return NULL);
51 uint32_t dataId = EXT_DATA_NAMESPACE;
52 ListNode *node = OH_ListFind(&content->extData, (void *)&dataId, AppSpawnExtDataCompareDataId);
53 if (node == NULL) {
54 return NULL;
55 }
56 return (AppSpawnNamespace *)ListEntry(node, AppSpawnNamespace, extData);
57 }
58
DeleteAppSpawnNamespace(AppSpawnNamespace * namespace)59 static void DeleteAppSpawnNamespace(AppSpawnNamespace *namespace)
60 {
61 APPSPAWN_CHECK_ONLY_EXPER(namespace != NULL, return);
62 APPSPAWN_LOGV("DeleteAppSpawnNamespace");
63 OH_ListRemove(&namespace->extData.node);
64 OH_ListInit(&namespace->extData.node);
65
66 if (namespace->nsInitPidFd > 0) {
67 close(namespace->nsInitPidFd);
68 namespace->nsInitPidFd = -1;
69 }
70 if (namespace->nsSelfPidFd > 0) {
71 close(namespace->nsSelfPidFd);
72 namespace->nsSelfPidFd = -1;
73 }
74 free(namespace);
75 }
76
FreeAppSpawnNamespace(struct TagAppSpawnExtData * data)77 static void FreeAppSpawnNamespace(struct TagAppSpawnExtData *data)
78 {
79 AppSpawnNamespace *namespace = ListEntry(data, AppSpawnNamespace, extData);
80 APPSPAWN_CHECK_ONLY_EXPER(namespace != NULL, return);
81 DeleteAppSpawnNamespace(namespace);
82 }
83
CreateAppSpawnNamespace(void)84 static AppSpawnNamespace *CreateAppSpawnNamespace(void)
85 {
86 APPSPAWN_LOGV("CreateAppSpawnNamespace");
87 AppSpawnNamespace *namespace = (AppSpawnNamespace *)calloc(1, sizeof(AppSpawnNamespace));
88 APPSPAWN_CHECK(namespace != NULL, return NULL, "Failed to create sandbox");
89 namespace->nsInitPidFd = -1;
90 namespace->nsSelfPidFd = -1;
91 // ext data init
92 OH_ListInit(&namespace->extData.node);
93 namespace->extData.dataId = EXT_DATA_NAMESPACE;
94 namespace->extData.freeNode = FreeAppSpawnNamespace;
95 namespace->extData.dumpNode = NULL;
96 return namespace;
97 }
98
GetPidByName(const char * name)99 static pid_t GetPidByName(const char *name)
100 {
101 int pid = -1; // initial pid set to -1
102 DIR *dir = opendir("/proc");
103 if (dir == NULL) {
104 return -1;
105 }
106
107 struct dirent *entry;
108 while ((entry = readdir(dir)) != NULL) {
109 if (entry->d_type != DT_DIR) {
110 continue;
111 }
112 long pidNum = strtol(entry->d_name, NULL, 10); // pid will not exceed a 10-digit decimal number
113 if (pidNum <= 0) {
114 continue;
115 }
116
117 char path[32]; // path that contains the process name
118 if (snprintf_s(path, sizeof(path), sizeof(path) - 1, "/proc/%s/comm", entry->d_name) < 0) {
119 continue;
120 }
121 FILE *file = fopen(path, "r");
122 if (file == NULL) {
123 continue;
124 }
125 char buffer[32]; // read the process name
126 if (fgets(buffer, sizeof(buffer), file) == NULL) {
127 (void)fclose(file);
128 continue;
129 }
130 buffer[strcspn(buffer, "\n")] = 0;
131 if (strcmp(buffer, name) != 0) {
132 (void)fclose(file);
133 continue;
134 }
135
136 APPSPAWN_LOGI("get pid of %{public}s success", name);
137 pid = (int)pidNum;
138 (void)fclose(file);
139 break;
140 }
141
142 closedir(dir);
143 return pid;
144 }
145
NsInitFunc()146 static int NsInitFunc()
147 {
148 setuid(PID_NS_INIT_UID);
149 setgid(PID_NS_INIT_GID);
150 #ifdef WITH_SELINUX
151 setcon("u:r:pid_ns_init:s0");
152 #endif
153 char *argv[] = {"/system/bin/pid_ns_init", NULL};
154 execve("/system/bin/pid_ns_init", argv, NULL);
155 _exit(0);
156 return 0;
157 }
158
GetNsPidFd(pid_t pid)159 static int GetNsPidFd(pid_t pid)
160 {
161 char nsPath[256]; // filepath of ns pid
162 int ret = snprintf_s(nsPath, sizeof(nsPath), sizeof(nsPath) - 1, "/proc/%d/ns/pid", pid);
163 if (ret < 0) {
164 APPSPAWN_LOGE("SetPidNamespace failed, snprintf_s error:%{public}s", strerror(errno));
165 return -1;
166 }
167 int nsFd = open(nsPath, O_RDONLY);
168 if (nsFd < 0) {
169 APPSPAWN_LOGE("open ns pid:%{public}d failed, err:%{public}s", pid, strerror(errno));
170 return -1;
171 }
172 return nsFd;
173 }
174
PreLoadEnablePidNs(AppSpawnMgr * content)175 APPSPAWN_STATIC int PreLoadEnablePidNs(AppSpawnMgr *content)
176 {
177 APPSPAWN_LOGI("Enable pid namespace flags: 0x%{public}x", content->content.sandboxNsFlags);
178 if (IsColdRunMode(content)) {
179 return 0;
180 }
181 if (IsNWebSpawnMode(content)) { // only for appspawn
182 return 0;
183 }
184 if (!(content->content.sandboxNsFlags & CLONE_NEWPID)) {
185 return 0;
186 }
187 AppSpawnNamespace *namespace = CreateAppSpawnNamespace();
188 APPSPAWN_CHECK(namespace != NULL, return -1, "Failed to create namespace");
189
190 int ret = -1;
191 // check if process pid_ns_init exists, this is the init process for pid namespace
192 pid_t pid = GetPidByName("pid_ns_init");
193 if (pid == -1) {
194 APPSPAWN_LOGI("Start Create pid_ns_init %{public}d", pid);
195 pid = clone(NsInitFunc, NULL, CLONE_NEWPID, NULL);
196 if (pid < 0) {
197 APPSPAWN_LOGE("clone pid ns init failed");
198 DeleteAppSpawnNamespace(namespace);
199 return ret;
200 }
201 } else {
202 APPSPAWN_LOGI("pid_ns_init exists, no need to create");
203 }
204
205 namespace->nsSelfPidFd = GetNsPidFd(getpid());
206 if (namespace->nsSelfPidFd < 0) {
207 APPSPAWN_LOGE("open ns pid of appspawn fail");
208 DeleteAppSpawnNamespace(namespace);
209 return ret;
210 }
211
212 namespace->nsInitPidFd = GetNsPidFd(pid);
213 if (namespace->nsInitPidFd < 0) {
214 APPSPAWN_LOGE("open ns pid of pid_ns_init fail");
215 DeleteAppSpawnNamespace(namespace);
216 return ret;
217 }
218 OH_ListAddTail(&content->extData, &namespace->extData.node);
219 APPSPAWN_LOGI("Enable pid namespace success.");
220 return 0;
221 }
222
223 // after calling setns, new process will be in the same pid namespace of the input pid
SetPidNamespace(int nsPidFd,int nsType)224 static int SetPidNamespace(int nsPidFd, int nsType)
225 {
226 APPSPAWN_LOGI("SetPidNamespace 0x%{public}x", nsType);
227 #ifndef APPSPAWN_TEST
228 if (setns(nsPidFd, nsType) < 0) {
229 APPSPAWN_LOGE("set pid namespace nsType:%{public}d failed", nsType);
230 return -1;
231 }
232 #endif
233 return 0;
234 }
235
PreForkSetPidNamespace(AppSpawnMgr * content,AppSpawningCtx * property)236 static int PreForkSetPidNamespace(AppSpawnMgr *content, AppSpawningCtx *property)
237 {
238 AppSpawnNamespace *namespace = GetAppSpawnNamespace(content);
239 if (namespace == NULL) {
240 return 0;
241 }
242 if (content->content.sandboxNsFlags & CLONE_NEWPID) {
243 SetPidNamespace(namespace->nsInitPidFd, CLONE_NEWPID); // pid_ns_init is the init process
244 }
245 return 0;
246 }
247
PostForkSetPidNamespace(AppSpawnMgr * content,AppSpawningCtx * property)248 static int PostForkSetPidNamespace(AppSpawnMgr *content, AppSpawningCtx *property)
249 {
250 AppSpawnNamespace *namespace = GetAppSpawnNamespace(content);
251 if (namespace == NULL) {
252 return 0;
253 }
254 if (content->content.sandboxNsFlags & CLONE_NEWPID) {
255 SetPidNamespace(namespace->nsSelfPidFd, 0); // go back to original pid namespace
256 }
257
258 return 0;
259 }
260
MODULE_CONSTRUCTOR(void)261 MODULE_CONSTRUCTOR(void)
262 {
263 AddPreloadHook(HOOK_PRIO_LOWEST, PreLoadEnablePidNs);
264 AddAppSpawnHook(STAGE_PARENT_PRE_FORK, HOOK_PRIO_LOWEST, PreForkSetPidNamespace);
265 AddAppSpawnHook(STAGE_PARENT_POST_FORK, HOOK_PRIO_HIGHEST, PostForkSetPidNamespace);
266 }
267