1 /* 2 * Copyright (C) 2016 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef FRAMEWORKS_BASE_CORE_JNI_FD_UTILS_H_ 18 #define FRAMEWORKS_BASE_CORE_JNI_FD_UTILS_H_ 19 20 #include <set> 21 #include <string> 22 #include <unordered_map> 23 #include <vector> 24 25 #include <dirent.h> 26 #include <inttypes.h> 27 #include <sys/stat.h> 28 29 #include <android-base/macros.h> 30 31 class FileDescriptorInfo; 32 33 // This type is duplicated in com_android_internal_os_Zygote.cpp 34 typedef const std::function<void(std::string)>& fail_fn_t; 35 36 // Allowlist of open paths that the zygote is allowed to keep open. 37 // 38 // In addition to the paths listed in kPathAllowlist in file_utils.cpp, and 39 // paths dynamically added with Allow(), all files ending with ".jar" 40 // under /system/framework" are allowlisted. See IsAllowed() for the canonical 41 // definition. 42 // 43 // If the allowlisted path is associated with a regular file or a 44 // character device, the file is reopened after a fork with the same 45 // offset and mode. If the allowlisted path is associated with a 46 // AF_UNIX socket, the socket will refer to /dev/null after each 47 // fork, and all operations on it will fail. 48 class FileDescriptorAllowlist { 49 public: 50 // Lazily creates the global allowlist. 51 static FileDescriptorAllowlist* Get(); 52 53 // Adds a path to the allowlist. Allow(const std::string & path)54 void Allow(const std::string& path) { allowlist_.push_back(path); } 55 56 // Returns true iff. a given path is allowlisted. A path is allowlisted 57 // if it belongs to the allowlist (see kPathAllowlist) or if it's a path 58 // under /system/framework that ends with ".jar" or if it is a system 59 // framework overlay. 60 bool IsAllowed(const std::string& path) const; 61 62 private: 63 FileDescriptorAllowlist(); 64 65 static FileDescriptorAllowlist* instance_; 66 67 std::vector<std::string> allowlist_; 68 69 DISALLOW_COPY_AND_ASSIGN(FileDescriptorAllowlist); 70 }; 71 72 // Returns the set of file descriptors currently open by the process. 73 std::unique_ptr<std::set<int>> GetOpenFds(fail_fn_t fail_fn); 74 75 // A FileDescriptorTable is a collection of FileDescriptorInfo objects 76 // keyed by their FDs. 77 class FileDescriptorTable { 78 public: 79 // Creates a new FileDescriptorTable. This function scans 80 // /proc/self/fd for the list of open file descriptors and collects 81 // information about them. Returns NULL if an error occurs. 82 static FileDescriptorTable* Create(const std::vector<int>& fds_to_ignore, 83 fail_fn_t fail_fn); 84 85 ~FileDescriptorTable(); 86 87 // Checks that the currently open FDs did not change their metadata from 88 // stat(2), readlink(2) etc. Ignores FDs from |fds_to_ignore|. 89 // 90 // Temporary: allows newly open FDs if they pass the same checks as in 91 // Create(). This will be further restricted. See TODOs in the 92 // implementation. 93 void Restat(const std::vector<int>& fds_to_ignore, fail_fn_t fail_fn); 94 95 // Reopens all file descriptors that are contained in the table. Returns true 96 // if all descriptors were successfully re-opened or detached, and false if an 97 // error occurred. 98 void ReopenOrDetach(fail_fn_t fail_fn); 99 100 private: 101 explicit FileDescriptorTable(const std::unordered_map<int, FileDescriptorInfo*>& map); 102 103 void RestatInternal(std::set<int>& open_fds, fail_fn_t fail_fn); 104 105 // Invariant: All values in this unordered_map are non-NULL. 106 std::unordered_map<int, FileDescriptorInfo*> open_fd_map_; 107 108 DISALLOW_COPY_AND_ASSIGN(FileDescriptorTable); 109 }; 110 111 #endif // FRAMEWORKS_BASE_CORE_JNI_FD_UTILS_H_ 112