1 /*
2 * Copyright (C) 2020 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "snapuserd_transition.h"
18
19 #include <sys/mman.h>
20 #include <sys/socket.h>
21 #include <sys/syscall.h>
22 #include <sys/xattr.h>
23 #include <unistd.h>
24
25 #include <filesystem>
26 #include <string>
27 #include <string_view>
28
29 #include <android-base/file.h>
30 #include <android-base/logging.h>
31 #include <android-base/parseint.h>
32 #include <android-base/stringprintf.h>
33 #include <android-base/strings.h>
34 #include <android-base/unique_fd.h>
35 #include <cutils/sockets.h>
36 #include <fs_avb/fs_avb.h>
37 #include <libsnapshot/snapshot.h>
38 #include <private/android_filesystem_config.h>
39 #include <procinfo/process_map.h>
40 #include <selinux/android.h>
41 #include <snapuserd/snapuserd_client.h>
42
43 #include "block_dev_initializer.h"
44 #include "lmkd_service.h"
45 #include "service_utils.h"
46 #include "util.h"
47
48 namespace android {
49 namespace init {
50
51 using namespace std::string_literals;
52
53 using android::base::unique_fd;
54 using android::snapshot::SnapshotManager;
55 using android::snapshot::SnapuserdClient;
56
57 static constexpr char kSnapuserdPath[] = "/system/bin/snapuserd";
58 static constexpr char kSnapuserdFirstStagePidVar[] = "FIRST_STAGE_SNAPUSERD_PID";
59 static constexpr char kSnapuserdFirstStageFdVar[] = "FIRST_STAGE_SNAPUSERD_FD";
60 static constexpr char kSnapuserdFirstStageInfoVar[] = "FIRST_STAGE_SNAPUSERD_INFO";
61 static constexpr char kSnapuserdLabel[] = "u:object_r:snapuserd_exec:s0";
62 static constexpr char kSnapuserdSocketLabel[] = "u:object_r:snapuserd_socket:s0";
63
LaunchFirstStageSnapuserd(SnapshotDriver driver)64 void LaunchFirstStageSnapuserd(SnapshotDriver driver) {
65 SocketDescriptor socket_desc;
66 socket_desc.name = android::snapshot::kSnapuserdSocket;
67 socket_desc.type = SOCK_STREAM;
68 socket_desc.perm = 0660;
69 socket_desc.uid = AID_SYSTEM;
70 socket_desc.gid = AID_SYSTEM;
71
72 // We specify a label here even though it technically is not needed. During
73 // first_stage_mount there is no sepolicy loaded. Once sepolicy is loaded,
74 // we bypass the socket entirely.
75 auto socket = socket_desc.Create(kSnapuserdSocketLabel);
76 if (!socket.ok()) {
77 LOG(FATAL) << "Could not create snapuserd socket: " << socket.error();
78 }
79
80 pid_t pid = fork();
81 if (pid < 0) {
82 PLOG(FATAL) << "Cannot launch snapuserd; fork failed";
83 }
84 if (pid == 0) {
85 socket->Publish();
86
87 if (driver == SnapshotDriver::DM_USER) {
88 char arg0[] = "/system/bin/snapuserd";
89 char arg1[] = "-user_snapshot";
90 char* const argv[] = {arg0, arg1, nullptr};
91 if (execv(arg0, argv) < 0) {
92 PLOG(FATAL) << "Cannot launch snapuserd; execv failed";
93 }
94 _exit(127);
95 } else {
96 char arg0[] = "/system/bin/snapuserd";
97 char* const argv[] = {arg0, nullptr};
98 if (execv(arg0, argv) < 0) {
99 PLOG(FATAL) << "Cannot launch snapuserd; execv failed";
100 }
101 _exit(127);
102 }
103 }
104
105 auto client = SnapuserdClient::Connect(android::snapshot::kSnapuserdSocket, 10s);
106 if (!client) {
107 LOG(FATAL) << "Could not connect to first-stage snapuserd";
108 }
109 if (client->SupportsSecondStageSocketHandoff()) {
110 setenv(kSnapuserdFirstStageInfoVar, "socket", 1);
111 }
112
113 setenv(kSnapuserdFirstStagePidVar, std::to_string(pid).c_str(), 1);
114
115 LOG(INFO) << "Relaunched snapuserd with pid: " << pid;
116 }
117
GetSnapuserdFirstStagePid()118 std::optional<pid_t> GetSnapuserdFirstStagePid() {
119 const char* pid_str = getenv(kSnapuserdFirstStagePidVar);
120 if (!pid_str) {
121 return {};
122 }
123
124 int pid = 0;
125 if (!android::base::ParseInt(pid_str, &pid)) {
126 LOG(FATAL) << "Could not parse pid in environment, " << kSnapuserdFirstStagePidVar << "="
127 << pid_str;
128 }
129 return {pid};
130 }
131
RelabelLink(const std::string & link)132 static void RelabelLink(const std::string& link) {
133 selinux_android_restorecon(link.c_str(), 0);
134
135 std::string path;
136 if (android::base::Readlink(link, &path)) {
137 selinux_android_restorecon(path.c_str(), 0);
138 }
139 }
140
RelabelDeviceMapper()141 static void RelabelDeviceMapper() {
142 selinux_android_restorecon("/dev/device-mapper", 0);
143
144 std::error_code ec;
145 for (auto& iter : std::filesystem::directory_iterator("/dev/block", ec)) {
146 const auto& path = iter.path();
147 if (android::base::StartsWith(path.string(), "/dev/block/dm-")) {
148 selinux_android_restorecon(path.string().c_str(), 0);
149 }
150 }
151 }
152
GetRamdiskSnapuserdFd()153 static std::optional<int> GetRamdiskSnapuserdFd() {
154 const char* fd_str = getenv(kSnapuserdFirstStageFdVar);
155 if (!fd_str) {
156 return {};
157 }
158
159 int fd;
160 if (!android::base::ParseInt(fd_str, &fd)) {
161 LOG(FATAL) << "Could not parse fd in environment, " << kSnapuserdFirstStageFdVar << "="
162 << fd_str;
163 }
164 return {fd};
165 }
166
RestoreconRamdiskSnapuserd(int fd)167 void RestoreconRamdiskSnapuserd(int fd) {
168 if (fsetxattr(fd, XATTR_NAME_SELINUX, kSnapuserdLabel, strlen(kSnapuserdLabel) + 1, 0) < 0) {
169 PLOG(FATAL) << "fsetxattr snapuserd failed";
170 }
171 }
172
SnapuserdSelinuxHelper(std::unique_ptr<SnapshotManager> && sm,pid_t old_pid)173 SnapuserdSelinuxHelper::SnapuserdSelinuxHelper(std::unique_ptr<SnapshotManager>&& sm, pid_t old_pid)
174 : sm_(std::move(sm)), old_pid_(old_pid) {
175 // Only dm-user device names change during transitions, so the other
176 // devices are expected to be present.
177 sm_->SetUeventRegenCallback([this](const std::string& device) -> bool {
178 if (android::base::StartsWith(device, "/dev/dm-user/")) {
179 return block_dev_init_.InitDmUser(android::base::Basename(device));
180 }
181 return true;
182 });
183 }
184
LockAllSystemPages()185 static void LockAllSystemPages() {
186 bool ok = true;
187 auto callback = [&](const android::procinfo::MapInfo& map) -> void {
188 if (!ok || android::base::StartsWith(map.name, "/dev/") ||
189 !android::base::StartsWith(map.name, "/")) {
190 return;
191 }
192 auto start = reinterpret_cast<const void*>(map.start);
193 auto len = map.end - map.start;
194 if (!len) {
195 return;
196 }
197 if (mlock(start, len) < 0) {
198 LOG(ERROR) << "mlock failed, " << start << " for " << len << " bytes.";
199 ok = false;
200 }
201 };
202
203 if (!android::procinfo::ReadProcessMaps(getpid(), callback) || !ok) {
204 LOG(FATAL) << "Could not process /proc/" << getpid() << "/maps file for init, "
205 << "falling back to mlockall().";
206 if (mlockall(MCL_CURRENT) < 0) {
207 LOG(FATAL) << "mlockall failed";
208 }
209 }
210 }
211
StartTransition()212 void SnapuserdSelinuxHelper::StartTransition() {
213 LOG(INFO) << "Starting SELinux transition of snapuserd";
214
215 // The restorecon path reads from /system etc, so make sure any reads have
216 // been cached before proceeding.
217 auto handle = selinux_android_file_context_handle();
218 if (!handle) {
219 LOG(FATAL) << "Could not create SELinux file context handle";
220 }
221 selinux_android_set_sehandle(handle);
222
223 // We cannot access /system after the transition, so make sure init is
224 // pinned in memory.
225 LockAllSystemPages();
226
227 argv_.emplace_back("snapuserd");
228 argv_.emplace_back("-no_socket");
229 if (!sm_->DetachSnapuserdForSelinux(&argv_)) {
230 LOG(FATAL) << "Could not perform selinux transition";
231 }
232
233 // Make sure the process is gone so we don't have any selinux audits.
234 KillFirstStageSnapuserd(old_pid_);
235 }
236
FinishTransition()237 void SnapuserdSelinuxHelper::FinishTransition() {
238 RelabelLink("/dev/block/by-name/super");
239 RelabelDeviceMapper();
240
241 selinux_android_restorecon("/dev/null", 0);
242 selinux_android_restorecon("/dev/urandom", 0);
243 selinux_android_restorecon("/dev/kmsg", 0);
244 selinux_android_restorecon("/dev/dm-user", SELINUX_ANDROID_RESTORECON_RECURSE);
245
246 RelaunchFirstStageSnapuserd();
247
248 if (munlockall() < 0) {
249 PLOG(ERROR) << "munlockall failed";
250 }
251 }
252
253 /*
254 * Before starting init second stage, we will wait
255 * for snapuserd daemon to be up and running; bionic libc
256 * may read /system/etc/selinux/plat_property_contexts file
257 * before invoking main() function. This will happen if
258 * init initializes property during second stage. Any access
259 * to /system without snapuserd daemon will lead to a deadlock.
260 *
261 * Thus, we do a simple probe by reading system partition. This
262 * read will eventually be serviced by daemon confirming that
263 * daemon is up and running. Furthermore, we are still in the kernel
264 * domain and sepolicy has not been enforced yet. Thus, access
265 * to these device mapper block devices are ok even though
266 * we may see audit logs.
267 */
TestSnapuserdIsReady()268 bool SnapuserdSelinuxHelper::TestSnapuserdIsReady() {
269 std::string dev = "/dev/block/mapper/system"s + fs_mgr_get_slot_suffix();
270 android::base::unique_fd fd(open(dev.c_str(), O_RDONLY | O_DIRECT));
271 if (fd < 0) {
272 PLOG(ERROR) << "open " << dev << " failed";
273 return false;
274 }
275
276 void* addr;
277 ssize_t page_size = getpagesize();
278 if (posix_memalign(&addr, page_size, page_size) < 0) {
279 PLOG(ERROR) << "posix_memalign with page size " << page_size;
280 return false;
281 }
282
283 std::unique_ptr<void, decltype(&::free)> buffer(addr, ::free);
284
285 int iter = 0;
286 while (iter < 10) {
287 ssize_t n = TEMP_FAILURE_RETRY(pread(fd.get(), buffer.get(), page_size, 0));
288 if (n < 0) {
289 // Wait for sometime before retry
290 std::this_thread::sleep_for(100ms);
291 } else if (n == page_size) {
292 return true;
293 } else {
294 LOG(ERROR) << "pread returned: " << n << " from: " << dev << " expected: " << page_size;
295 }
296
297 iter += 1;
298 }
299
300 return false;
301 }
302
RelaunchFirstStageSnapuserd()303 void SnapuserdSelinuxHelper::RelaunchFirstStageSnapuserd() {
304 auto fd = GetRamdiskSnapuserdFd();
305 if (!fd) {
306 LOG(FATAL) << "Environment variable " << kSnapuserdFirstStageFdVar << " was not set!";
307 }
308 unsetenv(kSnapuserdFirstStageFdVar);
309
310 RestoreconRamdiskSnapuserd(fd.value());
311
312 pid_t pid = fork();
313 if (pid < 0) {
314 PLOG(FATAL) << "Fork to relaunch snapuserd failed";
315 }
316 if (pid > 0) {
317 // We don't need the descriptor anymore, and it should be closed to
318 // avoid leaking into subprocesses.
319 close(fd.value());
320
321 setenv(kSnapuserdFirstStagePidVar, std::to_string(pid).c_str(), 1);
322
323 LOG(INFO) << "Relaunched snapuserd with pid: " << pid;
324
325 // Since daemon is not started as a service, we have
326 // to explicitly set the OOM score to default which is unkillable
327 std::string oom_str = std::to_string(DEFAULT_OOM_SCORE_ADJUST);
328 std::string oom_file = android::base::StringPrintf("/proc/%d/oom_score_adj", pid);
329 if (!android::base::WriteStringToFile(oom_str, oom_file)) {
330 PLOG(ERROR) << "couldn't write oom_score_adj to snapuserd daemon with pid: " << pid;
331 }
332
333 if (!TestSnapuserdIsReady()) {
334 PLOG(FATAL) << "snapuserd daemon failed to launch";
335 } else {
336 LOG(INFO) << "snapuserd daemon is up and running";
337 }
338
339 return;
340 }
341
342 // Make sure the descriptor is gone after we exec.
343 if (fcntl(fd.value(), F_SETFD, FD_CLOEXEC) < 0) {
344 PLOG(FATAL) << "fcntl FD_CLOEXEC failed for snapuserd fd";
345 }
346
347 std::vector<char*> argv;
348 for (auto& arg : argv_) {
349 argv.emplace_back(arg.data());
350 }
351 argv.emplace_back(nullptr);
352
353 int rv = syscall(SYS_execveat, fd.value(), "", reinterpret_cast<char* const*>(argv.data()),
354 nullptr, AT_EMPTY_PATH);
355 if (rv < 0) {
356 PLOG(FATAL) << "Failed to execveat() snapuserd";
357 }
358 }
359
CreateIfNeeded()360 std::unique_ptr<SnapuserdSelinuxHelper> SnapuserdSelinuxHelper::CreateIfNeeded() {
361 if (IsRecoveryMode()) {
362 return nullptr;
363 }
364
365 auto old_pid = GetSnapuserdFirstStagePid();
366 if (!old_pid) {
367 return nullptr;
368 }
369
370 auto sm = SnapshotManager::NewForFirstStageMount();
371 if (!sm) {
372 LOG(FATAL) << "Unable to create SnapshotManager";
373 }
374 return std::make_unique<SnapuserdSelinuxHelper>(std::move(sm), old_pid.value());
375 }
376
KillFirstStageSnapuserd(pid_t pid)377 void KillFirstStageSnapuserd(pid_t pid) {
378 if (kill(pid, SIGTERM) < 0 && errno != ESRCH) {
379 LOG(ERROR) << "Kill snapuserd pid failed: " << pid;
380 } else {
381 LOG(INFO) << "Sent SIGTERM to snapuserd process " << pid;
382 }
383 }
384
CleanupSnapuserdSocket()385 void CleanupSnapuserdSocket() {
386 auto socket_path = ANDROID_SOCKET_DIR "/"s + android::snapshot::kSnapuserdSocket;
387 if (access(socket_path.c_str(), F_OK) != 0) {
388 return;
389 }
390
391 // Tell the daemon to stop accepting connections and to gracefully exit
392 // once all outstanding handlers have terminated.
393 if (auto client = SnapuserdClient::Connect(android::snapshot::kSnapuserdSocket, 3s)) {
394 client->DetachSnapuserd();
395 }
396
397 // Unlink the socket so we can create it again in second-stage.
398 if (unlink(socket_path.c_str()) < 0) {
399 PLOG(FATAL) << "unlink " << socket_path << " failed";
400 }
401 }
402
SaveRamdiskPathToSnapuserd()403 void SaveRamdiskPathToSnapuserd() {
404 int fd = open(kSnapuserdPath, O_PATH);
405 if (fd < 0) {
406 PLOG(FATAL) << "Unable to open snapuserd: " << kSnapuserdPath;
407 }
408
409 auto value = std::to_string(fd);
410 if (setenv(kSnapuserdFirstStageFdVar, value.c_str(), 1) < 0) {
411 PLOG(FATAL) << "setenv failed: " << kSnapuserdFirstStageFdVar << "=" << value;
412 }
413 }
414
IsFirstStageSnapuserdRunning()415 bool IsFirstStageSnapuserdRunning() {
416 return GetSnapuserdFirstStagePid().has_value();
417 }
418
GetSnapuserdFirstStageInfo()419 std::vector<std::string> GetSnapuserdFirstStageInfo() {
420 const char* pid_str = getenv(kSnapuserdFirstStageInfoVar);
421 if (!pid_str) {
422 return {};
423 }
424 return android::base::Split(pid_str, ",");
425 }
426
427 } // namespace init
428 } // namespace android
429