1 /*
2 * Copyright (C) 2019 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "mount_namespace.h"
18
19 #include <sys/mount.h>
20
21 #include <string>
22 #include <vector>
23
24 #include <android-base/file.h>
25 #include <android-base/logging.h>
26 #include <android-base/properties.h>
27 #include <android-base/result.h>
28 #include <android-base/unique_fd.h>
29
30 #include "util.h"
31
32 namespace android {
33 namespace init {
34 namespace {
35
BindMount(const std::string & source,const std::string & mount_point)36 static bool BindMount(const std::string& source, const std::string& mount_point) {
37 if (mount(source.c_str(), mount_point.c_str(), nullptr, MS_BIND | MS_REC, nullptr) == -1) {
38 PLOG(ERROR) << "Failed to bind mount " << source;
39 return false;
40 }
41 return true;
42 }
43
ChangeMount(const std::string & mount_point,unsigned long mountflags)44 static bool ChangeMount(const std::string& mount_point, unsigned long mountflags) {
45 if (mount(nullptr, mount_point.c_str(), nullptr, mountflags, nullptr) == -1) {
46 PLOG(ERROR) << "Failed to remount " << mount_point << " as " << std::hex << mountflags;
47 return false;
48 }
49 return true;
50 }
51
OpenMountNamespace()52 static int OpenMountNamespace() {
53 int fd = open("/proc/self/ns/mnt", O_RDONLY | O_CLOEXEC);
54 if (fd < 0) {
55 PLOG(ERROR) << "Cannot open fd for current mount namespace";
56 }
57 return fd;
58 }
59
GetMountNamespaceId()60 static std::string GetMountNamespaceId() {
61 std::string ret;
62 if (!android::base::Readlink("/proc/self/ns/mnt", &ret)) {
63 PLOG(ERROR) << "Failed to read namespace ID";
64 return "";
65 }
66 return ret;
67 }
68
69 static android::base::unique_fd bootstrap_ns_fd;
70 static android::base::unique_fd default_ns_fd;
71
72 static std::string bootstrap_ns_id;
73 static std::string default_ns_id;
74
75 } // namespace
76
77 // In case we have two sets of APEXes (non-updatable, updatable), we need two separate mount
78 // namespaces.
NeedsTwoMountNamespaces()79 bool NeedsTwoMountNamespaces() {
80 if (IsRecoveryMode()) return false;
81 // In microdroid, there's only one set of APEXes in built-in directories include block devices.
82 if (IsMicrodroid()) return false;
83 return true;
84 }
85
SetupMountNamespaces()86 bool SetupMountNamespaces() {
87 // Set the propagation type of / as shared so that any mounting event (e.g.
88 // /data) is by default visible to all processes. When private mounting is
89 // needed for /foo/bar, then we will make /foo/bar as a mount point (by
90 // bind-mounting by to itself) and set the propagation type of the mount
91 // point to private.
92 if (!ChangeMount("/", MS_SHARED | MS_REC)) return false;
93
94 // /apex is a private mountpoint to give different sets of APEXes for
95 // the bootstrap and default mount namespaces. The processes running with
96 // the bootstrap namespace get APEXes from the read-only partition.
97 if (!(ChangeMount("/apex", MS_PRIVATE))) return false;
98
99 // /linkerconfig is a private mountpoint to give a different linker configuration
100 // based on the mount namespace. Subdirectory will be bind-mounted based on current mount
101 // namespace
102 if (!(ChangeMount("/linkerconfig", MS_PRIVATE))) return false;
103
104 // The two mount namespaces present challenges for scoped storage, because
105 // vold, which is responsible for most of the mounting, lives in the
106 // bootstrap mount namespace, whereas most other daemons and all apps live
107 // in the default namespace. Scoped storage has a need for a
108 // /mnt/installer view that is a slave bind mount of /mnt/user - in other
109 // words, all mounts under /mnt/user should automatically show up under
110 // /mnt/installer. However, additional mounts done under /mnt/installer
111 // should not propagate back to /mnt/user. In a single mount namespace
112 // this is easy to achieve, by simply marking the /mnt/installer a slave
113 // bind mount. Unfortunately, if /mnt/installer is only created and
114 // bind mounted after the two namespaces are created below, we end up
115 // with the following situation:
116 // /mnt/user and /mnt/installer share the same peer group in both the
117 // bootstrap and default namespaces. Marking /mnt/installer slave in either
118 // namespace means that it won't propagate events to the /mnt/installer in
119 // the other namespace, which is still something we require - vold is the
120 // one doing the mounting under /mnt/installer, and those mounts should
121 // show up in the default namespace as well.
122 //
123 // The simplest solution is to do the bind mount before the two namespaces
124 // are created: the effect is that in both namespaces, /mnt/installer is a
125 // slave to the /mnt/user mount, and at the same time /mnt/installer in the
126 // bootstrap namespace shares a peer group with /mnt/installer in the
127 // default namespace.
128 // /mnt/androidwritable is similar to /mnt/installer but serves for
129 // MOUNT_EXTERNAL_ANDROID_WRITABLE apps.
130 if (!mkdir_recursive("/mnt/user", 0755)) return false;
131 if (!mkdir_recursive("/mnt/installer", 0755)) return false;
132 if (!mkdir_recursive("/mnt/androidwritable", 0755)) return false;
133 if (!(BindMount("/mnt/user", "/mnt/installer"))) return false;
134 if (!(BindMount("/mnt/user", "/mnt/androidwritable"))) return false;
135 // First, make /mnt/installer and /mnt/androidwritable a slave bind mount
136 if (!(ChangeMount("/mnt/installer", MS_SLAVE))) return false;
137 if (!(ChangeMount("/mnt/androidwritable", MS_SLAVE))) return false;
138 // Then, make it shared again - effectively creating a new peer group, that
139 // will be inherited by new mount namespaces.
140 if (!(ChangeMount("/mnt/installer", MS_SHARED))) return false;
141 if (!(ChangeMount("/mnt/androidwritable", MS_SHARED))) return false;
142
143 bootstrap_ns_fd.reset(OpenMountNamespace());
144 bootstrap_ns_id = GetMountNamespaceId();
145
146 // When APEXes are updatable (e.g. not-flattened), we create separate mount
147 // namespaces for processes that are started before and after the APEX is
148 // activated by apexd. In the namespace for pre-apexd processes, small
149 // number of essential APEXes (e.g. com.android.runtime) are activated.
150 // In the namespace for post-apexd processes, all APEXes are activated.
151 bool success = true;
152 if (NeedsTwoMountNamespaces()) {
153 // Creating a new namespace by cloning, saving, and switching back to
154 // the original namespace.
155 if (unshare(CLONE_NEWNS) == -1) {
156 PLOG(ERROR) << "Cannot create mount namespace";
157 return false;
158 }
159 default_ns_fd.reset(OpenMountNamespace());
160 default_ns_id = GetMountNamespaceId();
161
162 if (setns(bootstrap_ns_fd.get(), CLONE_NEWNS) == -1) {
163 PLOG(ERROR) << "Cannot switch back to bootstrap mount namespace";
164 return false;
165 }
166
167 // Some components (e.g. servicemanager) need to access bootstrap
168 // APEXes from the default mount namespace. To achieve that, we bind-mount
169 // /apex to /bootstrap-apex in the bootstrap mount namespace. Since /bootstrap-apex
170 // is "shared", the mounts are visible in the default mount namespace as well.
171 //
172 // The end result will look like:
173 // in the bootstrap mount namespace:
174 // /apex (== /bootstrap-apex)
175 // {bootstrap APEXes from the read-only partition}
176 //
177 // in the default mount namespace:
178 // /bootstrap-apex
179 // {bootstrap APEXes from the read-only partition}
180 // /apex
181 // {APEXes, can be from /data partition}
182 if (!(BindMount("/bootstrap-apex", "/apex"))) return false;
183 } else {
184 // Otherwise, default == bootstrap
185 default_ns_fd.reset(OpenMountNamespace());
186 default_ns_id = GetMountNamespaceId();
187 }
188
189 LOG(INFO) << "SetupMountNamespaces done";
190 return success;
191 }
192
193 // Switch the mount namespace of the current process from bootstrap to default OR from default to
194 // bootstrap. If the current mount namespace is neither bootstrap nor default, keep it that way.
SwitchToMountNamespaceIfNeeded(MountNamespace target_mount_namespace)195 Result<void> SwitchToMountNamespaceIfNeeded(MountNamespace target_mount_namespace) {
196 if (IsRecoveryMode()) {
197 // we don't have multiple namespaces in recovery mode or if apex is not updatable
198 return {};
199 }
200
201 const std::string current_namespace_id = GetMountNamespaceId();
202 MountNamespace current_mount_namespace;
203 if (current_namespace_id == bootstrap_ns_id) {
204 current_mount_namespace = NS_BOOTSTRAP;
205 } else if (current_namespace_id == default_ns_id) {
206 current_mount_namespace = NS_DEFAULT;
207 } else {
208 // services with `namespace mnt` start in its own mount namespace. So we need to keep it.
209 return {};
210 }
211
212 // We're already in the target mount namespace.
213 if (current_mount_namespace == target_mount_namespace) {
214 return {};
215 }
216
217 const auto& ns_fd = target_mount_namespace == NS_BOOTSTRAP ? bootstrap_ns_fd : default_ns_fd;
218 const auto& ns_name = target_mount_namespace == NS_BOOTSTRAP ? "bootstrap" : "default";
219 if (ns_fd.get() != -1) {
220 if (setns(ns_fd.get(), CLONE_NEWNS) == -1) {
221 return ErrnoError() << "Failed to switch to " << ns_name << " mount namespace.";
222 }
223 }
224 return {};
225 }
226
GetCurrentMountNamespace()227 base::Result<MountNamespace> GetCurrentMountNamespace() {
228 std::string current_namespace_id = GetMountNamespaceId();
229 if (current_namespace_id == "") {
230 return Error() << "Failed to get current mount namespace ID";
231 }
232
233 if (current_namespace_id == bootstrap_ns_id) {
234 return NS_BOOTSTRAP;
235 } else if (current_namespace_id == default_ns_id) {
236 return NS_DEFAULT;
237 }
238
239 return Error() << "Failed to find current mount namespace";
240 }
241
242 } // namespace init
243 } // namespace android
244