2015-08-01 03:45:25 +08:00
|
|
|
/*
|
|
|
|
* Copyright (C) 2015 The Android Open Source Project
|
|
|
|
*
|
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
* you may not use this file except in compliance with the License.
|
|
|
|
* You may obtain a copy of the License at
|
|
|
|
*
|
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
*
|
|
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
* See the License for the specific language governing permissions and
|
|
|
|
* limitations under the License.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include "service.h"
|
|
|
|
|
|
|
|
#include <fcntl.h>
|
2016-11-11 09:43:47 +08:00
|
|
|
#include <inttypes.h>
|
init: Add support for ambient capabilities.
Ambient capabilities are inherited in a straightforward way across
execve(2):
"
If you are nonroot but you have a capability, you can add it to pA.
If you do so, your children get that capability in pA, pP, and pE.
For example, you can set pA = CAP_NET_BIND_SERVICE, and your
children can automatically bind low-numbered ports.
"
This will allow us to get rid of the special meaning for AID_NET_ADMIN
and AID_NET_RAW, and if desired, to reduce the use of file capabilities
(which grant capabilities to any process that can execute the file). An
additional benefit of the latter is that a single .rc file can specify
all properties for a service, without having to rely on a separate file
for file capabilities.
Ambient capabilities are supported starting with kernel 4.3 and have
been backported to all Android common kernels back to 3.10.
I chose to not use Minijail here (though I'm still using libcap) for
two reasons:
1-The Minijail code is designed to work in situations where the process
is holding any set of capabilities, so it's more complex. The situation
when forking from init allows for simpler code.
2-The way Minijail is structured right now, we would not be able to
make the required SELinux calls between UID/GID dropping and other priv
dropping code. In the future, it will make sense to add some sort of
"hook" to Minijail so that it can be used in situations where we want
to do other operations between some of the privilege-dropping
operations carried out by Minijail.
Bug: 32438163
Test: Use sample service.
Change-Id: I3226cc95769d1beacbae619cb6c6e6a5425890fb
2016-10-27 22:33:03 +08:00
|
|
|
#include <linux/securebits.h>
|
2016-04-22 06:35:09 +08:00
|
|
|
#include <sched.h>
|
|
|
|
#include <sys/mount.h>
|
|
|
|
#include <sys/prctl.h>
|
2016-05-19 08:36:30 +08:00
|
|
|
#include <sys/resource.h>
|
2015-08-01 03:45:25 +08:00
|
|
|
#include <sys/stat.h>
|
2017-04-08 04:46:21 +08:00
|
|
|
#include <sys/system_properties.h>
|
2016-05-19 08:36:30 +08:00
|
|
|
#include <sys/time.h>
|
2015-12-19 03:39:59 +08:00
|
|
|
#include <sys/wait.h>
|
2015-08-01 03:45:25 +08:00
|
|
|
#include <termios.h>
|
2015-08-12 07:37:04 +08:00
|
|
|
#include <unistd.h>
|
2015-08-01 03:45:25 +08:00
|
|
|
|
2015-12-05 14:00:26 +08:00
|
|
|
#include <android-base/file.h>
|
2017-04-07 07:30:22 +08:00
|
|
|
#include <android-base/logging.h>
|
2016-10-12 08:09:00 +08:00
|
|
|
#include <android-base/parseint.h>
|
2017-03-29 07:40:41 +08:00
|
|
|
#include <android-base/properties.h>
|
2017-06-30 07:18:08 +08:00
|
|
|
#include <android-base/scopeguard.h>
|
2015-12-05 14:00:26 +08:00
|
|
|
#include <android-base/stringprintf.h>
|
2016-06-25 06:12:21 +08:00
|
|
|
#include <android-base/strings.h>
|
2016-06-02 05:03:55 +08:00
|
|
|
#include <processgroup/processgroup.h>
|
2017-04-07 07:30:22 +08:00
|
|
|
#include <selinux/selinux.h>
|
|
|
|
#include <system/thread_defs.h>
|
2016-06-02 05:03:55 +08:00
|
|
|
|
2015-08-01 03:45:25 +08:00
|
|
|
#include "init.h"
|
|
|
|
#include "property_service.h"
|
|
|
|
#include "util.h"
|
|
|
|
|
2017-03-25 02:43:02 +08:00
|
|
|
using android::base::boot_clock;
|
2017-06-23 03:53:17 +08:00
|
|
|
using android::base::GetProperty;
|
|
|
|
using android::base::Join;
|
2017-06-30 07:18:08 +08:00
|
|
|
using android::base::make_scope_guard;
|
2016-10-12 08:09:00 +08:00
|
|
|
using android::base::ParseInt;
|
2017-06-23 03:53:17 +08:00
|
|
|
using android::base::StartsWith;
|
2015-08-27 02:43:36 +08:00
|
|
|
using android::base::StringPrintf;
|
|
|
|
using android::base::WriteStringToFile;
|
|
|
|
|
2017-06-23 03:53:17 +08:00
|
|
|
namespace android {
|
|
|
|
namespace init {
|
|
|
|
|
2016-07-09 01:32:26 +08:00
|
|
|
static std::string ComputeContextFromExecutable(std::string& service_name,
|
|
|
|
const std::string& service_path) {
|
|
|
|
std::string computed_context;
|
|
|
|
|
|
|
|
char* raw_con = nullptr;
|
|
|
|
char* raw_filecon = nullptr;
|
|
|
|
|
|
|
|
if (getcon(&raw_con) == -1) {
|
|
|
|
LOG(ERROR) << "could not get context while starting '" << service_name << "'";
|
|
|
|
return "";
|
|
|
|
}
|
|
|
|
std::unique_ptr<char> mycon(raw_con);
|
|
|
|
|
|
|
|
if (getfilecon(service_path.c_str(), &raw_filecon) == -1) {
|
|
|
|
LOG(ERROR) << "could not get file context while starting '" << service_name << "'";
|
|
|
|
return "";
|
|
|
|
}
|
|
|
|
std::unique_ptr<char> filecon(raw_filecon);
|
|
|
|
|
|
|
|
char* new_con = nullptr;
|
|
|
|
int rc = security_compute_create(mycon.get(), filecon.get(),
|
|
|
|
string_to_security_class("process"), &new_con);
|
|
|
|
if (rc == 0) {
|
|
|
|
computed_context = new_con;
|
|
|
|
free(new_con);
|
|
|
|
}
|
|
|
|
if (rc == 0 && computed_context == mycon.get()) {
|
|
|
|
LOG(ERROR) << "service " << service_name << " does not have a SELinux domain defined";
|
|
|
|
return "";
|
|
|
|
}
|
|
|
|
if (rc < 0) {
|
|
|
|
LOG(ERROR) << "could not get context while starting '" << service_name << "'";
|
|
|
|
return "";
|
|
|
|
}
|
|
|
|
return computed_context;
|
|
|
|
}
|
|
|
|
|
2016-04-22 06:35:09 +08:00
|
|
|
static void SetUpPidNamespace(const std::string& service_name) {
|
|
|
|
constexpr unsigned int kSafeFlags = MS_NODEV | MS_NOEXEC | MS_NOSUID;
|
|
|
|
|
|
|
|
// It's OK to LOG(FATAL) in this function since it's running in the first
|
|
|
|
// child process.
|
|
|
|
if (mount("", "/proc", "proc", kSafeFlags | MS_REMOUNT, "") == -1) {
|
2016-07-26 09:18:16 +08:00
|
|
|
PLOG(FATAL) << "couldn't remount(/proc) for " << service_name;
|
2016-04-22 06:35:09 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
if (prctl(PR_SET_NAME, service_name.c_str()) == -1) {
|
2016-07-26 09:18:16 +08:00
|
|
|
PLOG(FATAL) << "couldn't set name for " << service_name;
|
2016-04-22 06:35:09 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
pid_t child_pid = fork();
|
|
|
|
if (child_pid == -1) {
|
2016-07-26 09:18:16 +08:00
|
|
|
PLOG(FATAL) << "couldn't fork init inside the PID namespace for " << service_name;
|
2016-04-22 06:35:09 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
if (child_pid > 0) {
|
|
|
|
// So that we exit with the right status.
|
|
|
|
static int init_exitstatus = 0;
|
|
|
|
signal(SIGTERM, [](int) { _exit(init_exitstatus); });
|
|
|
|
|
|
|
|
pid_t waited_pid;
|
|
|
|
int status;
|
|
|
|
while ((waited_pid = wait(&status)) > 0) {
|
|
|
|
// This loop will end when there are no processes left inside the
|
|
|
|
// PID namespace or when the init process inside the PID namespace
|
|
|
|
// gets a signal.
|
|
|
|
if (waited_pid == child_pid) {
|
|
|
|
init_exitstatus = status;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (!WIFEXITED(init_exitstatus)) {
|
|
|
|
_exit(EXIT_FAILURE);
|
|
|
|
}
|
|
|
|
_exit(WEXITSTATUS(init_exitstatus));
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-07-09 01:32:26 +08:00
|
|
|
static void ExpandArgs(const std::vector<std::string>& args, std::vector<char*>* strs) {
|
|
|
|
std::vector<std::string> expanded_args;
|
|
|
|
expanded_args.resize(args.size());
|
|
|
|
strs->push_back(const_cast<char*>(args[0].c_str()));
|
|
|
|
for (std::size_t i = 1; i < args.size(); ++i) {
|
|
|
|
if (!expand_props(args[i], &expanded_args[i])) {
|
|
|
|
LOG(FATAL) << args[0] << ": cannot expand '" << args[i] << "'";
|
|
|
|
}
|
|
|
|
strs->push_back(const_cast<char*>(expanded_args[i].c_str()));
|
|
|
|
}
|
|
|
|
strs->push_back(nullptr);
|
|
|
|
}
|
|
|
|
|
2015-08-01 03:45:25 +08:00
|
|
|
ServiceEnvironmentInfo::ServiceEnvironmentInfo() {
|
|
|
|
}
|
|
|
|
|
|
|
|
ServiceEnvironmentInfo::ServiceEnvironmentInfo(const std::string& name,
|
|
|
|
const std::string& value)
|
|
|
|
: name(name), value(value) {
|
|
|
|
}
|
|
|
|
|
2017-03-28 01:59:11 +08:00
|
|
|
Service::Service(const std::string& name, const std::vector<std::string>& args)
|
|
|
|
: name_(name),
|
|
|
|
classnames_({"default"}),
|
|
|
|
flags_(0),
|
|
|
|
pid_(0),
|
|
|
|
crash_count_(0),
|
|
|
|
uid_(0),
|
|
|
|
gid_(0),
|
|
|
|
namespace_flags_(0),
|
|
|
|
seclabel_(""),
|
init: Stop combining actions
In the past, I had thought it didn't make sense to have multiple
Action classes with identical triggers within ActionManager::actions_,
and opted to instead combine these into a single action. In theory,
it should reduce memory overhead as only one copy of the triggers
needs to be stored.
In practice, this ends up not being a good idea.
Most importantly, given a file with the below three sections in this
same order:
on boot
setprop a b
on boot && property:true=true
setprop c d
on boot
setprop e f
Assuming that property 'true' == 'true', when the `boot` event
happens, the order of the setprop commands will actually be:
setprop a b
setprop e f
setprop c d
instead of the more intuitive order of:
setprop a b
setprop c d
setprop e f
This is a mistake and this CL fixes it. It also documents this order.
Secondly, with a given 'Action' now spanning multiple files, in order
to keep track of which file a command is run from, the 'Command'
itself needs to store this. Ironically to the original intention,
this increases total ram usage. This change now only stores the file
name in each 'Action' instead of each 'Command'. All in all this is a
negligible trade off of ram usage.
Thirdly, this requires a bunch of extra code and assumptions that
don't help anything else. In particular it forces to keep property triggers
sorted for easy comparison, which I'm using an std::map for currently,
but that is not the best data structure to contain them.
Lastly, I added the filename and line number to the 'processing
action' LOG(INFO) message.
Test: Boot bullhead, observe above changes
Test: Boot sailfish, observe no change in boot time
Change-Id: I3fbcac4ee677351314e33012c758145be82346e9
2017-04-19 04:21:54 +08:00
|
|
|
onrestart_(false, "<Service '" + name + "' onrestart>", 0),
|
2017-05-02 05:16:41 +08:00
|
|
|
keychord_id_(0),
|
2017-03-28 01:59:11 +08:00
|
|
|
ioprio_class_(IoSchedClass_NONE),
|
|
|
|
ioprio_pri_(0),
|
|
|
|
priority_(0),
|
|
|
|
oom_score_adjust_(-1000),
|
|
|
|
args_(args) {
|
2015-08-01 03:45:25 +08:00
|
|
|
onrestart_.InitSingleTrigger("onrestart");
|
|
|
|
}
|
|
|
|
|
2017-03-28 01:59:11 +08:00
|
|
|
Service::Service(const std::string& name, unsigned flags, uid_t uid, gid_t gid,
|
|
|
|
const std::vector<gid_t>& supp_gids, const CapSet& capabilities,
|
|
|
|
unsigned namespace_flags, const std::string& seclabel,
|
2016-04-22 06:35:09 +08:00
|
|
|
const std::vector<std::string>& args)
|
2017-03-28 01:59:11 +08:00
|
|
|
: name_(name),
|
|
|
|
classnames_({"default"}),
|
|
|
|
flags_(flags),
|
|
|
|
pid_(0),
|
|
|
|
crash_count_(0),
|
|
|
|
uid_(uid),
|
|
|
|
gid_(gid),
|
|
|
|
supp_gids_(supp_gids),
|
|
|
|
capabilities_(capabilities),
|
|
|
|
namespace_flags_(namespace_flags),
|
|
|
|
seclabel_(seclabel),
|
init: Stop combining actions
In the past, I had thought it didn't make sense to have multiple
Action classes with identical triggers within ActionManager::actions_,
and opted to instead combine these into a single action. In theory,
it should reduce memory overhead as only one copy of the triggers
needs to be stored.
In practice, this ends up not being a good idea.
Most importantly, given a file with the below three sections in this
same order:
on boot
setprop a b
on boot && property:true=true
setprop c d
on boot
setprop e f
Assuming that property 'true' == 'true', when the `boot` event
happens, the order of the setprop commands will actually be:
setprop a b
setprop e f
setprop c d
instead of the more intuitive order of:
setprop a b
setprop c d
setprop e f
This is a mistake and this CL fixes it. It also documents this order.
Secondly, with a given 'Action' now spanning multiple files, in order
to keep track of which file a command is run from, the 'Command'
itself needs to store this. Ironically to the original intention,
this increases total ram usage. This change now only stores the file
name in each 'Action' instead of each 'Command'. All in all this is a
negligible trade off of ram usage.
Thirdly, this requires a bunch of extra code and assumptions that
don't help anything else. In particular it forces to keep property triggers
sorted for easy comparison, which I'm using an std::map for currently,
but that is not the best data structure to contain them.
Lastly, I added the filename and line number to the 'processing
action' LOG(INFO) message.
Test: Boot bullhead, observe above changes
Test: Boot sailfish, observe no change in boot time
Change-Id: I3fbcac4ee677351314e33012c758145be82346e9
2017-04-19 04:21:54 +08:00
|
|
|
onrestart_(false, "<Service '" + name + "' onrestart>", 0),
|
2017-05-02 05:16:41 +08:00
|
|
|
keychord_id_(0),
|
2017-03-28 01:59:11 +08:00
|
|
|
ioprio_class_(IoSchedClass_NONE),
|
|
|
|
ioprio_pri_(0),
|
|
|
|
priority_(0),
|
|
|
|
oom_score_adjust_(-1000),
|
|
|
|
args_(args) {
|
2015-08-01 03:45:25 +08:00
|
|
|
onrestart_.InitSingleTrigger("onrestart");
|
|
|
|
}
|
|
|
|
|
|
|
|
void Service::NotifyStateChange(const std::string& new_state) const {
|
2017-03-28 07:27:30 +08:00
|
|
|
if ((flags_ & SVC_TEMPORARY) != 0) {
|
|
|
|
// Services created by 'exec' are temporary and don't have properties tracking their state.
|
2015-08-01 03:45:25 +08:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2017-06-23 07:50:31 +08:00
|
|
|
std::string prop_name = "init.svc." + name_;
|
|
|
|
property_set(prop_name, new_state);
|
2016-11-11 09:43:47 +08:00
|
|
|
|
|
|
|
if (new_state == "running") {
|
|
|
|
uint64_t start_ns = time_started_.time_since_epoch().count();
|
2017-06-23 07:50:31 +08:00
|
|
|
property_set("ro.boottime." + name_, std::to_string(start_ns));
|
2016-11-11 09:43:47 +08:00
|
|
|
}
|
2015-08-01 03:45:25 +08:00
|
|
|
}
|
|
|
|
|
2016-06-16 05:49:57 +08:00
|
|
|
void Service::KillProcessGroup(int signal) {
|
2017-05-05 02:32:36 +08:00
|
|
|
// If we've already seen a successful result from killProcessGroup*(), then we have removed
|
|
|
|
// the cgroup already and calling these functions a second time will simply result in an error.
|
|
|
|
// This is true regardless of which signal was sent.
|
|
|
|
// These functions handle their own logging, so no additional logging is needed.
|
|
|
|
if (!process_cgroup_empty_) {
|
|
|
|
LOG(INFO) << "Sending signal " << signal << " to service '" << name_ << "' (pid " << pid_
|
|
|
|
<< ") process group...";
|
|
|
|
int r;
|
|
|
|
if (signal == SIGTERM) {
|
|
|
|
r = killProcessGroupOnce(uid_, pid_, signal);
|
|
|
|
} else {
|
|
|
|
r = killProcessGroup(uid_, pid_, signal);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (r == 0) process_cgroup_empty_ = true;
|
|
|
|
}
|
2016-06-16 05:49:57 +08:00
|
|
|
}
|
|
|
|
|
2016-07-09 01:32:26 +08:00
|
|
|
void Service::SetProcessAttributes() {
|
init: Add support for ambient capabilities.
Ambient capabilities are inherited in a straightforward way across
execve(2):
"
If you are nonroot but you have a capability, you can add it to pA.
If you do so, your children get that capability in pA, pP, and pE.
For example, you can set pA = CAP_NET_BIND_SERVICE, and your
children can automatically bind low-numbered ports.
"
This will allow us to get rid of the special meaning for AID_NET_ADMIN
and AID_NET_RAW, and if desired, to reduce the use of file capabilities
(which grant capabilities to any process that can execute the file). An
additional benefit of the latter is that a single .rc file can specify
all properties for a service, without having to rely on a separate file
for file capabilities.
Ambient capabilities are supported starting with kernel 4.3 and have
been backported to all Android common kernels back to 3.10.
I chose to not use Minijail here (though I'm still using libcap) for
two reasons:
1-The Minijail code is designed to work in situations where the process
is holding any set of capabilities, so it's more complex. The situation
when forking from init allows for simpler code.
2-The way Minijail is structured right now, we would not be able to
make the required SELinux calls between UID/GID dropping and other priv
dropping code. In the future, it will make sense to add some sort of
"hook" to Minijail so that it can be used in situations where we want
to do other operations between some of the privilege-dropping
operations carried out by Minijail.
Bug: 32438163
Test: Use sample service.
Change-Id: I3226cc95769d1beacbae619cb6c6e6a5425890fb
2016-10-27 22:33:03 +08:00
|
|
|
// Keep capabilites on uid change.
|
|
|
|
if (capabilities_.any() && uid_) {
|
2017-07-01 05:04:20 +08:00
|
|
|
// If Android is running in a container, some securebits might already
|
|
|
|
// be locked, so don't change those.
|
|
|
|
int64_t securebits = prctl(PR_GET_SECUREBITS);
|
|
|
|
if (securebits == -1) {
|
|
|
|
PLOG(FATAL) << "prctl(PR_GET_SECUREBITS) failed for " << name_;
|
|
|
|
}
|
|
|
|
securebits |= SECBIT_KEEP_CAPS | SECBIT_KEEP_CAPS_LOCKED;
|
|
|
|
if (prctl(PR_SET_SECUREBITS, securebits) != 0) {
|
|
|
|
PLOG(FATAL) << "prctl(PR_SET_SECUREBITS) failed for " << name_;
|
init: Add support for ambient capabilities.
Ambient capabilities are inherited in a straightforward way across
execve(2):
"
If you are nonroot but you have a capability, you can add it to pA.
If you do so, your children get that capability in pA, pP, and pE.
For example, you can set pA = CAP_NET_BIND_SERVICE, and your
children can automatically bind low-numbered ports.
"
This will allow us to get rid of the special meaning for AID_NET_ADMIN
and AID_NET_RAW, and if desired, to reduce the use of file capabilities
(which grant capabilities to any process that can execute the file). An
additional benefit of the latter is that a single .rc file can specify
all properties for a service, without having to rely on a separate file
for file capabilities.
Ambient capabilities are supported starting with kernel 4.3 and have
been backported to all Android common kernels back to 3.10.
I chose to not use Minijail here (though I'm still using libcap) for
two reasons:
1-The Minijail code is designed to work in situations where the process
is holding any set of capabilities, so it's more complex. The situation
when forking from init allows for simpler code.
2-The way Minijail is structured right now, we would not be able to
make the required SELinux calls between UID/GID dropping and other priv
dropping code. In the future, it will make sense to add some sort of
"hook" to Minijail so that it can be used in situations where we want
to do other operations between some of the privilege-dropping
operations carried out by Minijail.
Bug: 32438163
Test: Use sample service.
Change-Id: I3226cc95769d1beacbae619cb6c6e6a5425890fb
2016-10-27 22:33:03 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-07-26 09:18:16 +08:00
|
|
|
// TODO: work out why this fails for `console` then upgrade to FATAL.
|
|
|
|
if (setpgid(0, getpid()) == -1) PLOG(ERROR) << "setpgid failed for " << name_;
|
2016-07-09 01:32:26 +08:00
|
|
|
|
|
|
|
if (gid_) {
|
|
|
|
if (setgid(gid_) != 0) {
|
2016-07-26 09:18:16 +08:00
|
|
|
PLOG(FATAL) << "setgid failed for " << name_;
|
2016-07-09 01:32:26 +08:00
|
|
|
}
|
|
|
|
}
|
2016-10-30 03:20:00 +08:00
|
|
|
if (setgroups(supp_gids_.size(), &supp_gids_[0]) != 0) {
|
|
|
|
PLOG(FATAL) << "setgroups failed for " << name_;
|
2016-07-09 01:32:26 +08:00
|
|
|
}
|
|
|
|
if (uid_) {
|
|
|
|
if (setuid(uid_) != 0) {
|
2016-07-26 09:18:16 +08:00
|
|
|
PLOG(FATAL) << "setuid failed for " << name_;
|
2016-07-09 01:32:26 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
if (!seclabel_.empty()) {
|
|
|
|
if (setexeccon(seclabel_.c_str()) < 0) {
|
2016-07-26 09:18:16 +08:00
|
|
|
PLOG(FATAL) << "cannot setexeccon('" << seclabel_ << "') for " << name_;
|
2016-07-09 01:32:26 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
if (priority_ != 0) {
|
|
|
|
if (setpriority(PRIO_PROCESS, 0, priority_) != 0) {
|
2016-07-26 09:18:16 +08:00
|
|
|
PLOG(FATAL) << "setpriority failed for " << name_;
|
2016-07-09 01:32:26 +08:00
|
|
|
}
|
|
|
|
}
|
init: Add support for ambient capabilities.
Ambient capabilities are inherited in a straightforward way across
execve(2):
"
If you are nonroot but you have a capability, you can add it to pA.
If you do so, your children get that capability in pA, pP, and pE.
For example, you can set pA = CAP_NET_BIND_SERVICE, and your
children can automatically bind low-numbered ports.
"
This will allow us to get rid of the special meaning for AID_NET_ADMIN
and AID_NET_RAW, and if desired, to reduce the use of file capabilities
(which grant capabilities to any process that can execute the file). An
additional benefit of the latter is that a single .rc file can specify
all properties for a service, without having to rely on a separate file
for file capabilities.
Ambient capabilities are supported starting with kernel 4.3 and have
been backported to all Android common kernels back to 3.10.
I chose to not use Minijail here (though I'm still using libcap) for
two reasons:
1-The Minijail code is designed to work in situations where the process
is holding any set of capabilities, so it's more complex. The situation
when forking from init allows for simpler code.
2-The way Minijail is structured right now, we would not be able to
make the required SELinux calls between UID/GID dropping and other priv
dropping code. In the future, it will make sense to add some sort of
"hook" to Minijail so that it can be used in situations where we want
to do other operations between some of the privilege-dropping
operations carried out by Minijail.
Bug: 32438163
Test: Use sample service.
Change-Id: I3226cc95769d1beacbae619cb6c6e6a5425890fb
2016-10-27 22:33:03 +08:00
|
|
|
if (capabilities_.any()) {
|
|
|
|
if (!SetCapsForExec(capabilities_)) {
|
|
|
|
LOG(FATAL) << "cannot set capabilities for " << name_;
|
|
|
|
}
|
|
|
|
}
|
2016-07-09 01:32:26 +08:00
|
|
|
}
|
|
|
|
|
2017-03-28 07:27:30 +08:00
|
|
|
void Service::Reap() {
|
2015-08-01 03:45:25 +08:00
|
|
|
if (!(flags_ & SVC_ONESHOT) || (flags_ & SVC_RESTART)) {
|
2016-06-16 05:49:57 +08:00
|
|
|
KillProcessGroup(SIGKILL);
|
2015-08-01 03:45:25 +08:00
|
|
|
}
|
|
|
|
|
2016-10-27 22:45:34 +08:00
|
|
|
// Remove any descriptor resources we may have created.
|
|
|
|
std::for_each(descriptors_.begin(), descriptors_.end(),
|
|
|
|
std::bind(&DescriptorInfo::Clean, std::placeholders::_1));
|
2015-08-01 03:45:25 +08:00
|
|
|
|
2017-03-28 07:27:30 +08:00
|
|
|
if (flags_ & SVC_TEMPORARY) {
|
|
|
|
return;
|
2015-08-01 03:45:25 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
pid_ = 0;
|
|
|
|
flags_ &= (~SVC_RUNNING);
|
|
|
|
|
|
|
|
// Oneshot processes go into the disabled state on exit,
|
|
|
|
// except when manually restarted.
|
|
|
|
if ((flags_ & SVC_ONESHOT) && !(flags_ & SVC_RESTART)) {
|
|
|
|
flags_ |= SVC_DISABLED;
|
|
|
|
}
|
|
|
|
|
|
|
|
// Disabled and reset processes do not get restarted automatically.
|
|
|
|
if (flags_ & (SVC_DISABLED | SVC_RESET)) {
|
|
|
|
NotifyStateChange("stopped");
|
2017-03-28 07:27:30 +08:00
|
|
|
return;
|
2015-08-01 03:45:25 +08:00
|
|
|
}
|
|
|
|
|
2016-11-11 09:43:47 +08:00
|
|
|
// If we crash > 4 times in 4 minutes, reboot into recovery.
|
|
|
|
boot_clock::time_point now = boot_clock::now();
|
2015-08-01 03:45:25 +08:00
|
|
|
if ((flags_ & SVC_CRITICAL) && !(flags_ & SVC_RESTART)) {
|
2016-11-11 09:43:47 +08:00
|
|
|
if (now < time_crashed_ + 4min) {
|
|
|
|
if (++crash_count_ > 4) {
|
2016-11-30 03:20:58 +08:00
|
|
|
LOG(ERROR) << "critical process '" << name_ << "' exited 4 times in 4 minutes";
|
|
|
|
panic();
|
2015-08-01 03:45:25 +08:00
|
|
|
}
|
|
|
|
} else {
|
|
|
|
time_crashed_ = now;
|
2016-11-11 09:43:47 +08:00
|
|
|
crash_count_ = 1;
|
2015-08-01 03:45:25 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
flags_ &= (~SVC_RESTART);
|
|
|
|
flags_ |= SVC_RESTARTING;
|
|
|
|
|
|
|
|
// Execute all onrestart commands for this service.
|
|
|
|
onrestart_.ExecuteAllCommands();
|
|
|
|
|
|
|
|
NotifyStateChange("restarting");
|
2017-03-28 07:27:30 +08:00
|
|
|
return;
|
2015-08-01 03:45:25 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
void Service::DumpState() const {
|
2016-06-25 06:12:21 +08:00
|
|
|
LOG(INFO) << "service " << name_;
|
2017-06-23 03:53:17 +08:00
|
|
|
LOG(INFO) << " class '" << Join(classnames_, " ") << "'";
|
|
|
|
LOG(INFO) << " exec " << Join(args_, " ");
|
2016-10-27 22:45:34 +08:00
|
|
|
std::for_each(descriptors_.begin(), descriptors_.end(),
|
|
|
|
[] (const auto& info) { LOG(INFO) << *info; });
|
2015-08-01 03:45:25 +08:00
|
|
|
}
|
|
|
|
|
init: Add support for ambient capabilities.
Ambient capabilities are inherited in a straightforward way across
execve(2):
"
If you are nonroot but you have a capability, you can add it to pA.
If you do so, your children get that capability in pA, pP, and pE.
For example, you can set pA = CAP_NET_BIND_SERVICE, and your
children can automatically bind low-numbered ports.
"
This will allow us to get rid of the special meaning for AID_NET_ADMIN
and AID_NET_RAW, and if desired, to reduce the use of file capabilities
(which grant capabilities to any process that can execute the file). An
additional benefit of the latter is that a single .rc file can specify
all properties for a service, without having to rely on a separate file
for file capabilities.
Ambient capabilities are supported starting with kernel 4.3 and have
been backported to all Android common kernels back to 3.10.
I chose to not use Minijail here (though I'm still using libcap) for
two reasons:
1-The Minijail code is designed to work in situations where the process
is holding any set of capabilities, so it's more complex. The situation
when forking from init allows for simpler code.
2-The way Minijail is structured right now, we would not be able to
make the required SELinux calls between UID/GID dropping and other priv
dropping code. In the future, it will make sense to add some sort of
"hook" to Minijail so that it can be used in situations where we want
to do other operations between some of the privilege-dropping
operations carried out by Minijail.
Bug: 32438163
Test: Use sample service.
Change-Id: I3226cc95769d1beacbae619cb6c6e6a5425890fb
2016-10-27 22:33:03 +08:00
|
|
|
bool Service::ParseCapabilities(const std::vector<std::string>& args, std::string* err) {
|
|
|
|
capabilities_ = 0;
|
|
|
|
|
2016-12-16 01:13:38 +08:00
|
|
|
if (!CapAmbientSupported()) {
|
|
|
|
*err = "capabilities requested but the kernel does not support ambient capabilities";
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
unsigned int last_valid_cap = GetLastValidCap();
|
|
|
|
if (last_valid_cap >= capabilities_.size()) {
|
|
|
|
LOG(WARNING) << "last valid run-time capability is larger than CAP_LAST_CAP";
|
|
|
|
}
|
|
|
|
|
init: Add support for ambient capabilities.
Ambient capabilities are inherited in a straightforward way across
execve(2):
"
If you are nonroot but you have a capability, you can add it to pA.
If you do so, your children get that capability in pA, pP, and pE.
For example, you can set pA = CAP_NET_BIND_SERVICE, and your
children can automatically bind low-numbered ports.
"
This will allow us to get rid of the special meaning for AID_NET_ADMIN
and AID_NET_RAW, and if desired, to reduce the use of file capabilities
(which grant capabilities to any process that can execute the file). An
additional benefit of the latter is that a single .rc file can specify
all properties for a service, without having to rely on a separate file
for file capabilities.
Ambient capabilities are supported starting with kernel 4.3 and have
been backported to all Android common kernels back to 3.10.
I chose to not use Minijail here (though I'm still using libcap) for
two reasons:
1-The Minijail code is designed to work in situations where the process
is holding any set of capabilities, so it's more complex. The situation
when forking from init allows for simpler code.
2-The way Minijail is structured right now, we would not be able to
make the required SELinux calls between UID/GID dropping and other priv
dropping code. In the future, it will make sense to add some sort of
"hook" to Minijail so that it can be used in situations where we want
to do other operations between some of the privilege-dropping
operations carried out by Minijail.
Bug: 32438163
Test: Use sample service.
Change-Id: I3226cc95769d1beacbae619cb6c6e6a5425890fb
2016-10-27 22:33:03 +08:00
|
|
|
for (size_t i = 1; i < args.size(); i++) {
|
|
|
|
const std::string& arg = args[i];
|
2016-12-16 01:13:38 +08:00
|
|
|
int res = LookupCap(arg);
|
|
|
|
if (res < 0) {
|
init: Add support for ambient capabilities.
Ambient capabilities are inherited in a straightforward way across
execve(2):
"
If you are nonroot but you have a capability, you can add it to pA.
If you do so, your children get that capability in pA, pP, and pE.
For example, you can set pA = CAP_NET_BIND_SERVICE, and your
children can automatically bind low-numbered ports.
"
This will allow us to get rid of the special meaning for AID_NET_ADMIN
and AID_NET_RAW, and if desired, to reduce the use of file capabilities
(which grant capabilities to any process that can execute the file). An
additional benefit of the latter is that a single .rc file can specify
all properties for a service, without having to rely on a separate file
for file capabilities.
Ambient capabilities are supported starting with kernel 4.3 and have
been backported to all Android common kernels back to 3.10.
I chose to not use Minijail here (though I'm still using libcap) for
two reasons:
1-The Minijail code is designed to work in situations where the process
is holding any set of capabilities, so it's more complex. The situation
when forking from init allows for simpler code.
2-The way Minijail is structured right now, we would not be able to
make the required SELinux calls between UID/GID dropping and other priv
dropping code. In the future, it will make sense to add some sort of
"hook" to Minijail so that it can be used in situations where we want
to do other operations between some of the privilege-dropping
operations carried out by Minijail.
Bug: 32438163
Test: Use sample service.
Change-Id: I3226cc95769d1beacbae619cb6c6e6a5425890fb
2016-10-27 22:33:03 +08:00
|
|
|
*err = StringPrintf("invalid capability '%s'", arg.c_str());
|
|
|
|
return false;
|
|
|
|
}
|
2016-12-16 01:13:38 +08:00
|
|
|
unsigned int cap = static_cast<unsigned int>(res); // |res| is >= 0.
|
|
|
|
if (cap > last_valid_cap) {
|
|
|
|
*err = StringPrintf("capability '%s' not supported by the kernel", arg.c_str());
|
|
|
|
return false;
|
|
|
|
}
|
init: Add support for ambient capabilities.
Ambient capabilities are inherited in a straightforward way across
execve(2):
"
If you are nonroot but you have a capability, you can add it to pA.
If you do so, your children get that capability in pA, pP, and pE.
For example, you can set pA = CAP_NET_BIND_SERVICE, and your
children can automatically bind low-numbered ports.
"
This will allow us to get rid of the special meaning for AID_NET_ADMIN
and AID_NET_RAW, and if desired, to reduce the use of file capabilities
(which grant capabilities to any process that can execute the file). An
additional benefit of the latter is that a single .rc file can specify
all properties for a service, without having to rely on a separate file
for file capabilities.
Ambient capabilities are supported starting with kernel 4.3 and have
been backported to all Android common kernels back to 3.10.
I chose to not use Minijail here (though I'm still using libcap) for
two reasons:
1-The Minijail code is designed to work in situations where the process
is holding any set of capabilities, so it's more complex. The situation
when forking from init allows for simpler code.
2-The way Minijail is structured right now, we would not be able to
make the required SELinux calls between UID/GID dropping and other priv
dropping code. In the future, it will make sense to add some sort of
"hook" to Minijail so that it can be used in situations where we want
to do other operations between some of the privilege-dropping
operations carried out by Minijail.
Bug: 32438163
Test: Use sample service.
Change-Id: I3226cc95769d1beacbae619cb6c6e6a5425890fb
2016-10-27 22:33:03 +08:00
|
|
|
capabilities_[cap] = true;
|
|
|
|
}
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2016-06-30 02:32:49 +08:00
|
|
|
bool Service::ParseClass(const std::vector<std::string>& args, std::string* err) {
|
2017-03-28 01:59:11 +08:00
|
|
|
classnames_ = std::set<std::string>(args.begin() + 1, args.end());
|
2015-08-27 02:43:36 +08:00
|
|
|
return true;
|
|
|
|
}
|
2015-08-01 03:45:25 +08:00
|
|
|
|
2016-06-30 02:32:49 +08:00
|
|
|
bool Service::ParseConsole(const std::vector<std::string>& args, std::string* err) {
|
2015-08-27 02:43:36 +08:00
|
|
|
flags_ |= SVC_CONSOLE;
|
2016-03-21 16:08:07 +08:00
|
|
|
console_ = args.size() > 1 ? "/dev/" + args[1] : "";
|
2015-08-27 02:43:36 +08:00
|
|
|
return true;
|
|
|
|
}
|
2015-08-01 03:45:25 +08:00
|
|
|
|
2016-06-30 02:32:49 +08:00
|
|
|
bool Service::ParseCritical(const std::vector<std::string>& args, std::string* err) {
|
2015-08-27 02:43:36 +08:00
|
|
|
flags_ |= SVC_CRITICAL;
|
|
|
|
return true;
|
|
|
|
}
|
2015-08-01 03:45:25 +08:00
|
|
|
|
2016-06-30 02:32:49 +08:00
|
|
|
bool Service::ParseDisabled(const std::vector<std::string>& args, std::string* err) {
|
2015-08-27 02:43:36 +08:00
|
|
|
flags_ |= SVC_DISABLED;
|
|
|
|
flags_ |= SVC_RC_DISABLED;
|
|
|
|
return true;
|
|
|
|
}
|
2015-08-01 03:45:25 +08:00
|
|
|
|
2016-06-30 02:32:49 +08:00
|
|
|
bool Service::ParseGroup(const std::vector<std::string>& args, std::string* err) {
|
2017-05-05 08:40:33 +08:00
|
|
|
std::string decode_uid_err;
|
|
|
|
if (!DecodeUid(args[1], &gid_, &decode_uid_err)) {
|
|
|
|
*err = "Unable to find GID for '" + args[1] + "': " + decode_uid_err;
|
|
|
|
return false;
|
|
|
|
}
|
2015-08-27 02:43:36 +08:00
|
|
|
for (std::size_t n = 2; n < args.size(); n++) {
|
2017-05-05 08:40:33 +08:00
|
|
|
gid_t gid;
|
|
|
|
if (!DecodeUid(args[n], &gid, &decode_uid_err)) {
|
|
|
|
*err = "Unable to find GID for '" + args[n] + "': " + decode_uid_err;
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
supp_gids_.emplace_back(gid);
|
2015-08-27 02:43:36 +08:00
|
|
|
}
|
|
|
|
return true;
|
|
|
|
}
|
2015-08-01 03:45:25 +08:00
|
|
|
|
2016-06-30 02:32:49 +08:00
|
|
|
bool Service::ParsePriority(const std::vector<std::string>& args, std::string* err) {
|
2016-10-12 08:09:00 +08:00
|
|
|
priority_ = 0;
|
|
|
|
if (!ParseInt(args[1], &priority_,
|
2016-11-12 10:06:31 +08:00
|
|
|
static_cast<int>(ANDROID_PRIORITY_HIGHEST), // highest is negative
|
|
|
|
static_cast<int>(ANDROID_PRIORITY_LOWEST))) {
|
2016-05-19 08:36:30 +08:00
|
|
|
*err = StringPrintf("process priority value must be range %d - %d",
|
|
|
|
ANDROID_PRIORITY_HIGHEST, ANDROID_PRIORITY_LOWEST);
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2016-06-30 02:32:49 +08:00
|
|
|
bool Service::ParseIoprio(const std::vector<std::string>& args, std::string* err) {
|
2016-10-12 08:09:00 +08:00
|
|
|
if (!ParseInt(args[2], &ioprio_pri_, 0, 7)) {
|
2015-08-27 02:43:36 +08:00
|
|
|
*err = "priority value must be range 0 - 7";
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (args[1] == "rt") {
|
|
|
|
ioprio_class_ = IoSchedClass_RT;
|
|
|
|
} else if (args[1] == "be") {
|
|
|
|
ioprio_class_ = IoSchedClass_BE;
|
|
|
|
} else if (args[1] == "idle") {
|
|
|
|
ioprio_class_ = IoSchedClass_IDLE;
|
|
|
|
} else {
|
|
|
|
*err = "ioprio option usage: ioprio <rt|be|idle> <0-7>";
|
|
|
|
return false;
|
2015-08-01 03:45:25 +08:00
|
|
|
}
|
|
|
|
|
2015-08-27 02:43:36 +08:00
|
|
|
return true;
|
|
|
|
}
|
2015-08-01 03:45:25 +08:00
|
|
|
|
2016-06-30 02:32:49 +08:00
|
|
|
bool Service::ParseKeycodes(const std::vector<std::string>& args, std::string* err) {
|
2015-08-27 02:43:36 +08:00
|
|
|
for (std::size_t i = 1; i < args.size(); i++) {
|
2016-10-12 08:09:00 +08:00
|
|
|
int code;
|
|
|
|
if (ParseInt(args[i], &code)) {
|
|
|
|
keycodes_.emplace_back(code);
|
|
|
|
} else {
|
|
|
|
LOG(WARNING) << "ignoring invalid keycode: " << args[i];
|
|
|
|
}
|
2015-08-01 03:45:25 +08:00
|
|
|
}
|
2015-08-27 02:43:36 +08:00
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2016-06-30 02:32:49 +08:00
|
|
|
bool Service::ParseOneshot(const std::vector<std::string>& args, std::string* err) {
|
2015-08-27 02:43:36 +08:00
|
|
|
flags_ |= SVC_ONESHOT;
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2016-06-30 02:32:49 +08:00
|
|
|
bool Service::ParseOnrestart(const std::vector<std::string>& args, std::string* err) {
|
2015-08-27 02:43:36 +08:00
|
|
|
std::vector<std::string> str_args(args.begin() + 1, args.end());
|
init: Stop combining actions
In the past, I had thought it didn't make sense to have multiple
Action classes with identical triggers within ActionManager::actions_,
and opted to instead combine these into a single action. In theory,
it should reduce memory overhead as only one copy of the triggers
needs to be stored.
In practice, this ends up not being a good idea.
Most importantly, given a file with the below three sections in this
same order:
on boot
setprop a b
on boot && property:true=true
setprop c d
on boot
setprop e f
Assuming that property 'true' == 'true', when the `boot` event
happens, the order of the setprop commands will actually be:
setprop a b
setprop e f
setprop c d
instead of the more intuitive order of:
setprop a b
setprop c d
setprop e f
This is a mistake and this CL fixes it. It also documents this order.
Secondly, with a given 'Action' now spanning multiple files, in order
to keep track of which file a command is run from, the 'Command'
itself needs to store this. Ironically to the original intention,
this increases total ram usage. This change now only stores the file
name in each 'Action' instead of each 'Command'. All in all this is a
negligible trade off of ram usage.
Thirdly, this requires a bunch of extra code and assumptions that
don't help anything else. In particular it forces to keep property triggers
sorted for easy comparison, which I'm using an std::map for currently,
but that is not the best data structure to contain them.
Lastly, I added the filename and line number to the 'processing
action' LOG(INFO) message.
Test: Boot bullhead, observe above changes
Test: Boot sailfish, observe no change in boot time
Change-Id: I3fbcac4ee677351314e33012c758145be82346e9
2017-04-19 04:21:54 +08:00
|
|
|
int line = onrestart_.NumCommands() + 1;
|
|
|
|
onrestart_.AddCommand(str_args, line, err);
|
2015-08-27 02:43:36 +08:00
|
|
|
return true;
|
|
|
|
}
|
2015-08-01 03:45:25 +08:00
|
|
|
|
2016-06-30 02:32:49 +08:00
|
|
|
bool Service::ParseNamespace(const std::vector<std::string>& args, std::string* err) {
|
2016-04-22 06:35:09 +08:00
|
|
|
for (size_t i = 1; i < args.size(); i++) {
|
|
|
|
if (args[i] == "pid") {
|
|
|
|
namespace_flags_ |= CLONE_NEWPID;
|
|
|
|
// PID namespaces require mount namespaces.
|
|
|
|
namespace_flags_ |= CLONE_NEWNS;
|
|
|
|
} else if (args[i] == "mnt") {
|
|
|
|
namespace_flags_ |= CLONE_NEWNS;
|
|
|
|
} else {
|
|
|
|
*err = "namespace must be 'pid' or 'mnt'";
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2016-07-23 03:07:06 +08:00
|
|
|
bool Service::ParseOomScoreAdjust(const std::vector<std::string>& args, std::string* err) {
|
2016-10-12 08:09:00 +08:00
|
|
|
if (!ParseInt(args[1], &oom_score_adjust_, -1000, 1000)) {
|
2016-07-23 03:07:06 +08:00
|
|
|
*err = "oom_score_adjust value must be in range -1000 - +1000";
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2016-06-30 02:32:49 +08:00
|
|
|
bool Service::ParseSeclabel(const std::vector<std::string>& args, std::string* err) {
|
2015-08-27 02:43:36 +08:00
|
|
|
seclabel_ = args[1];
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2016-06-30 02:32:49 +08:00
|
|
|
bool Service::ParseSetenv(const std::vector<std::string>& args, std::string* err) {
|
2015-08-27 02:43:36 +08:00
|
|
|
envvars_.emplace_back(args[1], args[2]);
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2017-07-06 02:38:44 +08:00
|
|
|
bool Service::ParseShutdown(const std::vector<std::string>& args, std::string* err) {
|
|
|
|
if (args[1] == "critical") {
|
|
|
|
flags_ |= SVC_SHUTDOWN_CRITICAL;
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2016-10-27 22:45:34 +08:00
|
|
|
template <typename T>
|
|
|
|
bool Service::AddDescriptor(const std::vector<std::string>& args, std::string* err) {
|
|
|
|
int perm = args.size() > 3 ? std::strtoul(args[3].c_str(), 0, 8) : -1;
|
2017-05-05 08:40:33 +08:00
|
|
|
uid_t uid = 0;
|
|
|
|
gid_t gid = 0;
|
2016-10-27 22:45:34 +08:00
|
|
|
std::string context = args.size() > 6 ? args[6] : "";
|
|
|
|
|
2017-05-05 08:40:33 +08:00
|
|
|
std::string decode_uid_err;
|
|
|
|
if (args.size() > 4) {
|
|
|
|
if (!DecodeUid(args[4], &uid, &decode_uid_err)) {
|
|
|
|
*err = "Unable to find UID for '" + args[4] + "': " + decode_uid_err;
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (args.size() > 5) {
|
|
|
|
if (!DecodeUid(args[5], &gid, &decode_uid_err)) {
|
|
|
|
*err = "Unable to find GID for '" + args[5] + "': " + decode_uid_err;
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-10-27 22:45:34 +08:00
|
|
|
auto descriptor = std::make_unique<T>(args[1], args[2], uid, gid, perm, context);
|
|
|
|
|
|
|
|
auto old =
|
|
|
|
std::find_if(descriptors_.begin(), descriptors_.end(),
|
|
|
|
[&descriptor] (const auto& other) { return descriptor.get() == other.get(); });
|
|
|
|
|
|
|
|
if (old != descriptors_.end()) {
|
|
|
|
*err = "duplicate descriptor " + args[1] + " " + args[2];
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
descriptors_.emplace_back(std::move(descriptor));
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
// name type perm [ uid gid context ]
|
2016-06-30 02:32:49 +08:00
|
|
|
bool Service::ParseSocket(const std::vector<std::string>& args, std::string* err) {
|
2017-06-23 03:53:17 +08:00
|
|
|
if (!StartsWith(args[2], "dgram") && !StartsWith(args[2], "stream") &&
|
|
|
|
!StartsWith(args[2], "seqpacket")) {
|
2015-08-27 02:43:36 +08:00
|
|
|
*err = "socket type must be 'dgram', 'stream' or 'seqpacket'";
|
2015-08-01 03:45:25 +08:00
|
|
|
return false;
|
|
|
|
}
|
2016-10-27 22:45:34 +08:00
|
|
|
return AddDescriptor<SocketInfo>(args, err);
|
|
|
|
}
|
2015-08-27 02:43:36 +08:00
|
|
|
|
2016-10-27 22:45:34 +08:00
|
|
|
// name type perm [ uid gid context ]
|
|
|
|
bool Service::ParseFile(const std::vector<std::string>& args, std::string* err) {
|
|
|
|
if (args[2] != "r" && args[2] != "w" && args[2] != "rw") {
|
|
|
|
*err = "file type must be 'r', 'w' or 'rw'";
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
if ((args[1][0] != '/') || (args[1].find("../") != std::string::npos)) {
|
|
|
|
*err = "file name must not be relative";
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
return AddDescriptor<FileInfo>(args, err);
|
2015-08-01 03:45:25 +08:00
|
|
|
}
|
|
|
|
|
2016-06-30 02:32:49 +08:00
|
|
|
bool Service::ParseUser(const std::vector<std::string>& args, std::string* err) {
|
2017-05-05 08:40:33 +08:00
|
|
|
std::string decode_uid_err;
|
|
|
|
if (!DecodeUid(args[1], &uid_, &decode_uid_err)) {
|
|
|
|
*err = "Unable to find UID for '" + args[1] + "': " + decode_uid_err;
|
|
|
|
return false;
|
|
|
|
}
|
2015-08-27 02:43:36 +08:00
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2016-06-30 02:32:49 +08:00
|
|
|
bool Service::ParseWritepid(const std::vector<std::string>& args, std::string* err) {
|
2015-08-27 02:43:36 +08:00
|
|
|
writepid_files_.assign(args.begin() + 1, args.end());
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2016-06-30 02:32:49 +08:00
|
|
|
class Service::OptionParserMap : public KeywordMap<OptionParser> {
|
2017-04-20 07:18:50 +08:00
|
|
|
public:
|
|
|
|
OptionParserMap() {}
|
|
|
|
|
|
|
|
private:
|
|
|
|
const Map& map() const override;
|
2015-08-27 02:43:36 +08:00
|
|
|
};
|
|
|
|
|
2017-04-20 07:18:50 +08:00
|
|
|
const Service::OptionParserMap::Map& Service::OptionParserMap::map() const {
|
2015-08-27 02:43:36 +08:00
|
|
|
constexpr std::size_t kMax = std::numeric_limits<std::size_t>::max();
|
2017-03-28 01:59:11 +08:00
|
|
|
// clang-format off
|
2016-06-30 02:32:49 +08:00
|
|
|
static const Map option_parsers = {
|
init: Add support for ambient capabilities.
Ambient capabilities are inherited in a straightforward way across
execve(2):
"
If you are nonroot but you have a capability, you can add it to pA.
If you do so, your children get that capability in pA, pP, and pE.
For example, you can set pA = CAP_NET_BIND_SERVICE, and your
children can automatically bind low-numbered ports.
"
This will allow us to get rid of the special meaning for AID_NET_ADMIN
and AID_NET_RAW, and if desired, to reduce the use of file capabilities
(which grant capabilities to any process that can execute the file). An
additional benefit of the latter is that a single .rc file can specify
all properties for a service, without having to rely on a separate file
for file capabilities.
Ambient capabilities are supported starting with kernel 4.3 and have
been backported to all Android common kernels back to 3.10.
I chose to not use Minijail here (though I'm still using libcap) for
two reasons:
1-The Minijail code is designed to work in situations where the process
is holding any set of capabilities, so it's more complex. The situation
when forking from init allows for simpler code.
2-The way Minijail is structured right now, we would not be able to
make the required SELinux calls between UID/GID dropping and other priv
dropping code. In the future, it will make sense to add some sort of
"hook" to Minijail so that it can be used in situations where we want
to do other operations between some of the privilege-dropping
operations carried out by Minijail.
Bug: 32438163
Test: Use sample service.
Change-Id: I3226cc95769d1beacbae619cb6c6e6a5425890fb
2016-10-27 22:33:03 +08:00
|
|
|
{"capabilities",
|
|
|
|
{1, kMax, &Service::ParseCapabilities}},
|
2017-03-28 01:59:11 +08:00
|
|
|
{"class", {1, kMax, &Service::ParseClass}},
|
2016-06-30 02:32:49 +08:00
|
|
|
{"console", {0, 1, &Service::ParseConsole}},
|
|
|
|
{"critical", {0, 0, &Service::ParseCritical}},
|
|
|
|
{"disabled", {0, 0, &Service::ParseDisabled}},
|
|
|
|
{"group", {1, NR_SVC_SUPP_GIDS + 1, &Service::ParseGroup}},
|
|
|
|
{"ioprio", {2, 2, &Service::ParseIoprio}},
|
|
|
|
{"priority", {1, 1, &Service::ParsePriority}},
|
|
|
|
{"keycodes", {1, kMax, &Service::ParseKeycodes}},
|
|
|
|
{"oneshot", {0, 0, &Service::ParseOneshot}},
|
|
|
|
{"onrestart", {1, kMax, &Service::ParseOnrestart}},
|
2016-07-23 03:07:06 +08:00
|
|
|
{"oom_score_adjust",
|
|
|
|
{1, 1, &Service::ParseOomScoreAdjust}},
|
2016-06-30 02:32:49 +08:00
|
|
|
{"namespace", {1, 2, &Service::ParseNamespace}},
|
|
|
|
{"seclabel", {1, 1, &Service::ParseSeclabel}},
|
|
|
|
{"setenv", {2, 2, &Service::ParseSetenv}},
|
2017-07-06 02:38:44 +08:00
|
|
|
{"shutdown", {1, 1, &Service::ParseShutdown}},
|
2016-06-30 02:32:49 +08:00
|
|
|
{"socket", {3, 6, &Service::ParseSocket}},
|
2016-12-03 00:05:22 +08:00
|
|
|
{"file", {2, 2, &Service::ParseFile}},
|
2016-06-30 02:32:49 +08:00
|
|
|
{"user", {1, 1, &Service::ParseUser}},
|
|
|
|
{"writepid", {1, kMax, &Service::ParseWritepid}},
|
2015-08-27 02:43:36 +08:00
|
|
|
};
|
2017-03-28 01:59:11 +08:00
|
|
|
// clang-format on
|
2016-06-30 02:32:49 +08:00
|
|
|
return option_parsers;
|
2015-08-27 02:43:36 +08:00
|
|
|
}
|
|
|
|
|
2016-06-30 02:32:49 +08:00
|
|
|
bool Service::ParseLine(const std::vector<std::string>& args, std::string* err) {
|
|
|
|
static const OptionParserMap parser_map;
|
2017-04-25 07:59:05 +08:00
|
|
|
auto parser = parser_map.FindFunction(args, err);
|
2015-08-27 02:43:36 +08:00
|
|
|
|
2016-06-30 02:32:49 +08:00
|
|
|
if (!parser) {
|
2015-08-27 02:43:36 +08:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2016-06-30 02:32:49 +08:00
|
|
|
return (this->*parser)(args, err);
|
2015-08-27 02:43:36 +08:00
|
|
|
}
|
|
|
|
|
2017-03-28 07:27:30 +08:00
|
|
|
bool Service::ExecStart(std::unique_ptr<Timer>* exec_waiter) {
|
|
|
|
flags_ |= SVC_EXEC | SVC_ONESHOT;
|
|
|
|
|
|
|
|
exec_waiter->reset(new Timer);
|
|
|
|
|
|
|
|
if (!Start()) {
|
|
|
|
exec_waiter->reset();
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2016-04-13 06:38:27 +08:00
|
|
|
bool Service::Start() {
|
2015-08-01 03:45:25 +08:00
|
|
|
// Starting a service removes it from the disabled or reset state and
|
|
|
|
// immediately takes it out of the restarting state if it was in there.
|
|
|
|
flags_ &= (~(SVC_DISABLED|SVC_RESTARTING|SVC_RESET|SVC_RESTART|SVC_DISABLED_START));
|
|
|
|
|
|
|
|
// Running processes require no additional work --- if they're in the
|
|
|
|
// process of exiting, we've ensured that they will immediately restart
|
|
|
|
// on exit, unless they are ONESHOT.
|
|
|
|
if (flags_ & SVC_RUNNING) {
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
bool needs_console = (flags_ & SVC_CONSOLE);
|
2016-03-21 16:08:07 +08:00
|
|
|
if (needs_console) {
|
|
|
|
if (console_.empty()) {
|
|
|
|
console_ = default_console;
|
|
|
|
}
|
|
|
|
|
2016-12-21 07:52:15 +08:00
|
|
|
// Make sure that open call succeeds to ensure a console driver is
|
|
|
|
// properly registered for the device node
|
|
|
|
int console_fd = open(console_.c_str(), O_RDWR | O_CLOEXEC);
|
|
|
|
if (console_fd < 0) {
|
|
|
|
PLOG(ERROR) << "service '" << name_ << "' couldn't open console '" << console_ << "'";
|
2016-03-21 16:08:07 +08:00
|
|
|
flags_ |= SVC_DISABLED;
|
|
|
|
return false;
|
|
|
|
}
|
2016-12-21 07:52:15 +08:00
|
|
|
close(console_fd);
|
2015-08-01 03:45:25 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
struct stat sb;
|
|
|
|
if (stat(args_[0].c_str(), &sb) == -1) {
|
2016-06-25 06:12:21 +08:00
|
|
|
PLOG(ERROR) << "cannot find '" << args_[0] << "', disabling '" << name_ << "'";
|
2015-08-01 03:45:25 +08:00
|
|
|
flags_ |= SVC_DISABLED;
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
std::string scon;
|
|
|
|
if (!seclabel_.empty()) {
|
|
|
|
scon = seclabel_;
|
|
|
|
} else {
|
2016-07-09 01:32:26 +08:00
|
|
|
scon = ComputeContextFromExecutable(name_, args_[0]);
|
|
|
|
if (scon == "") {
|
2015-08-01 03:45:25 +08:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-10-05 05:05:39 +08:00
|
|
|
LOG(INFO) << "starting service '" << name_ << "'...";
|
2015-08-01 03:45:25 +08:00
|
|
|
|
2016-04-22 06:35:09 +08:00
|
|
|
pid_t pid = -1;
|
|
|
|
if (namespace_flags_) {
|
2016-07-09 01:32:26 +08:00
|
|
|
pid = clone(nullptr, nullptr, namespace_flags_ | SIGCHLD, nullptr);
|
2016-04-22 06:35:09 +08:00
|
|
|
} else {
|
|
|
|
pid = fork();
|
|
|
|
}
|
|
|
|
|
2015-08-01 03:45:25 +08:00
|
|
|
if (pid == 0) {
|
|
|
|
umask(077);
|
|
|
|
|
2016-04-22 06:35:09 +08:00
|
|
|
if (namespace_flags_ & CLONE_NEWPID) {
|
|
|
|
// This will fork again to run an init process inside the PID
|
|
|
|
// namespace.
|
|
|
|
SetUpPidNamespace(name_);
|
|
|
|
}
|
|
|
|
|
2015-08-01 03:45:25 +08:00
|
|
|
for (const auto& ei : envvars_) {
|
|
|
|
add_environment(ei.name.c_str(), ei.value.c_str());
|
|
|
|
}
|
|
|
|
|
2016-10-27 22:45:34 +08:00
|
|
|
std::for_each(descriptors_.begin(), descriptors_.end(),
|
|
|
|
std::bind(&DescriptorInfo::CreateAndPublish, std::placeholders::_1, scon));
|
2015-08-01 03:45:25 +08:00
|
|
|
|
2016-05-04 03:00:00 +08:00
|
|
|
// See if there were "writepid" instructions to write to files under /dev/cpuset/.
|
|
|
|
auto cpuset_predicate = [](const std::string& path) {
|
2017-06-23 03:53:17 +08:00
|
|
|
return StartsWith(path, "/dev/cpuset/");
|
2016-05-04 03:00:00 +08:00
|
|
|
};
|
|
|
|
auto iter = std::find_if(writepid_files_.begin(), writepid_files_.end(), cpuset_predicate);
|
|
|
|
if (iter == writepid_files_.end()) {
|
|
|
|
// There were no "writepid" instructions for cpusets, check if the system default
|
|
|
|
// cpuset is specified to be used for the process.
|
2017-06-23 03:53:17 +08:00
|
|
|
std::string default_cpuset = GetProperty("ro.cpuset.default", "");
|
2016-05-04 03:00:00 +08:00
|
|
|
if (!default_cpuset.empty()) {
|
|
|
|
// Make sure the cpuset name starts and ends with '/'.
|
|
|
|
// A single '/' means the 'root' cpuset.
|
|
|
|
if (default_cpuset.front() != '/') {
|
|
|
|
default_cpuset.insert(0, 1, '/');
|
|
|
|
}
|
|
|
|
if (default_cpuset.back() != '/') {
|
|
|
|
default_cpuset.push_back('/');
|
|
|
|
}
|
|
|
|
writepid_files_.push_back(
|
|
|
|
StringPrintf("/dev/cpuset%stasks", default_cpuset.c_str()));
|
|
|
|
}
|
|
|
|
}
|
2017-06-23 07:50:31 +08:00
|
|
|
std::string pid_str = std::to_string(getpid());
|
2015-08-01 03:45:25 +08:00
|
|
|
for (const auto& file : writepid_files_) {
|
2015-08-27 02:43:36 +08:00
|
|
|
if (!WriteStringToFile(pid_str, file)) {
|
2016-06-25 06:12:21 +08:00
|
|
|
PLOG(ERROR) << "couldn't write " << pid_str << " to " << file;
|
2015-08-01 03:45:25 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (ioprio_class_ != IoSchedClass_NONE) {
|
|
|
|
if (android_set_ioprio(getpid(), ioprio_class_, ioprio_pri_)) {
|
2016-07-09 01:32:26 +08:00
|
|
|
PLOG(ERROR) << "failed to set pid " << getpid()
|
2016-06-25 06:12:21 +08:00
|
|
|
<< " ioprio=" << ioprio_class_ << "," << ioprio_pri_;
|
2015-08-01 03:45:25 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (needs_console) {
|
|
|
|
setsid();
|
|
|
|
OpenConsole();
|
|
|
|
} else {
|
|
|
|
ZapStdio();
|
|
|
|
}
|
|
|
|
|
2016-07-09 01:32:26 +08:00
|
|
|
// As requested, set our gid, supplemental gids, uid, context, and
|
|
|
|
// priority. Aborts on failure.
|
|
|
|
SetProcessAttributes();
|
2015-08-01 03:45:25 +08:00
|
|
|
|
|
|
|
std::vector<char*> strs;
|
2016-07-09 01:32:26 +08:00
|
|
|
ExpandArgs(args_, &strs);
|
2016-06-08 02:22:00 +08:00
|
|
|
if (execve(strs[0], (char**) &strs[0], (char**) ENV) < 0) {
|
2016-06-25 06:12:21 +08:00
|
|
|
PLOG(ERROR) << "cannot execve('" << strs[0] << "')";
|
2015-08-01 03:45:25 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
_exit(127);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (pid < 0) {
|
2016-06-25 06:12:21 +08:00
|
|
|
PLOG(ERROR) << "failed to fork for '" << name_ << "'";
|
2015-08-01 03:45:25 +08:00
|
|
|
pid_ = 0;
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2016-07-23 03:07:06 +08:00
|
|
|
if (oom_score_adjust_ != -1000) {
|
2017-06-23 07:50:31 +08:00
|
|
|
std::string oom_str = std::to_string(oom_score_adjust_);
|
2016-07-23 03:07:06 +08:00
|
|
|
std::string oom_file = StringPrintf("/proc/%d/oom_score_adj", pid);
|
|
|
|
if (!WriteStringToFile(oom_str, oom_file)) {
|
|
|
|
PLOG(ERROR) << "couldn't write oom_score_adj: " << strerror(errno);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-11-11 09:43:47 +08:00
|
|
|
time_started_ = boot_clock::now();
|
2015-08-01 03:45:25 +08:00
|
|
|
pid_ = pid;
|
|
|
|
flags_ |= SVC_RUNNING;
|
2017-05-05 02:32:36 +08:00
|
|
|
process_cgroup_empty_ = false;
|
2016-06-16 05:49:57 +08:00
|
|
|
|
|
|
|
errno = -createProcessGroup(uid_, pid_);
|
|
|
|
if (errno != 0) {
|
2016-07-09 01:32:26 +08:00
|
|
|
PLOG(ERROR) << "createProcessGroup(" << uid_ << ", " << pid_ << ") failed for service '"
|
|
|
|
<< name_ << "'";
|
2016-06-16 05:49:57 +08:00
|
|
|
}
|
2015-08-01 03:45:25 +08:00
|
|
|
|
|
|
|
if ((flags_ & SVC_EXEC) != 0) {
|
2017-06-23 07:50:31 +08:00
|
|
|
LOG(INFO) << "SVC_EXEC pid " << pid_ << " (uid " << uid_ << " gid " << gid_ << "+"
|
|
|
|
<< supp_gids_.size() << " context "
|
|
|
|
<< (!seclabel_.empty() ? seclabel_ : "default") << ") started; waiting...";
|
2015-08-01 03:45:25 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
NotifyStateChange("running");
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
bool Service::StartIfNotDisabled() {
|
|
|
|
if (!(flags_ & SVC_DISABLED)) {
|
|
|
|
return Start();
|
|
|
|
} else {
|
|
|
|
flags_ |= SVC_DISABLED_START;
|
|
|
|
}
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
bool Service::Enable() {
|
|
|
|
flags_ &= ~(SVC_DISABLED | SVC_RC_DISABLED);
|
|
|
|
if (flags_ & SVC_DISABLED_START) {
|
|
|
|
return Start();
|
|
|
|
}
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
void Service::Reset() {
|
|
|
|
StopOrReset(SVC_RESET);
|
|
|
|
}
|
|
|
|
|
|
|
|
void Service::Stop() {
|
|
|
|
StopOrReset(SVC_DISABLED);
|
|
|
|
}
|
|
|
|
|
2015-12-19 03:39:59 +08:00
|
|
|
void Service::Terminate() {
|
|
|
|
flags_ &= ~(SVC_RESTARTING | SVC_DISABLED_START);
|
|
|
|
flags_ |= SVC_DISABLED;
|
|
|
|
if (pid_) {
|
2016-06-16 05:49:57 +08:00
|
|
|
KillProcessGroup(SIGTERM);
|
2015-12-19 03:39:59 +08:00
|
|
|
NotifyStateChange("stopping");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-08-01 03:45:25 +08:00
|
|
|
void Service::Restart() {
|
|
|
|
if (flags_ & SVC_RUNNING) {
|
|
|
|
/* Stop, wait, then start the service. */
|
|
|
|
StopOrReset(SVC_RESTART);
|
|
|
|
} else if (!(flags_ & SVC_RESTARTING)) {
|
|
|
|
/* Just start the service since it's not running. */
|
|
|
|
Start();
|
|
|
|
} /* else: Service is restarting anyways. */
|
|
|
|
}
|
|
|
|
|
2016-11-11 09:43:47 +08:00
|
|
|
void Service::RestartIfNeeded(time_t* process_needs_restart_at) {
|
|
|
|
boot_clock::time_point now = boot_clock::now();
|
|
|
|
boot_clock::time_point next_start = time_started_ + 5s;
|
|
|
|
if (now > next_start) {
|
2015-08-01 03:45:25 +08:00
|
|
|
flags_ &= (~SVC_RESTARTING);
|
|
|
|
Start();
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2016-11-11 09:43:47 +08:00
|
|
|
time_t next_start_time_t = time(nullptr) +
|
|
|
|
time_t(std::chrono::duration_cast<std::chrono::seconds>(next_start - now).count());
|
|
|
|
if (next_start_time_t < *process_needs_restart_at || *process_needs_restart_at == 0) {
|
|
|
|
*process_needs_restart_at = next_start_time_t;
|
2015-08-01 03:45:25 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-06-16 05:49:57 +08:00
|
|
|
// The how field should be either SVC_DISABLED, SVC_RESET, or SVC_RESTART.
|
2015-08-01 03:45:25 +08:00
|
|
|
void Service::StopOrReset(int how) {
|
2016-06-16 05:49:57 +08:00
|
|
|
// The service is still SVC_RUNNING until its process exits, but if it has
|
|
|
|
// already exited it shoudn't attempt a restart yet.
|
2015-08-01 03:45:25 +08:00
|
|
|
flags_ &= ~(SVC_RESTARTING | SVC_DISABLED_START);
|
|
|
|
|
|
|
|
if ((how != SVC_DISABLED) && (how != SVC_RESET) && (how != SVC_RESTART)) {
|
2016-06-16 05:49:57 +08:00
|
|
|
// An illegal flag: default to SVC_DISABLED.
|
2015-08-01 03:45:25 +08:00
|
|
|
how = SVC_DISABLED;
|
|
|
|
}
|
2016-06-16 05:49:57 +08:00
|
|
|
|
|
|
|
// If the service has not yet started, prevent it from auto-starting with its class.
|
2015-08-01 03:45:25 +08:00
|
|
|
if (how == SVC_RESET) {
|
|
|
|
flags_ |= (flags_ & SVC_RC_DISABLED) ? SVC_DISABLED : SVC_RESET;
|
|
|
|
} else {
|
|
|
|
flags_ |= how;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (pid_) {
|
2016-06-16 05:49:57 +08:00
|
|
|
KillProcessGroup(SIGKILL);
|
2015-08-01 03:45:25 +08:00
|
|
|
NotifyStateChange("stopping");
|
|
|
|
} else {
|
|
|
|
NotifyStateChange("stopped");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
void Service::ZapStdio() const {
|
|
|
|
int fd;
|
|
|
|
fd = open("/dev/null", O_RDWR);
|
|
|
|
dup2(fd, 0);
|
|
|
|
dup2(fd, 1);
|
|
|
|
dup2(fd, 2);
|
|
|
|
close(fd);
|
|
|
|
}
|
|
|
|
|
|
|
|
void Service::OpenConsole() const {
|
2016-03-21 16:08:07 +08:00
|
|
|
int fd = open(console_.c_str(), O_RDWR);
|
|
|
|
if (fd == -1) fd = open("/dev/null", O_RDWR);
|
2015-08-01 03:45:25 +08:00
|
|
|
ioctl(fd, TIOCSCTTY, 0);
|
|
|
|
dup2(fd, 0);
|
|
|
|
dup2(fd, 1);
|
|
|
|
dup2(fd, 2);
|
|
|
|
close(fd);
|
|
|
|
}
|
|
|
|
|
|
|
|
int ServiceManager::exec_count_ = 0;
|
|
|
|
|
|
|
|
ServiceManager::ServiceManager() {
|
|
|
|
}
|
|
|
|
|
|
|
|
ServiceManager& ServiceManager::GetInstance() {
|
|
|
|
static ServiceManager instance;
|
|
|
|
return instance;
|
|
|
|
}
|
|
|
|
|
2015-08-27 02:43:36 +08:00
|
|
|
void ServiceManager::AddService(std::unique_ptr<Service> service) {
|
|
|
|
services_.emplace_back(std::move(service));
|
2015-08-01 03:45:25 +08:00
|
|
|
}
|
|
|
|
|
2017-03-28 07:27:30 +08:00
|
|
|
bool ServiceManager::Exec(const std::vector<std::string>& args) {
|
|
|
|
Service* svc = MakeExecOneshotService(args);
|
|
|
|
if (!svc) {
|
|
|
|
LOG(ERROR) << "Could not create exec service";
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
if (!svc->ExecStart(&exec_waiter_)) {
|
|
|
|
LOG(ERROR) << "Could not start exec service";
|
|
|
|
ServiceManager::GetInstance().RemoveService(*svc);
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
bool ServiceManager::ExecStart(const std::string& name) {
|
|
|
|
Service* svc = FindServiceByName(name);
|
|
|
|
if (!svc) {
|
|
|
|
LOG(ERROR) << "ExecStart(" << name << "): Service not found";
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
if (!svc->ExecStart(&exec_waiter_)) {
|
|
|
|
LOG(ERROR) << "ExecStart(" << name << "): Could not start Service";
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
bool ServiceManager::IsWaitingForExec() const { return exec_waiter_ != nullptr; }
|
|
|
|
|
2015-08-01 03:45:25 +08:00
|
|
|
Service* ServiceManager::MakeExecOneshotService(const std::vector<std::string>& args) {
|
|
|
|
// Parse the arguments: exec [SECLABEL [UID [GID]*] --] COMMAND ARGS...
|
|
|
|
// SECLABEL can be a - to denote default
|
|
|
|
std::size_t command_arg = 1;
|
|
|
|
for (std::size_t i = 1; i < args.size(); ++i) {
|
|
|
|
if (args[i] == "--") {
|
|
|
|
command_arg = i + 1;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (command_arg > 4 + NR_SVC_SUPP_GIDS) {
|
2016-06-25 06:12:21 +08:00
|
|
|
LOG(ERROR) << "exec called with too many supplementary group ids";
|
2015-08-01 03:45:25 +08:00
|
|
|
return nullptr;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (command_arg >= args.size()) {
|
2016-06-25 06:12:21 +08:00
|
|
|
LOG(ERROR) << "exec called without command";
|
2015-08-01 03:45:25 +08:00
|
|
|
return nullptr;
|
|
|
|
}
|
|
|
|
std::vector<std::string> str_args(args.begin() + command_arg, args.end());
|
|
|
|
|
|
|
|
exec_count_++;
|
2017-06-23 03:53:17 +08:00
|
|
|
std::string name = "exec " + std::to_string(exec_count_) + " (" + Join(str_args, " ") + ")";
|
2017-04-26 08:31:06 +08:00
|
|
|
|
2017-03-28 07:27:30 +08:00
|
|
|
unsigned flags = SVC_EXEC | SVC_ONESHOT | SVC_TEMPORARY;
|
init: Add support for ambient capabilities.
Ambient capabilities are inherited in a straightforward way across
execve(2):
"
If you are nonroot but you have a capability, you can add it to pA.
If you do so, your children get that capability in pA, pP, and pE.
For example, you can set pA = CAP_NET_BIND_SERVICE, and your
children can automatically bind low-numbered ports.
"
This will allow us to get rid of the special meaning for AID_NET_ADMIN
and AID_NET_RAW, and if desired, to reduce the use of file capabilities
(which grant capabilities to any process that can execute the file). An
additional benefit of the latter is that a single .rc file can specify
all properties for a service, without having to rely on a separate file
for file capabilities.
Ambient capabilities are supported starting with kernel 4.3 and have
been backported to all Android common kernels back to 3.10.
I chose to not use Minijail here (though I'm still using libcap) for
two reasons:
1-The Minijail code is designed to work in situations where the process
is holding any set of capabilities, so it's more complex. The situation
when forking from init allows for simpler code.
2-The way Minijail is structured right now, we would not be able to
make the required SELinux calls between UID/GID dropping and other priv
dropping code. In the future, it will make sense to add some sort of
"hook" to Minijail so that it can be used in situations where we want
to do other operations between some of the privilege-dropping
operations carried out by Minijail.
Bug: 32438163
Test: Use sample service.
Change-Id: I3226cc95769d1beacbae619cb6c6e6a5425890fb
2016-10-27 22:33:03 +08:00
|
|
|
CapSet no_capabilities;
|
2016-04-22 06:35:09 +08:00
|
|
|
unsigned namespace_flags = 0;
|
2015-08-01 03:45:25 +08:00
|
|
|
|
|
|
|
std::string seclabel = "";
|
|
|
|
if (command_arg > 2 && args[1] != "-") {
|
|
|
|
seclabel = args[1];
|
|
|
|
}
|
|
|
|
uid_t uid = 0;
|
|
|
|
if (command_arg > 3) {
|
2017-05-05 08:40:33 +08:00
|
|
|
std::string decode_uid_err;
|
|
|
|
if (!DecodeUid(args[2], &uid, &decode_uid_err)) {
|
|
|
|
LOG(ERROR) << "Unable to find UID for '" << args[2] << "': " << decode_uid_err;
|
|
|
|
return nullptr;
|
|
|
|
}
|
2015-08-01 03:45:25 +08:00
|
|
|
}
|
|
|
|
gid_t gid = 0;
|
|
|
|
std::vector<gid_t> supp_gids;
|
|
|
|
if (command_arg > 4) {
|
2017-05-05 08:40:33 +08:00
|
|
|
std::string decode_uid_err;
|
|
|
|
if (!DecodeUid(args[3], &gid, &decode_uid_err)) {
|
|
|
|
LOG(ERROR) << "Unable to find GID for '" << args[3] << "': " << decode_uid_err;
|
|
|
|
return nullptr;
|
|
|
|
}
|
2015-08-01 03:45:25 +08:00
|
|
|
std::size_t nr_supp_gids = command_arg - 1 /* -- */ - 4 /* exec SECLABEL UID GID */;
|
|
|
|
for (size_t i = 0; i < nr_supp_gids; ++i) {
|
2017-05-05 08:40:33 +08:00
|
|
|
gid_t supp_gid;
|
|
|
|
if (!DecodeUid(args[4 + i], &supp_gid, &decode_uid_err)) {
|
|
|
|
LOG(ERROR) << "Unable to find UID for '" << args[4 + i] << "': " << decode_uid_err;
|
|
|
|
return nullptr;
|
|
|
|
}
|
|
|
|
supp_gids.push_back(supp_gid);
|
2015-08-01 03:45:25 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-03-28 01:59:11 +08:00
|
|
|
auto svc_p = std::make_unique<Service>(name, flags, uid, gid, supp_gids, no_capabilities,
|
|
|
|
namespace_flags, seclabel, str_args);
|
2015-08-01 03:45:25 +08:00
|
|
|
Service* svc = svc_p.get();
|
2017-03-24 07:07:51 +08:00
|
|
|
services_.emplace_back(std::move(svc_p));
|
2015-08-01 03:45:25 +08:00
|
|
|
|
|
|
|
return svc;
|
|
|
|
}
|
|
|
|
|
|
|
|
Service* ServiceManager::FindServiceByName(const std::string& name) const {
|
|
|
|
auto svc = std::find_if(services_.begin(), services_.end(),
|
|
|
|
[&name] (const std::unique_ptr<Service>& s) {
|
|
|
|
return name == s->name();
|
|
|
|
});
|
|
|
|
if (svc != services_.end()) {
|
|
|
|
return svc->get();
|
|
|
|
}
|
|
|
|
return nullptr;
|
|
|
|
}
|
|
|
|
|
|
|
|
Service* ServiceManager::FindServiceByPid(pid_t pid) const {
|
|
|
|
auto svc = std::find_if(services_.begin(), services_.end(),
|
|
|
|
[&pid] (const std::unique_ptr<Service>& s) {
|
|
|
|
return s->pid() == pid;
|
|
|
|
});
|
|
|
|
if (svc != services_.end()) {
|
|
|
|
return svc->get();
|
|
|
|
}
|
|
|
|
return nullptr;
|
|
|
|
}
|
|
|
|
|
|
|
|
Service* ServiceManager::FindServiceByKeychord(int keychord_id) const {
|
|
|
|
auto svc = std::find_if(services_.begin(), services_.end(),
|
|
|
|
[&keychord_id] (const std::unique_ptr<Service>& s) {
|
|
|
|
return s->keychord_id() == keychord_id;
|
|
|
|
});
|
|
|
|
|
|
|
|
if (svc != services_.end()) {
|
|
|
|
return svc->get();
|
|
|
|
}
|
|
|
|
return nullptr;
|
|
|
|
}
|
|
|
|
|
2016-07-28 07:25:51 +08:00
|
|
|
void ServiceManager::ForEachService(const std::function<void(Service*)>& callback) const {
|
2015-08-01 03:45:25 +08:00
|
|
|
for (const auto& s : services_) {
|
2015-12-19 03:39:59 +08:00
|
|
|
callback(s.get());
|
2015-08-01 03:45:25 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
void ServiceManager::ForEachServiceInClass(const std::string& classname,
|
|
|
|
void (*func)(Service* svc)) const {
|
|
|
|
for (const auto& s : services_) {
|
2017-03-28 01:59:11 +08:00
|
|
|
if (s->classnames().find(classname) != s->classnames().end()) {
|
2015-08-01 03:45:25 +08:00
|
|
|
func(s.get());
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
void ServiceManager::ForEachServiceWithFlags(unsigned matchflags,
|
|
|
|
void (*func)(Service* svc)) const {
|
|
|
|
for (const auto& s : services_) {
|
|
|
|
if (s->flags() & matchflags) {
|
|
|
|
func(s.get());
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-08-27 02:43:36 +08:00
|
|
|
void ServiceManager::RemoveService(const Service& svc) {
|
2015-08-01 03:45:25 +08:00
|
|
|
auto svc_it = std::find_if(services_.begin(), services_.end(),
|
|
|
|
[&svc] (const std::unique_ptr<Service>& s) {
|
|
|
|
return svc.name() == s->name();
|
|
|
|
});
|
|
|
|
if (svc_it == services_.end()) {
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
services_.erase(svc_it);
|
|
|
|
}
|
|
|
|
|
2015-08-27 02:43:36 +08:00
|
|
|
void ServiceManager::DumpState() const {
|
|
|
|
for (const auto& s : services_) {
|
|
|
|
s->DumpState();
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-12-19 03:39:59 +08:00
|
|
|
bool ServiceManager::ReapOneProcess() {
|
2017-06-30 07:18:08 +08:00
|
|
|
siginfo_t siginfo = {};
|
|
|
|
// This returns a zombie pid or informs us that there are no zombies left to be reaped.
|
|
|
|
// It does NOT reap the pid; that is done below.
|
|
|
|
if (TEMP_FAILURE_RETRY(waitid(P_ALL, 0, &siginfo, WEXITED | WNOHANG | WNOWAIT)) != 0) {
|
|
|
|
PLOG(ERROR) << "waitid failed";
|
2015-12-19 03:39:59 +08:00
|
|
|
return false;
|
2017-06-30 07:18:08 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
auto pid = siginfo.si_pid;
|
|
|
|
if (pid == 0) return false;
|
|
|
|
|
|
|
|
// At this point we know we have a zombie pid, so we use this scopeguard to reap the pid
|
|
|
|
// whenever the function returns from this point forward.
|
|
|
|
// We do NOT want to reap the zombie earlier as in Service::Reap(), we kill(-pid, ...) and we
|
|
|
|
// want the pid to remain valid throughout that (and potentially future) usages.
|
|
|
|
auto reaper = make_scope_guard([pid] { TEMP_FAILURE_RETRY(waitpid(pid, nullptr, WNOHANG)); });
|
|
|
|
|
|
|
|
if (PropertyChildReap(pid)) {
|
2017-06-10 02:29:23 +08:00
|
|
|
return true;
|
2015-12-19 03:39:59 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
Service* svc = FindServiceByPid(pid);
|
|
|
|
|
|
|
|
std::string name;
|
2017-04-28 07:25:06 +08:00
|
|
|
std::string wait_string;
|
2015-12-19 03:39:59 +08:00
|
|
|
if (svc) {
|
2017-06-23 03:53:17 +08:00
|
|
|
name = StringPrintf("Service '%s' (pid %d)", svc->name().c_str(), pid);
|
2017-04-28 07:25:06 +08:00
|
|
|
if (svc->flags() & SVC_EXEC) {
|
2017-06-23 03:53:17 +08:00
|
|
|
wait_string = StringPrintf(" waiting took %f seconds", exec_waiter_->duration_s());
|
2017-04-28 07:25:06 +08:00
|
|
|
}
|
2015-12-19 03:39:59 +08:00
|
|
|
} else {
|
2017-06-23 03:53:17 +08:00
|
|
|
name = StringPrintf("Untracked pid %d", pid);
|
2015-12-19 03:39:59 +08:00
|
|
|
}
|
|
|
|
|
2017-06-30 07:18:08 +08:00
|
|
|
auto status = siginfo.si_status;
|
2015-12-19 03:39:59 +08:00
|
|
|
if (WIFEXITED(status)) {
|
2017-04-28 07:25:06 +08:00
|
|
|
LOG(INFO) << name << " exited with status " << WEXITSTATUS(status) << wait_string;
|
2015-12-19 03:39:59 +08:00
|
|
|
} else if (WIFSIGNALED(status)) {
|
2017-04-28 07:25:06 +08:00
|
|
|
LOG(INFO) << name << " killed by signal " << WTERMSIG(status) << wait_string;
|
2015-12-19 03:39:59 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
if (!svc) {
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2017-03-28 07:27:30 +08:00
|
|
|
svc->Reap();
|
|
|
|
|
|
|
|
if (svc->flags() & SVC_EXEC) {
|
|
|
|
exec_waiter_.reset();
|
|
|
|
}
|
|
|
|
if (svc->flags() & SVC_TEMPORARY) {
|
2015-12-19 03:39:59 +08:00
|
|
|
RemoveService(*svc);
|
|
|
|
}
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
void ServiceManager::ReapAnyOutstandingChildren() {
|
|
|
|
while (ReapOneProcess()) {
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-06-28 13:08:45 +08:00
|
|
|
void ServiceManager::ClearExecWait() {
|
|
|
|
// Clear EXEC flag if there is one pending
|
|
|
|
// And clear the wait flag
|
|
|
|
for (const auto& s : services_) {
|
|
|
|
s->UnSetExec();
|
|
|
|
}
|
|
|
|
exec_waiter_.reset();
|
|
|
|
}
|
|
|
|
|
2017-04-20 06:31:58 +08:00
|
|
|
bool ServiceParser::ParseSection(std::vector<std::string>&& args, const std::string& filename,
|
init: Stop combining actions
In the past, I had thought it didn't make sense to have multiple
Action classes with identical triggers within ActionManager::actions_,
and opted to instead combine these into a single action. In theory,
it should reduce memory overhead as only one copy of the triggers
needs to be stored.
In practice, this ends up not being a good idea.
Most importantly, given a file with the below three sections in this
same order:
on boot
setprop a b
on boot && property:true=true
setprop c d
on boot
setprop e f
Assuming that property 'true' == 'true', when the `boot` event
happens, the order of the setprop commands will actually be:
setprop a b
setprop e f
setprop c d
instead of the more intuitive order of:
setprop a b
setprop c d
setprop e f
This is a mistake and this CL fixes it. It also documents this order.
Secondly, with a given 'Action' now spanning multiple files, in order
to keep track of which file a command is run from, the 'Command'
itself needs to store this. Ironically to the original intention,
this increases total ram usage. This change now only stores the file
name in each 'Action' instead of each 'Command'. All in all this is a
negligible trade off of ram usage.
Thirdly, this requires a bunch of extra code and assumptions that
don't help anything else. In particular it forces to keep property triggers
sorted for easy comparison, which I'm using an std::map for currently,
but that is not the best data structure to contain them.
Lastly, I added the filename and line number to the 'processing
action' LOG(INFO) message.
Test: Boot bullhead, observe above changes
Test: Boot sailfish, observe no change in boot time
Change-Id: I3fbcac4ee677351314e33012c758145be82346e9
2017-04-19 04:21:54 +08:00
|
|
|
int line, std::string* err) {
|
2015-08-27 02:43:36 +08:00
|
|
|
if (args.size() < 3) {
|
|
|
|
*err = "services must have a name and a program";
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
const std::string& name = args[1];
|
|
|
|
if (!IsValidName(name)) {
|
|
|
|
*err = StringPrintf("invalid service name '%s'", name.c_str());
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2017-04-20 06:31:58 +08:00
|
|
|
Service* old_service = service_manager_->FindServiceByName(name);
|
|
|
|
if (old_service) {
|
|
|
|
*err = "ignored duplicate definition of service '" + name + "'";
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2015-08-27 02:43:36 +08:00
|
|
|
std::vector<std::string> str_args(args.begin() + 2, args.end());
|
2017-03-28 01:59:11 +08:00
|
|
|
service_ = std::make_unique<Service>(name, str_args);
|
2015-08-27 02:43:36 +08:00
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2017-04-20 06:31:58 +08:00
|
|
|
bool ServiceParser::ParseLineSection(std::vector<std::string>&& args, int line, std::string* err) {
|
|
|
|
return service_ ? service_->ParseLine(std::move(args), err) : false;
|
2015-08-27 02:43:36 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
void ServiceParser::EndSection() {
|
|
|
|
if (service_) {
|
2017-04-20 06:31:58 +08:00
|
|
|
service_manager_->AddService(std::move(service_));
|
2015-08-27 02:43:36 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
bool ServiceParser::IsValidName(const std::string& name) const {
|
2017-03-01 01:54:36 +08:00
|
|
|
// Property names can be any length, but may only contain certain characters.
|
|
|
|
// Property values can contain any characters, but may only be a certain length.
|
|
|
|
// (The latter restriction is needed because `start` and `stop` work by writing
|
|
|
|
// the service name to the "ctl.start" and "ctl.stop" properties.)
|
|
|
|
return is_legal_property_name("init.svc." + name) && name.size() <= PROP_VALUE_MAX;
|
2015-08-01 03:45:25 +08:00
|
|
|
}
|
2017-06-23 03:53:17 +08:00
|
|
|
|
|
|
|
} // namespace init
|
|
|
|
} // namespace android
|