Commit Graph

40 Commits

Author SHA1 Message Date
Nick Kralevich 9bcfd64b59 init: harden socket creation against symlinks
Instead of using chown, use the symlink safe lchown.

Instead of using chmod, use the symlink safe fchmodat
with AT_SYMLINK_NOFOLLOW.

Fix a bug where the SELinux filesystem creation context may
not be restored, and some memory not freed, if bind() fails.

Check the return values from the chown/chmod calls and unlink
the files if it ever fails.

(cherrypicked from commit ab5629c197)

Bug: 27337831
Change-Id: I28c5f4dee55aa706437eb51ad403c1fbf56138de
2016-02-25 12:38:51 -08:00
Elliott Hughes 4f71319df0 Track rename of base/ to android-base/.
Change-Id: Idf9444fece4aa89c93e15640de59a91f6e758ccf
2015-12-04 22:00:26 -08:00
Nick Kralevich 83ccb1c76b init: Don't ignore setsockcreatecon errors
The init language supports setting the creation context of a socket
as the 6th argument to the socket keyword. For example, in the
following service, the context associated with the netd socket
is u:r:netd:s0

service netd /system/bin/netd
    class main
    socket netd stream 0660 root system u:r:netd:s0
    socket dnsproxyd stream 0660 root inet
    socket mdns stream 0660 root system
    socket fwmarkd stream 0660 root inet

The 6 argument form of the socket statement is rarely if ever used,
since the init code supplies a sensible default.

Currently, there's no error checking on the value supplied as
the 6th argument. For example, if you have the following socket
statement:

  socket netd stream 0660 root system graphics

a socket will attempt to get created with an invalid "graphics"
context. When setsockcreatecon fails, it retains the default socket
creation context, which for init is u:r:init:s0. This results in a
socket being created which is in an unexpected context.

Check the return value from the setsockcreatecon() call. If an
invalid context is specified, return early and don't subsequently
attempt to create the socket with the default context.

Bug: 25851205
Change-Id: Ic66cd6f7efe3897fb247b587ddeac5d35e1602b7
2015-11-23 17:09:49 -08:00
Tom Cherry cda81d01c6 am 54c70ca1: Merge "init: Use classes for parsing and clean up memory allocations"
* commit '54c70ca15660529466b5b4e091209a20a3e75dff':
  init: Use classes for parsing and clean up memory allocations
2015-09-01 21:42:01 +00:00
Tom Cherry b7349902a9 init: Use classes for parsing and clean up memory allocations
Create a Parser class that uses multiple SectionParser interfaces to
handle parsing the different sections of an init rc.

Create an ActionParser and ServiceParser that implement SectionParser
and parse the sections corresponding to Action and Service
classes.

Remove the legacy keyword structure and replace it with std::map's
that map keyword -> (minimum args, maximum args, function pointer) for
Commands and Service Options.

Create an ImportParser that implements SectionParser and handles the
import 'section'.

Clean up the unsafe memory handling of the Action class by using
std::unique_ptr.

Change-Id: Ic5ea5510cb956dbc3f78745a35096ca7d6da7085
2015-09-01 12:26:02 -07:00
Lee Campbell 42f669a144 am f75b5ff1: am fe39394e: Merge "init: Adding support to import directories"
* commit 'f75b5ff17529e3eb163b9c7c49fc49842d443126':
  init: Adding support to import directories
2015-07-28 00:17:15 +00:00
Lee Campbell f13b1b3139 init: Adding support to import directories
Support added so init scripts can now import directories.

BUG: 22721249
Change-Id: I02b566bfb50ea84469f1ea0c6ad205435a1df286
TEST: Tested importing a folder on arm64 emulator
2015-07-27 14:56:03 -07:00
Nick Kralevich 7cba866569 am 8d855ba9: am d2e7f002: Merge "init/util.cpp: don\'t return a negative unsigned value"
* commit '8d855ba983d7e794fd75a20557ee92f4f8db2465':
  init/util.cpp: don't return a negative unsigned value
2015-06-19 03:46:48 +00:00
Nick Kralevich d2104df69b init/util.cpp: don't return a negative unsigned value
android_name_to_id() returns -1U on error, which causes a
crash when the following clang options are enabled:

  -fsanitize=signed-integer-overflow,unsigned-integer-overflow
  -ftrap-function=abort
  -fsanitize-undefined-trap-on-error

Rather than returning a negative unsigned value (which doesn't
make a lot of sense, IMHO), return a positive unsigned value.

While we're here, add logging on decode_uid failures.

Bug: 21880301
Change-Id: I652e4c1daa07c7494cceca2b4e1656b9158f2604
2015-06-18 20:11:06 -07:00
Elliott Hughes af02e2403a am 9fc83437: Don\'t use TEMP_FAILURE_RETRY on close in system/core.
* commit '9fc834377297cb2dcc418e4ce7e38e89dd09812b':
  Don't use TEMP_FAILURE_RETRY on close in system/core.
2015-05-27 20:51:25 +00:00
Elliott Hughes 9fc8343772 Don't use TEMP_FAILURE_RETRY on close in system/core.
Bug: http://b/20501816
Change-Id: I1839b48ee4f891b8431ecb809e37a4566a5b3e50
(cherry picked from commit 47b0134ec2)
2015-05-27 13:27:06 -07:00
Thierry Strudel 604e75449d am 91cf41cf: init: wait_for_file use smaller time resolution
* commit '91cf41cf43847930a8e55b3789d4943a8e22f73a':
  init: wait_for_file use smaller time resolution
2015-05-22 23:48:00 +00:00
Thierry Strudel 91cf41cf43 init: wait_for_file use smaller time resolution
As 1s timeout can be requested, using second resolution time to check
for timeout prevent from being accurate on the actual time we wait.
Use available gettime_ns instead.

Bug: 21374269
Change-Id: I8be1b69e02beacc7196427f97855e036addf54d1
Signed-off-by: Thierry Strudel <tstrudel@google.com>
2015-05-22 16:03:12 -07:00
Elliott Hughes 47b0134ec2 Don't use TEMP_FAILURE_RETRY on close in system/core.
Bug: http://b/20501816
Change-Id: I1839b48ee4f891b8431ecb809e37a4566a5b3e50
2015-05-15 19:16:40 -07:00
Elliott Hughes 2550355ceb resolved conflicts for merge of d410a9b3 to mnc-dev-plus-aosp
Change-Id: I2e8e6c9a2024e0a753d3912111ccd1c2bfbfef10
2015-05-12 20:16:40 -07:00
Tom Cherry cce7e93b28 Fix insmod module size
read_file() used to append a new line character to the end of the buffer it
returns, because parse_config() isn't able to cope with input that's not
'\n'-terminated. Fix read_file() to be less insane, and push the workarounds
into the parse_config() callers.

Longer term we should rewrite parse_config().

Bug: http://b/21079470
Change-Id: Ie9d9a7adcd33b66621726aef20c4b8cc51c08be7
(cherry picked from commit eaa3b4ec6f)
2015-05-12 19:42:38 -07:00
Tom Cherry eaa3b4ec6f Fix insmod module size
read_file() used to append a new line character to the end of the buffer it
returns, because parse_config() isn't able to cope with input that's not
'\n'-terminated. Fix read_file() to be less insane, and push the workarounds
into the parse_config() callers.

Longer term we should rewrite parse_config().

Change-Id: Ie9d9a7adcd33b66621726aef20c4b8cc51c08be7
2015-05-12 14:18:49 -07:00
Andres Morales b7f8b91040 am 86aeb11e: Merge "load ro.recovery_id property from recovery partition" into mnc-dev
* commit '86aeb11ed047b3698948c4eee8fbaccd20131ecb':
  load ro.recovery_id property from recovery partition
2015-05-09 00:46:52 +00:00
Andres Morales cb3fce80fa load ro.recovery_id property from recovery partition
Change-Id: I9dc1f325e353375d9c1c8ed949636e2404601076
(cherry picked from commit db5f5d4367)
2015-05-08 17:35:13 -07:00
Andres Morales db5f5d4367 load ro.recovery_id property from recovery partition
Change-Id: I9dc1f325e353375d9c1c8ed949636e2404601076
2015-05-08 17:23:24 -07:00
Elliott Hughes fdf2546ae7 am a5aa7a11: am 55c2e1f4: Merge "Clean up init /proc/cmdline handling."
* commit 'a5aa7a11266f1d407275b78981fc864c6c863358':
  Clean up init /proc/cmdline handling.
2015-05-07 18:31:16 +00:00
Elliott Hughes e5ce30fed8 Clean up init /proc/cmdline handling.
Helped debug a problem where the N9 bootloader incorrectly
concatenated the various command lines.

Bug: http://b/20906691
Change-Id: I0580b06f4185129c7eedf0bdf74b5ce17f88bf9c
2015-05-07 11:02:08 -07:00
Nick Kralevich eab1e21996 am ecf184c9: am 9c9280d8: Merge "init: get rid of the remaining double mounts"
* commit 'ecf184c901b78994773d687763c1478752e9375e':
  init: get rid of the remaining double mounts
2015-04-26 22:14:51 +00:00
Nick Kralevich 14adea307d am 45a49d0e: am ccac2be8: Merge "init: use SELinux /dev/null if available"
* commit '45a49d0eb7e2e9fc3d2c48884c84f6a6c7397720':
  init: use SELinux /dev/null if available
2015-04-26 22:14:47 +00:00
Nick Kralevich ada332e4a0 am ecf184c9: am 9c9280d8: Merge "init: get rid of the remaining double mounts"
* commit 'ecf184c901b78994773d687763c1478752e9375e':
  init: get rid of the remaining double mounts
2015-04-26 02:11:28 +00:00
Nick Kralevich ec9bd166cc am 45a49d0e: am ccac2be8: Merge "init: use SELinux /dev/null if available"
* commit '45a49d0eb7e2e9fc3d2c48884c84f6a6c7397720':
  init: use SELinux /dev/null if available
2015-04-26 01:39:13 +00:00
Nick Kralevich f667a3247a init: get rid of the remaining double mounts
Don't double mount /dev and its subdirectories anymore. Instead, the
first stage init is solely responsible for mounting it.

Don't have init prepare the property space. This is the responsibility
of the second stage init.

Don't have SELinux use the property space to determine how we should
be running. Instead, create a new function and extract the data we
need directly from /proc/cmdline. SELinux needs this information in
the first stage init process where the property service isn't available.

Change-Id: I5b4f3bec79463a7381a68f30bdda78b5cc122a96
2015-04-25 18:29:26 -07:00
Nick Kralevich e34577ce1b init: use SELinux /dev/null if available
SELinux provides it's own /dev/null character device at
/sys/fs/selinux/null. This character device is exactly the same
as /dev/null, including the same major/minor numbers, and can
be used wherever /dev/null is used.

Use /sys/fs/selinux/null instead of trying to create our own
/dev/__null__ device. This moves us one step closer to eliminating
all uses of mknod() by init.

/sys/fs/selinux/null is only available once the /sys/fs/selinux filesystem
is mounted. It's not available to the first stage init, so we
still have to fall back to mknod then.

Change-Id: Ic733767ea6220a130537de33cc478ae79578ce20
2015-04-25 16:48:23 -07:00
Nick Kralevich 2ae7d4eefd am 6b6df173: am f8b0743e: Merge "init: fix write_file checkreqprot logic error"
* commit '6b6df1733711ace006e0f4f9d44c718f85d2f70d':
  init: fix write_file checkreqprot logic error
2015-04-25 23:28:44 +00:00
Nick Kralevich eedbe81f75 init: fix write_file checkreqprot logic error
write_file() returned -errno on error, not -1. Callers who check for
-1 would falsely believe that the write was successful when it wasn't.
Fixup write_file so that it return -1 on error consistent
with other functions.

Change-Id: Ic51aaf8678d8d97b2606bd171f11b3b11f642e39
2015-04-25 15:36:13 -07:00
Ed Tam 438443e742 resolved conflicts for merge of 79f33846 to lmp-mr1-dev-plus-aosp
Change-Id: I24c60a2747931917a3ea09b953905ce0f4145280
2015-04-13 16:29:05 -07:00
Elliott Hughes da40c00137 Log more timing information from init.
Also make important events in init's life NOTICE rather than INFO,
and ensure that NOTICE events actually make it to the kernel log.

Also fix the logging so that if you have a printf format string
error, the compiler now catches it.

Also give messages from init, ueventd, and watchdogd distinct tags.
(Previously they'd all call themselves "init", and dmesg doesn't
include pids, so you couldn't untangle them.)

Also include the tag in SELinux messages.

Bug: 19544788
Change-Id: Ica6daea065bfdb80155c52c0b06f346a7df208fe
2015-03-28 00:25:22 -07:00
Elliott Hughes bbc01d8254 Merge "Remove /proc/cpuinfo parsing" 2015-03-19 23:21:29 +00:00
Dan Albert c007bc3856 Revert "Revert "Create libbase.""
This reverts commit a7870d8816.
2015-03-16 10:08:46 -07:00
Nicolas Geoffray a7870d8816 Revert "Create libbase."
Breaks internal master.

This reverts commit 98ff77204c.

Change-Id: I18dc6021cb43efff8aa88486c2d980dc2b8eedba
2015-03-16 11:07:29 +00:00
Dan Albert 98ff77204c Create libbase.
Move StringPrintf and the string based file I/O from libutils to
libbase.

Change-Id: I0297a6063874b9d92100e0dd5123fddfbda932fe
2015-03-14 16:36:18 -07:00
Rom Lemarchand 74b34f3cb7 Remove /proc/cpuinfo parsing
- Clean up the paths for ro.revision and ro.hardware parsing
- Use ro.hardwre in ueventd instead of parsing the kernel command line

(cherry-pick of 38b340a52f8e864650db8bae1eb88d5c00485db0.)

Bug: 19366018
Change-Id: I018a293f3d46e736a8b65132b5b00b0f7c20edae
2015-03-14 11:05:48 -07:00
Elliott Hughes f682b4786a Clean up reading and writing in init.
This isn't particularly useful in and of itself, but it does introduce the
first (trivial) unit test, improves the documentation (including details
about how to debug init crashes), and made me aware of how unpleasant the
existing parser is.

I also fixed a bug in passing --- unless you thought the "peboot" and "pm"
commands were features...

Bug: 19217569
Change-Id: I6ab76129a543ce3ed3dab52ef2c638009874c3de
2015-02-06 14:20:30 -08:00
Elliott Hughes 24627906bf Use TEMP_FAILURE_RETRY, always build bootchart.cpp.
Also switch the revision parsing over to sscanf as promised. I haven't
done the hardware parsing because I don't yet know whether we actually need
to keep the space-stripping code.

Change-Id: Ic33378345cd515cb08d00c543acf44eb72673396
2015-02-04 10:25:09 -08:00
Elliott Hughes f3cf438714 Build init as C++.
This is just the minimal change to keep it building.

Change-Id: I245c5b8413a1db114576c81462eb5737f5ffcef2
2015-02-04 08:59:10 -08:00