Commit Graph

93 Commits

Author SHA1 Message Date
Daniel Rosenberg 2bd0efa89c sdcard: Support sdcardfs
Add ability to use sdcardfs if kernel support is found.
In the future, we will likely remove the fuse components
entirely, but for now, just use sdcardfs when possible.

Bug: 19160983
Change-Id: I35e4d6cb5976c00c6f87ff7fc478ba9f9d212c05
Signed-off-by: Daniel Rosenberg <drosen@google.com>
2016-03-16 15:58:24 -07:00
Jeff Sharkey fe76461944 Re-derive permissions after package changes.
When packages change, existing package-specific directories may have
gained/lost a UID mapping, so we need to update the permissions for
any in-memory nodes.

This allows an app to deliver data for another package before that
package is installed, which is the typical pattern of how OBB files
are delivered.

Also fix bug by re-deriving permissions when files are moved.

Bug: 25399427
Change-Id: I06f38a24ad7dee5f5099ba81429aef03208e5683
2015-12-14 15:38:24 -07:00
William Roberts e509980542 sdcard: use libpackageparser
Switch from the internal packages.list file parser
implementation to a common parser library.

See Change-Id: I87a406802f95d8e7bfd8ee85f723f80e9e6b6c0c
for all of the details.

Change-Id: I98924dce406b322e0d402bca7fdac51f6a1e6a4b
Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-10-22 22:52:35 +00:00
Jeff Sharkey fdf1487493 resolved conflicts for merge of b9f438ff to mnc-dev-plus-aosp
Change-Id: I7103bacb1b2d7dc29b4f8d9dddb2fec1feb869d3
2015-08-06 12:52:25 -07:00
Jeff Sharkey b9f438ff84 Protect runtime storage mount points.
We have a bunch of magic that mounts the correct view of storage
access based on the runtime permissions of an app, but we forgot to
protect the real underlying data sources; oops.

This series of changes just bumps the directory heirarchy one level
to give us /mnt/runtime which we can mask off as 0700 to prevent
people from jumping to the exposed internals.

Also add CTS tests to verify that we're protecting access to
internal mount points like this.

Bug: 22964288
Change-Id: I32068e63a3362b37e8ebca1418f900bb8537b498
2015-08-06 11:45:31 -07:00
Jeff Sharkey e01761998b am d57125af: Merge "Give secondary users read-only physical cards." into mnc-dev
* commit 'd57125af1a81f34b162ecd5de81e6f1365aff588':
  Give secondary users read-only physical cards.
2015-07-29 04:04:33 +00:00
Elliott Hughes b6bfa337e5 am 07bed194: am 87998c07: Merge "Move sdcard off PAGESIZE and onto PAGE_SIZE."
* commit '07bed1941f902c1d65a410e49d33882e0da7b5ed':
  Move sdcard off PAGESIZE and onto PAGE_SIZE.
2015-07-29 00:17:17 +00:00
Elliott Hughes e24e9a5091 Move sdcard off PAGESIZE and onto PAGE_SIZE.
Only sdcard is using PAGESIZE, and glibc doesn't have it.

Bug: http://b/22735893
Change-Id: Ib8af14a2e99d98881a79f21ad1a695499c7d74bd
2015-07-28 16:36:47 -07:00
Jeff Sharkey 10a239b971 Give secondary users read-only physical cards.
Long ago, we mounted secondary physical cards as readable by all
users on the device, which enabled the use-case of loading media on
a card and viewing it from all users.

More recently, we started giving write access to these secondary
physical cards, but this created a one-directional channel for
communication across user boundaries; something that CDD disallows.

This change is designed to give us the best of both worlds: the
package-specific directories are writable for the user that mounted
the card, but access to those "Android" directories are blocked for
all other users.  Other users remain able to read content elsewhere
on the card.

Bug: 22787184
Change-Id: I4a04a1a857a65becf5fd37d775d927af022b40ca
2015-07-28 14:42:21 -07:00
Jeff Sharkey ed2fe57c25 Use single tree for multiple storage views.
Instead of having each view build and maintain its own tree
representing the underlying storage, switch to building a single tree
that each view augments with GID/mode specific behavior.

This has the nice property of a single file always having the same
node ID when presented across multiple views, giving us a firm handle
that we can use to invalidate kernel caches.

Specifically, when a file is deleted through one view, we now tell
the kernel to invalidate that file in the other two views.

Bug: 22477678, 22375891
Change-Id: I3ff041d549d41040839cde9773504719a508219f
2015-07-16 15:30:45 -07:00
Mark Salyzyn 6b6c1bd996 Gracefully handle ENODEV in sdcard daemon (part deux)
reorder to handle errno correctly and remove log stutter

Bug: 22197797
Bug: 22241640
Change-Id: I81e6b2ff15b6ea6e5e780bd3599bf1019ff36f26
2015-07-06 13:46:49 -07:00
Jeff Sharkey 25aabb9ede Permission to view shared storage for all users.
Typical apps are restricted so they can only view shared storage
belonging to the user they're running as.  However, a handful of
system components need access to shared storage across all users,
such as DefaultContainerService and SystemUI.

Since WRITE_MEDIA_STORAGE already offers this functionality by
bypassing any FUSE emulation, reuse it to grant the "sdcard_rw" GID
which is no longer handed out to third-party apps.  Then we change
the FUSE daemon to allow the "sdcard_rw" GID to see shared storage
of all users.

Bug: 19995822
Change-Id: Id2fe846aefbf13fc050e9b00ddef120021e817f4
2015-07-06 10:54:53 -07:00
Jeff Sharkey 4a48581851 Gracefully handle ENODEV in sdcard daemon.
When someone force-unmounts our target endpoint, gracefully handle by
terminating, instead of looping on the same errno forever.

Bug: 22197797
Change-Id: I7e71632f69d47152ea78a94431c23ae69aba9b93
2015-06-30 16:02:52 -07:00
Jeff Sharkey 169944afdf Remove unused methods to fix build.
Change-Id: I6e1f85a7cc3428d558460737da3b3193d035b73e
2015-06-26 09:43:52 -07:00
Jeff Sharkey f38f29c87d Let's reinvent storage, yet again!
Now that we're treating storage as a runtime permission, we need to
grant read/write access without killing the app.  This is really
tricky, since we had been using GIDs for access control, and they're
set in stone once Zygote drops privileges.

The only thing left that can change dynamically is the filesystem
itself, so let's do that.  This means changing the FUSE daemon to
present itself as three different views:

/mnt/runtime_default/foo - view for apps with no access
/mnt/runtime_read/foo - view for apps with read access
/mnt/runtime_write/foo - view for apps with write access

There is still a single location for all the backing files, and
filesystem permissions are derived the same way for each view, but
the file modes are masked off differently for each mountpoint.

During Zygote fork, it wires up the appropriate storage access into
an isolated mount namespace based on the current app permissions.  When
the app is granted permissions dynamically at runtime, the system
asks vold to jump into the existing mount namespace and bind mount
the newly granted access model into place.

Bug: 21858077
Change-Id: I5a016f0958a92fd390c02b5ae159f8008bd4f4b7
2015-06-25 22:27:04 -07:00
Elliott Hughes dac7f85d16 am 3d671000: am 28693983: am 1a39a994: Merge "Correct magic number on umount2"
* commit '3d671000c7268fcfcaf5445734b88428af26c294':
  Correct magic number on umount2
2015-04-24 04:01:13 +00:00
William Roberts 4555b69f26 Correct magic number on umount2
The umount2 call was using the magic constant 2 which is
has a defined and proper macro in mount.h as MNT_DETATCH.

Change-Id: I4ca4a6d31cbf5495c545088e3d90a8894a9f912f
2015-04-24 01:13:35 +00:00
Elliott Hughes c5f37661f9 am 03c0adab: am 6a99ff0a: am 3a4aedfc: Merge "sdcard: Properly handle deleted nodes"
* commit '03c0adab88fcb91393f934f213f953c1f23762d5':
  sdcard: Properly handle deleted nodes
2015-04-04 01:06:09 +00:00
Elliott Hughes 3a4aedfcd3 Merge "sdcard: Properly handle deleted nodes" 2015-04-04 00:27:46 +00:00
Elliott Hughes bfe72ddb20 am d71b0943: am 2d4a347e: am fad9b3eb: Merge "sdcard: Turn on noatime for fuse mounted sdcard"
* commit 'd71b0943de271d308ec1aeb1fa834dd35fedee50':
  sdcard: Turn on noatime for fuse mounted sdcard
2015-04-02 02:59:56 +00:00
Jeff Sharkey fc0004894a Progress towards dynamic storage support.
To support external storage devices that are dynamically added and
removed at runtime, we're changing /mnt and /storage to be tmpfs that
are managed by vold.

To support primary storage being inserted/ejected at runtime in a
multi-user environment, we can no longer bind-mount each user into
place.  Instead, we have a new /storage/self/primary symlink which
is resolved through /mnt/user/n/primary, and which vold updates at
runtime.

Fix small mode bugs in FUSE daemon so it can be safely mounted
visible to all users on device.

Bug: 19993667
Change-Id: I0ebf4d10aba03d73d9a6fa37d4d43766be8a173b
2015-03-30 19:48:38 -07:00
Jeff Sharkey 6c161fa7d8 Fix bug blocking access to secondary users.
Change-Id: I97ce510b6bc705488b9bea3340a72fb5449f8134
2015-03-24 11:53:10 -07:00
Jeff Sharkey 05edf7a5a9 Fix build, missed refactoring.
Change-Id: I17337133d8ca6a421e12c0834f42655f1a10197e
2015-03-23 20:05:32 -07:00
Jeff Sharkey a140afe454 Add multi-user GIDs to SD card daemon.
This will eventually allow us to have a single unified filesystem
instead of requiring zygote to use bind mounts.

Change-Id: I1fc4ada4874698a00e7e0b8800617732e69348f0
2015-03-23 19:25:27 -07:00
Krzysztof Adamski c5353126be sdcard: Properly handle deleted nodes
The sdcard fuse deamon is not properly handling deleted nodes that are
still in use (opened by some process). Typically Linux filesystems makes
it possible to open a file, unlink it and then still use it. In case of a
storage emulated by sdcard deamon this does not work as expected - other
process are not able to recreate file/dir with the same name until all
references to deleted file are closed.

The easiest way to trigger this problem is:

process1: mkdir /sdcard/test1; cd /sdcard/test1
process2: rm -r /sdcard/test1
process2: mkdir /sdcard/test1

After that, process2 will get an error:
mkdir failed for /sdcard/test1, Device or resource busy

There is exactly the same problem with files as directories.
This may case issues for example with directories that are
automatically recreated when they are missing (like DCIM directory). If
some process holds file opened inside of such directory but that
directory is removed, process trying to recreate the directory will get
EBUSY error and possibly crash.

Verified on the Z Ultra GPE.

Change-Id: I1cbf0bec135e6aaafba0ce8e5bb594e3639e0007
2015-02-20 20:56:10 +00:00
Johan Redestig 55cc5e5217 sdcard: Turn on noatime for fuse mounted sdcard
This provides symmetry with /data and /cache that are
typically mounted with noatime.

Change-Id: I6fe1bead368b52632424b03b50d4081852824cdb
2015-01-25 12:30:37 +01:00
Narayan Kamath 5aadceb56f sdcard : inode numbers must be fully representable as uint32_t.
This works around a bug on on 64 bit kernels + sdcard daemons
where we were using memory addresses as inode numbers.

bug: 19012244

(cherry picked from commit faa0935ffb)

Change-Id: Idbf9e285e507e702e04e7461a10153df68ef2322
2015-01-15 11:58:53 +00:00
Narayan Kamath 4b69d15c03 am 0f86444b: Merge "sdcard : inode numbers must be fully representable as uint32_t." into lmp-mr1-dev
* commit '0f86444b3912cadb4227755f3b80d2ff74841575':
  sdcard : inode numbers must be fully representable as uint32_t.
2015-01-15 10:26:27 +00:00
Narayan Kamath faa0935ffb sdcard : inode numbers must be fully representable as uint32_t.
This works around a bug on on 64 bit kernels + sdcard daemons
where we were using memory addresses as inode numbers.

bug: 19012244

Change-Id: Ia63c5b33b4212bf03ff92fa2faff0bb76e48791c
2015-01-14 17:00:43 +00:00
Marco Nelissen 5eb431180b Merge "Allow updates for open file descriptors" 2014-12-10 18:50:08 +00:00
Marco Nelissen a80f0986bb Allow updates for open file descriptors
even if the calling process itself would not be able to open the file.

Bug: 18688419

Change-Id: I640db19f19c1a677735fd0c14b7e2e38977d0f4d
2014-12-10 10:44:20 -08:00
Daisuke Okitsu a5a4e9e0ca sdcard: mount sdcard with the noexec option
Vold mounts the sdcard with noexec, but the fuse deamon
mounts with exec, so it is still possible to execute
binaries:

  /dev/fuse /storage/sdcard1 fuse rw,nosuid,nodev,relatime,
  user_id=1023,group_id=1023,default_permissions,allow_other 0 0

  /dev/block/vold/179:65 /mnt/media_rw/sdcard1 vfat rw,dirsync,
  nosuid,nodev,noexec,relatime,uid=1023,gid=1023,fmask=0007,
  dmask=0007,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,
  shortname=mixed,utf8,errors=remount-ro 0 0

With this change both vold and fuse mounts with noexec.

(cherry picked from commit f777d6694eecf6e61d9859df2090199863050017)

Change-Id: I66cbfc3a3a89a26958f83577f5e7a5e27f99184e
2014-11-24 08:39:15 -08:00
Daisuke Okitsu 00690852b4 sdcard: mount sdcard with the noexec option
Vold mounts the sdcard with noexec, but the fuse deamon
mounts with exec, so it is still possible to execute
binaries:

  /dev/fuse /storage/sdcard1 fuse rw,nosuid,nodev,relatime,
  user_id=1023,group_id=1023,default_permissions,allow_other 0 0

  /dev/block/vold/179:65 /mnt/media_rw/sdcard1 vfat rw,dirsync,
  nosuid,nodev,noexec,relatime,uid=1023,gid=1023,fmask=0007,
  dmask=0007,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,
  shortname=mixed,utf8,errors=remount-ro 0 0

With this change both vold and fuse mounts with noexec.

Change-Id: I66cbfc3a3a89a26958f83577f5e7a5e27f99184e
2014-11-24 09:52:14 +01:00
Daisuke Okitsu 19ec8860c1 Sdcard: Initialize the padding output value
Add initialization of the output value in handle_write.
This value is referred to in FUSE so initialization is
necessary.

See also handle_open and handle_opendir.

Change-Id: I6507f113da9f6823fbfa459624d6594fc20afa51
2014-11-13 10:51:07 +01:00
Elliott Hughes f1df854e58 bionic's struct stat is now POSIX-compliant.
Right now we still have the kernel names, but they're only there by
"virtue" of macro namespace pollution, so I'd like to get rid of them.

Bug: 18298106
Change-Id: Ifed0b3a9238c79a99d8a2b62e0f5897c50a725d1
2014-11-10 11:03:38 -08:00
Christopher Ferris 9d859fee5e am f37bfb32: am 23aeeff5: Merge "Use the correct fuse_init_out structure size."
* commit 'f37bfb32eb82393d14e339684c9f508cea3b0ab4':
  Use the correct fuse_init_out structure size.
2014-09-16 19:42:53 +00:00
Christopher Ferris ff649ea5ab Use the correct fuse_init_out structure size.
Kernel 2.6.16 is the first stable kernel with struct fuse_init_out
defined (fuse version 7.6). The structure is the same from 7.6 through
7.22. Beginning with 7.23, the structure increased in size and added
new parameters.

If the kernel only works on minor revs older than or equal to 22,
then use the older structure size since this code only uses the 7.22
version of the structure.

Change-Id: If2507a02ad674fcf02869a325221339ae1ace64d
2014-09-15 18:29:47 -07:00
Elliott Hughes 787a2cce94 am 33a5575a: am 39a8ade7: Merge "Fix sdcard truncates."
* commit '33a5575a585bdc4000be06f96554309b5d3471ff':
  Fix sdcard truncates.
2014-07-31 22:28:57 +00:00
Elliott Hughes 853574ddc7 Fix sdcard truncates.
Use truncate64 instead of truncate so we don't truncate (ho ho) the offset.

(cherrypick of 4568565e85bf2e1ea11b2e09d72e244088c05dbc.)

Bug: https://code.google.com/p/android/issues/detail?id=74039
Change-Id: I63711ccd299e3ebc475563b1999817d1919571ab
2014-07-31 12:20:14 -07:00
Elliott Hughes 4568565e85 Fix sdcard truncates.
Use truncate64 instead of truncate so we don't truncate (ho ho) the offset.

Bug: https://code.google.com/p/android/issues/detail?id=74039
Change-Id: I63711ccd299e3ebc475563b1999817d1919571ab
2014-07-31 12:03:03 -07:00
Nick Kralevich 504b4e9cc9 Merge "sdcard: ensure installd fs upgrade has completed" into lmp-dev 2014-07-24 22:43:15 +00:00
Nick Kralevich 8d28fa71fc sdcard: ensure installd fs upgrade has completed
Before running the sdcard daemon, make sure that installd has
completed all upgrades to /data that it needs to complete.
This avoids race conditions between installd and the sdcard daemon.

Maybe fixes bug 16329437.

Bug: 16329437
Change-Id: I5e164f08009c1036469f8734ec07cbae9c5e262b
2014-07-24 17:05:59 -07:00
Marcus Oakland e43b99a074 Correction to TRACE format strings
When built with "#define FUSE_TRACE 1" numerous TRACE statements
failed to compile because of mismatches between format strings and
types (uint64_t and size_t). These have been corrected by using the
format strings from the inttype.h header file, or %zu.

Signed-off-by: Marcus Oakland <marcus.oakland@arm.com>

(cherry picked from commit d33308752f)

Change-Id: I550b422a6b7c92ea903b4dd8f5e4aec5637cdf67
2014-07-24 11:51:54 -07:00
Nick Kralevich 506edb5f7c sdcard: ensure installd fs upgrade has completed
Before running the sdcard daemon, make sure that installd has
completed all upgrades to /data that it needs to complete.
This avoids race conditions between installd and the sdcard daemon.

Maybe fixes bug 16329437.

(cherrypicked from commit 8d28fa71fc)

Bug: 16329437
Change-Id: I5e164f08009c1036469f8734ec07cbae9c5e262b
2014-07-25 09:44:29 -07:00
Marcus Oakland d33308752f Correction to TRACE format strings
When built with "#define FUSE_TRACE 1" numerous TRACE statements
failed to compile because of mismatches between format strings and
types (uint64_t and size_t). These have been corrected by using the
format strings from the inttype.h header file, or %zu.

Change-Id: I36cd6f8da0790f1218d7dbaaa5b3bbfa4df7fdee
Signed-off-by: Marcus Oakland <marcus.oakland@arm.com>
2014-07-24 11:30:19 -07:00
Elliott Hughes 6ebab06dc4 am f043f061: am 060b6ecb: am 6e141aea: Merge "Fix sdcard\'s FUSE_FSYNCDIR handling."
* commit 'f043f061295a787aca42186fe9ab87c24d393b92':
  Fix sdcard's FUSE_FSYNCDIR handling.
2014-07-09 12:16:46 +00:00
Elliott Hughes 40372e5b4e am 94645665: am f8acdcbe: am 75b7171f: Merge "Make sdcard log to the log rather than stderr."
* commit '9464566580559b7353e6e2c898da79ffbbf993aa':
  Make sdcard log to the log rather than stderr.
2014-07-09 12:16:41 +00:00
Elliott Hughes 300d564980 Make sdcard log to the log rather than stderr.
Change-Id: I9c78941184c5e364055bfac766e1e542d3c23c87
2014-07-08 13:53:26 -07:00
Elliott Hughes f6d6737529 Fix sdcard's FUSE_FSYNCDIR handling.
For a file the FUSE fh is a struct handle containing an int fd;
for a directory it's a struct dirhandle containing a DIR*. Fix
handle_fsync to extract the file descriptor appropriately in
both cases.

Bug: 14613980
Change-Id: I45515cff6638e27a99b849e6fc639d355dbb4d27
2014-07-08 14:38:26 -07:00
Jeff Sharkey 2e7d80d10a Per-app media directories on external storage.
This change defines per-app directories on external storage that
will be scanned and included in MediaStore.  This gives apps a way
to write content to secondary shared storage in a way that can
easily be surfaced to other apps.

Bug: 14382377
Change-Id: I6f03d8076a9391d8b9eb8421ec3fc93669b3ba0d
2014-05-30 16:28:49 -07:00