1#!/bin/bash
2
3# Script to swap core networking modules in a GMS userdebug device to AOSP modules, by remounting
4# the system partition and replacing module prebuilts. This is only to be used for local testing,
5# and should only be used on userdebug devices that support "adb root" and remounting the system
6# partition using overlayfs. The setup wizard should be cleared before running the script.
7#
8# Usage: aospify_device.sh [device_serial]
9#
10# Reset with "adb enable-verity", then wiping data (from Settings, or:
11# "adb reboot bootloader && fastboot erase userdata && fastboot reboot").
12# Some devices output errors like "Overlayfs teardown failed" on "enable-verity" but it still works
13# (/mnt/scratch should be deleted).
14#
15# This applies to NetworkStack, CaptivePortalLogin, dnsresolver, tethering, cellbroadcast modules,
16# which generally need to be preloaded together (core networking modules + cellbroadcast which
17# shares its certificates with NetworkStack and CaptivePortalLogin)
18#
19# This allows device manufacturers to test their changes in AOSP modules, running them on their
20# own device builds, before contributing contributing the patches to AOSP. After running this script
21# once AOSP modules can be quickly built and updated on the prepared device with:
22#   m NetworkStack
23#   adb install --staged $ANDROID_PRODUCT_OUT/system/priv-app/NetworkStack/NetworkStack.apk \
24#   adb reboot
25# or for APEX modules:
26#   m com.android.tethering deapexer
27#   $ANDROID_HOST_OUT/bin/deapexer decompress --input $ANDROID_PRODUCT_OUT/system/apex/com.android.tethering.capex --output /tmp/decompressed.apex
28#   adb install /tmp/decompressed.apex && adb reboot
29#
30# This has been tested on Android T and Android U Pixel devices. On recent (U+) devices, it requires
31# setting a released target SDK (for example target_sdk_version: "34") in
32# packages/modules/Connectivity/service/ServiceConnectivityResources/Android.bp before building.
33set -e
34
35function push_apex {
36    local original_apex_name=$1
37    local aosp_apex_name=$2
38    if $ADB_CMD shell ls /system/apex/$original_apex_name.capex 1>/dev/null 2>/dev/null; then
39        $ADB_CMD shell rm /system/apex/$original_apex_name.capex
40        $ADB_CMD push $ANDROID_PRODUCT_OUT/system/apex/$aosp_apex_name.capex /system/apex/
41    else
42        rm -f /tmp/decompressed_$aosp_apex_name.apex
43        $ANDROID_HOST_OUT/bin/deapexer decompress --input $ANDROID_PRODUCT_OUT/system/apex/$aosp_apex_name.capex --output /tmp/decompressed_$aosp_apex_name.apex
44        if ! $ADB_CMD shell ls /system/apex/$original_apex_name.apex 1>/dev/null 2>/dev/null; then
45            # Filename observed on some phones, even though it is not actually compressed
46            original_apex_name=${original_apex_name}_compressed
47        fi
48        $ADB_CMD shell rm /system/apex/$original_apex_name.apex
49        $ADB_CMD push /tmp/decompressed_$aosp_apex_name.apex /system/apex/$aosp_apex_name.apex
50        rm /tmp/decompressed_$aosp_apex_name.apex
51    fi
52}
53
54function push_apk {
55    local app_type=$1
56    local original_apk_name=$2
57    local aosp_apk_name=$3
58    $ADB_CMD shell rm /system/$app_type/$original_apk_name/$original_apk_name*.apk
59    $ADB_CMD push $ANDROID_PRODUCT_OUT/system/$app_type/$aosp_apk_name/$aosp_apk_name.apk /system/$app_type/$original_apk_name/
60}
61
62NETWORKSTACK_AOSP_SEPOLICY_KEY="<signer signature=\"308205dc308203c4a003020102020900fc6cb0d8a6fdd16\
638300d06092a864886f70d01010b0500308181310b30090603550406130255533113301106035504080c0a43616c69666f72\
646e69613116301406035504070c0d4d6f756e7461696e20566965773110300e060355040a0c07416e64726f69643110300e0\
6560355040b0c07416e64726f69643121301f06035504030c18636f6d2e616e64726f69642e6e6574776f726b737461636b30\
6620170d3139303231323031343632305a180f34373537303130383031343632305a308181310b30090603550406130255533\
67113301106035504080c0a43616c69666f726e69613116301406035504070c0d4d6f756e7461696e20566965773110300e06\
680355040a0c07416e64726f69643110300e060355040b0c07416e64726f69643121301f06035504030c18636f6d2e616e647\
6926f69642e6e6574776f726b737461636b30820222300d06092a864886f70d01010105000382020f003082020a0282020100\
70bb71f5137ff0b2d757acc2ca3d378e0f8de11090d5caf3d49e314d35c283b778b02d792d8eba440364ca970985441660f0b\
71c00afbc63dd611b1bf51ad28a1edd21e0048f548b80f8bd113e25682822f57dab8273afaf12c64d19a0c6be238f3e66ddc7\
729b10fd926931e3ee60a7bf618644da3c2c4fc428139d45d27beda7fe45e30075b493ead6ec01cdd55d931c0a657e2e59742\
73ca632b6dc3842a2deb7d22443c809291d7a549203ae6ae356582a4ca23f30f0549c4ec8408a75278e95c69e8390ad5280bc\
74efaef6f1309a41bd9f3bfb5d12dca7e79ec6fd6848193fa9ab728224887b4f93e985ec7cbf6401b0e863a4b91c05d046f04\
750fe954004b1645954fcb4114cee1e8b64b47d719a19ef4c001cb183f7f3e166e43f56d68047c3440da34fdf529d44274b8b\
762f6afb345091ad8ad4b93bd5c55d52286a5d3c157465db8ddf62e7cdb6b10fb18888046afdd263ae6f2125d9065759c7e42\
77f8610a6746edbdc547d4301612eeec3c3cbd124dececc8d38b20e73b13f24ee7ca13a98c5f61f0c81b07d2b519749bc2bcb\
789e0949aef6c118a3e8125e6ab57fce46bb091a66740e10b31c740b891900c0ecda9cc69ecb4f3369998b175106dd0a4ffd7\
79024eb7e75fedd1a5b131d0bb2b40c63491e3cf86b8957b21521b3a96ed1376a51a6ac697866b0256dee1bcd9ab9a188bf4c\
80ed80b59a5f24c2da9a55eb7b0e502116e30203010001a3533051301d0603551d0e041604149383c92cfbf099d5c47b0c365\
817d8622a084b72e1301f0603551d230418301680149383c92cfbf099d5c47b0c3657d8622a084b72e1300f0603551d130101\
82ff040530030101ff300d06092a864886f70d01010b050003820201006a0501382fde2a6b8f70c60cd1b8ee4f788718c288b\
83170258ef3a96230b65005650d6a4c42a59a97b2ddec502413e7b438fbd060363d74b74a232382a7f77fd3da34e38f79fad0\
8435a8b472c5cff365818a0118d87fa1e31cc7ed4befd27628760c290980c3cc3b7ff0cfd01b75ff1fcc83e981b5b25a54d85\
85b68a80424ac26015fb3a4c754969a71174c0bc283f6c88191dced609e245f5938ffd0ad799198e2d0bf6342221c1b0a5d33\
862ed2fffc668982cabbcb7d3b630ff8476e5c84ac0ad37adf9224035200039f95ec1fa95bf83796c0e8986135cee2dcaef19\
870b249855a7e7397d4a0bf17ea63d978589c6b48118a381fffbd790c44d80233e2e35292a3b5533ca3f2cc173f85cf904adf\
88e2e4e2183dc1eba0ebae07b839a81ff1bc92e292550957c8599af21e9c0497b9234ce345f3f508b1cc872aa55ddb5e773c5\
89c7dd6577b9a8b6daed20ae1ff4b8206fd9f5c8f5a22ba1980bef01ae6fcb2659b97ad5b985fa81c019ffe008ddd9c8130c0\
906fc6032b2149c2209fc438a7e8c3b20ce03650ad31c4ee48f169777a0ae182b72ca31b81540f61f167d8d7adf4f6bb2330f\
91f5c24037245000d8172c12ab5d5aa5890b8b12db0f0e7296264eb66e7f9714c31004649fb4b864005f9c43c80db3f6de52f\
92d44d6e2036bfe7f5807156ed5ab591d06fd6bb93ba4334ea2739af8b41ed2686454e60b666d10738bb7ba88001\">\
93<seinfo value=\"network_stack\"\/><\/signer>"
94
95DEVICE=$1
96ADB_CMD="adb -s $DEVICE"
97
98if [ -z "$DEVICE" ]; then
99    echo "Usage: aospify_device.sh [device_serial]"
100    exit 1
101fi
102
103if [ -z "$ANDROID_BUILD_TOP" ]; then
104    echo "Run build/envsetup.sh first to set ANDROID_BUILD_TOP"
105    exit 1
106fi
107
108if ! $ADB_CMD wait-for-device shell pm path com.google.android.networkstack 1>/dev/null 2>/dev/null; then
109    echo "This device is already not using GMS modules"
110    exit 1
111fi
112
113read -p "This script is only for test purposes and highly likely to make your device unusable. \
114Continue ? <y/N>" prompt
115if [[ $prompt != "y" ]]
116then
117    exit 0
118fi
119
120cd $ANDROID_BUILD_TOP
121source build/envsetup.sh
122lunch aosp_arm64-trunk_staging-userdebug
123m NetworkStack CaptivePortalLogin com.android.tethering com.android.cellbroadcast \
124    com.android.resolv deapexer \
125    out/target/product/generic_arm64/system/etc/selinux/plat_mac_permissions.xml \
126    out/target/product/generic_arm64/system/etc/permissions/com.android.networkstack.xml
127
128$ADB_CMD root
129$ADB_CMD remount
130$ADB_CMD reboot
131
132echo "Waiting for boot..."
133until [[ $($ADB_CMD wait-for-device shell getprop sys.boot_completed) == 1 ]]; do
134    sleep 1;
135done
136
137$ADB_CMD root
138$ADB_CMD remount
139
140push_apk priv-app NetworkStackGoogle NetworkStack
141push_apk app CaptivePortalLoginGoogle CaptivePortalLogin
142push_apex com.google.android.tethering com.android.tethering
143push_apex com.google.android.cellbroadcast com.android.cellbroadcast
144push_apex com.google.android.resolv com.android.resolv
145
146# Replace the network_stack key used to set its sepolicy context
147rm -f /tmp/pulled_plat_mac_permissions.xml
148$ADB_CMD pull /system/etc/selinux/plat_mac_permissions.xml /tmp/pulled_plat_mac_permissions.xml
149sed_replace='s/<signer signature="[0-9a-fA-F]+"><seinfo value="network_stack"\/><\/signer>/'$NETWORKSTACK_AOSP_SEPOLICY_KEY'/'
150sed -E "$sed_replace" /tmp/pulled_plat_mac_permissions.xml |
151    $ADB_CMD shell 'cat > /system/etc/selinux/plat_mac_permissions.xml'
152rm /tmp/pulled_plat_mac_permissions.xml
153
154# Update the networkstack privapp-permissions allowlist
155rm -f /tmp/pulled_privapp-permissions.xml
156networkstack_permissions=/system/etc/permissions/GoogleNetworkStack_permissions.xml
157if ! $ADB_CMD shell ls $networkstack_permissions 1>/dev/null 2>/dev/null; then
158    networkstack_permissions=/system/etc/permissions/privapp-permissions-google.xml
159fi
160
161$ADB_CMD pull $networkstack_permissions /tmp/pulled_privapp-permissions.xml
162
163# Remove last </permission> line, and the permissions for com.google.android.networkstack
164sed -nE '1,/<\/permissions>/p' /tmp/pulled_privapp-permissions.xml \
165    | sed -E '/com.google.android.networkstack/,/privapp-permissions/d' > /tmp/modified_privapp-permissions.xml
166# Add the AOSP permissions and re-add the </permissions> line
167sed -nE '/com.android.networkstack/,/privapp-permissions/p' $ANDROID_PRODUCT_OUT/system/etc/permissions/com.android.networkstack.xml \
168    >> /tmp/modified_privapp-permissions.xml
169echo '</permissions>' >> /tmp/modified_privapp-permissions.xml
170
171$ADB_CMD push /tmp/modified_privapp-permissions.xml $networkstack_permissions
172
173rm /tmp/pulled_privapp-permissions.xml /tmp/modified_privapp-permissions.xml
174
175echo "Done modifying, rebooting"
176$ADB_CMD reboot