1*00c7fec1SAndroid Build Coastguard Worker /*
2*00c7fec1SAndroid Build Coastguard Worker * Copyright (C) 2010 The Android Open Source Project
3*00c7fec1SAndroid Build Coastguard Worker *
4*00c7fec1SAndroid Build Coastguard Worker * Licensed under the Apache License, Version 2.0 (the "License");
5*00c7fec1SAndroid Build Coastguard Worker * you may not use this file except in compliance with the License.
6*00c7fec1SAndroid Build Coastguard Worker * You may obtain a copy of the License at
7*00c7fec1SAndroid Build Coastguard Worker *
8*00c7fec1SAndroid Build Coastguard Worker * http://www.apache.org/licenses/LICENSE-2.0
9*00c7fec1SAndroid Build Coastguard Worker *
10*00c7fec1SAndroid Build Coastguard Worker * Unless required by applicable law or agreed to in writing, software
11*00c7fec1SAndroid Build Coastguard Worker * distributed under the License is distributed on an "AS IS" BASIS,
12*00c7fec1SAndroid Build Coastguard Worker * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13*00c7fec1SAndroid Build Coastguard Worker * See the License for the specific language governing permissions and
14*00c7fec1SAndroid Build Coastguard Worker * limitations under the License.
15*00c7fec1SAndroid Build Coastguard Worker */
16*00c7fec1SAndroid Build Coastguard Worker
17*00c7fec1SAndroid Build Coastguard Worker #include <errno.h>
18*00c7fec1SAndroid Build Coastguard Worker #include <error.h>
19*00c7fec1SAndroid Build Coastguard Worker #include <paths.h>
20*00c7fec1SAndroid Build Coastguard Worker #include <pwd.h>
21*00c7fec1SAndroid Build Coastguard Worker #include <stdlib.h>
22*00c7fec1SAndroid Build Coastguard Worker #include <string.h>
23*00c7fec1SAndroid Build Coastguard Worker #include <sys/capability.h>
24*00c7fec1SAndroid Build Coastguard Worker #include <sys/stat.h>
25*00c7fec1SAndroid Build Coastguard Worker #include <sys/types.h>
26*00c7fec1SAndroid Build Coastguard Worker #include <unistd.h>
27*00c7fec1SAndroid Build Coastguard Worker
28*00c7fec1SAndroid Build Coastguard Worker #include <string>
29*00c7fec1SAndroid Build Coastguard Worker #include <vector>
30*00c7fec1SAndroid Build Coastguard Worker
31*00c7fec1SAndroid Build Coastguard Worker #include <libminijail.h>
32*00c7fec1SAndroid Build Coastguard Worker #include <scoped_minijail.h>
33*00c7fec1SAndroid Build Coastguard Worker
34*00c7fec1SAndroid Build Coastguard Worker #include <android-base/properties.h>
35*00c7fec1SAndroid Build Coastguard Worker #include <packagelistparser/packagelistparser.h>
36*00c7fec1SAndroid Build Coastguard Worker #include <private/android_filesystem_config.h>
37*00c7fec1SAndroid Build Coastguard Worker #include <selinux/android.h>
38*00c7fec1SAndroid Build Coastguard Worker
39*00c7fec1SAndroid Build Coastguard Worker // The purpose of this program is to run a command as a specific
40*00c7fec1SAndroid Build Coastguard Worker // application user-id. Typical usage is:
41*00c7fec1SAndroid Build Coastguard Worker //
42*00c7fec1SAndroid Build Coastguard Worker // run-as <package-name> <command> <args>
43*00c7fec1SAndroid Build Coastguard Worker //
44*00c7fec1SAndroid Build Coastguard Worker // The 'run-as' binary is installed with CAP_SETUID and CAP_SETGID file
45*00c7fec1SAndroid Build Coastguard Worker // capabilities, but will check the following:
46*00c7fec1SAndroid Build Coastguard Worker //
47*00c7fec1SAndroid Build Coastguard Worker // - that the ro.boot.disable_runas property is not set
48*00c7fec1SAndroid Build Coastguard Worker // - that it is invoked from the 'shell' or 'root' user (abort otherwise)
49*00c7fec1SAndroid Build Coastguard Worker // - that '<package-name>' is the name of an installed and debuggable package
50*00c7fec1SAndroid Build Coastguard Worker // - that the package's data directory is well-formed
51*00c7fec1SAndroid Build Coastguard Worker //
52*00c7fec1SAndroid Build Coastguard Worker // If so, it will drop to the application's user id / group id, cd to the
53*00c7fec1SAndroid Build Coastguard Worker // package's data directory, then run the command there.
54*00c7fec1SAndroid Build Coastguard Worker //
55*00c7fec1SAndroid Build Coastguard Worker // This can be useful for a number of different things on production devices:
56*00c7fec1SAndroid Build Coastguard Worker //
57*00c7fec1SAndroid Build Coastguard Worker // - Allow application developers to look at their own application data
58*00c7fec1SAndroid Build Coastguard Worker // during development.
59*00c7fec1SAndroid Build Coastguard Worker //
60*00c7fec1SAndroid Build Coastguard Worker // - Run the 'gdbserver' binary executable to allow native debugging
61*00c7fec1SAndroid Build Coastguard Worker //
62*00c7fec1SAndroid Build Coastguard Worker
packagelist_parse_callback(pkg_info * this_package,void * userdata)63*00c7fec1SAndroid Build Coastguard Worker static bool packagelist_parse_callback(pkg_info* this_package, void* userdata) {
64*00c7fec1SAndroid Build Coastguard Worker pkg_info* p = reinterpret_cast<pkg_info*>(userdata);
65*00c7fec1SAndroid Build Coastguard Worker if (strcmp(p->name, this_package->name) == 0) {
66*00c7fec1SAndroid Build Coastguard Worker *p = *this_package;
67*00c7fec1SAndroid Build Coastguard Worker return false; // Stop searching.
68*00c7fec1SAndroid Build Coastguard Worker }
69*00c7fec1SAndroid Build Coastguard Worker packagelist_free(this_package);
70*00c7fec1SAndroid Build Coastguard Worker return true; // Keep searching.
71*00c7fec1SAndroid Build Coastguard Worker }
72*00c7fec1SAndroid Build Coastguard Worker
check_directory(const char * path,uid_t uid)73*00c7fec1SAndroid Build Coastguard Worker static void check_directory(const char* path, uid_t uid) {
74*00c7fec1SAndroid Build Coastguard Worker struct stat st;
75*00c7fec1SAndroid Build Coastguard Worker if (TEMP_FAILURE_RETRY(lstat(path, &st)) == -1) {
76*00c7fec1SAndroid Build Coastguard Worker error(1, errno, "couldn't stat %s", path);
77*00c7fec1SAndroid Build Coastguard Worker }
78*00c7fec1SAndroid Build Coastguard Worker
79*00c7fec1SAndroid Build Coastguard Worker // Must be a real directory, not a symlink.
80*00c7fec1SAndroid Build Coastguard Worker if (!S_ISDIR(st.st_mode)) {
81*00c7fec1SAndroid Build Coastguard Worker error(1, 0, "%s not a directory: %o", path, st.st_mode);
82*00c7fec1SAndroid Build Coastguard Worker }
83*00c7fec1SAndroid Build Coastguard Worker
84*00c7fec1SAndroid Build Coastguard Worker // Must be owned by specific uid/gid.
85*00c7fec1SAndroid Build Coastguard Worker if (st.st_uid != uid || st.st_gid != uid) {
86*00c7fec1SAndroid Build Coastguard Worker error(1, 0, "%s has wrong owner: %d/%d, not %d", path, st.st_uid, st.st_gid, uid);
87*00c7fec1SAndroid Build Coastguard Worker }
88*00c7fec1SAndroid Build Coastguard Worker
89*00c7fec1SAndroid Build Coastguard Worker // Must not be readable or writable by others.
90*00c7fec1SAndroid Build Coastguard Worker if ((st.st_mode & (S_IROTH | S_IWOTH)) != 0) {
91*00c7fec1SAndroid Build Coastguard Worker error(1, 0, "%s readable or writable by others: %o", path, st.st_mode);
92*00c7fec1SAndroid Build Coastguard Worker }
93*00c7fec1SAndroid Build Coastguard Worker }
94*00c7fec1SAndroid Build Coastguard Worker
95*00c7fec1SAndroid Build Coastguard Worker // This function is used to check the data directory path for safety.
96*00c7fec1SAndroid Build Coastguard Worker // We check that every sub-directory is owned by the 'system' user
97*00c7fec1SAndroid Build Coastguard Worker // and exists and is not a symlink. We also check that the full directory
98*00c7fec1SAndroid Build Coastguard Worker // path is properly owned by the user ID.
check_data_path(const char * package_name,const char * data_path,uid_t uid)99*00c7fec1SAndroid Build Coastguard Worker static void check_data_path(const char* package_name, const char* data_path, uid_t uid) {
100*00c7fec1SAndroid Build Coastguard Worker // The path should be absolute.
101*00c7fec1SAndroid Build Coastguard Worker if (data_path[0] != '/') {
102*00c7fec1SAndroid Build Coastguard Worker error(1, 0, "%s data path not absolute: %s", package_name, data_path);
103*00c7fec1SAndroid Build Coastguard Worker }
104*00c7fec1SAndroid Build Coastguard Worker
105*00c7fec1SAndroid Build Coastguard Worker // Look for all sub-paths, we do that by finding
106*00c7fec1SAndroid Build Coastguard Worker // directory separators in the input path and
107*00c7fec1SAndroid Build Coastguard Worker // checking each sub-path independently.
108*00c7fec1SAndroid Build Coastguard Worker for (int nn = 1; data_path[nn] != '\0'; nn++) {
109*00c7fec1SAndroid Build Coastguard Worker char subpath[PATH_MAX];
110*00c7fec1SAndroid Build Coastguard Worker
111*00c7fec1SAndroid Build Coastguard Worker /* skip non-separator characters */
112*00c7fec1SAndroid Build Coastguard Worker if (data_path[nn] != '/') continue;
113*00c7fec1SAndroid Build Coastguard Worker
114*00c7fec1SAndroid Build Coastguard Worker /* handle trailing separator case */
115*00c7fec1SAndroid Build Coastguard Worker if (data_path[nn+1] == '\0') break;
116*00c7fec1SAndroid Build Coastguard Worker
117*00c7fec1SAndroid Build Coastguard Worker /* found a separator, check that data_path is not too long. */
118*00c7fec1SAndroid Build Coastguard Worker if (nn >= (int)(sizeof subpath)) {
119*00c7fec1SAndroid Build Coastguard Worker error(1, 0, "%s data path too long: %s", package_name, data_path);
120*00c7fec1SAndroid Build Coastguard Worker }
121*00c7fec1SAndroid Build Coastguard Worker
122*00c7fec1SAndroid Build Coastguard Worker /* reject any '..' subpath */
123*00c7fec1SAndroid Build Coastguard Worker if (nn >= 3 &&
124*00c7fec1SAndroid Build Coastguard Worker data_path[nn-3] == '/' &&
125*00c7fec1SAndroid Build Coastguard Worker data_path[nn-2] == '.' &&
126*00c7fec1SAndroid Build Coastguard Worker data_path[nn-1] == '.') {
127*00c7fec1SAndroid Build Coastguard Worker error(1, 0, "%s contains '..': %s", package_name, data_path);
128*00c7fec1SAndroid Build Coastguard Worker }
129*00c7fec1SAndroid Build Coastguard Worker
130*00c7fec1SAndroid Build Coastguard Worker /* copy to 'subpath', then check ownership */
131*00c7fec1SAndroid Build Coastguard Worker memcpy(subpath, data_path, nn);
132*00c7fec1SAndroid Build Coastguard Worker subpath[nn] = '\0';
133*00c7fec1SAndroid Build Coastguard Worker
134*00c7fec1SAndroid Build Coastguard Worker check_directory(subpath, AID_SYSTEM);
135*00c7fec1SAndroid Build Coastguard Worker }
136*00c7fec1SAndroid Build Coastguard Worker
137*00c7fec1SAndroid Build Coastguard Worker // All sub-paths were checked, now verify that the full data
138*00c7fec1SAndroid Build Coastguard Worker // directory is owned by the application uid.
139*00c7fec1SAndroid Build Coastguard Worker check_directory(data_path, uid);
140*00c7fec1SAndroid Build Coastguard Worker }
141*00c7fec1SAndroid Build Coastguard Worker
get_supplementary_gids(uid_t userAppId)142*00c7fec1SAndroid Build Coastguard Worker std::vector<gid_t> get_supplementary_gids(uid_t userAppId) {
143*00c7fec1SAndroid Build Coastguard Worker std::vector<gid_t> gids;
144*00c7fec1SAndroid Build Coastguard Worker int size = getgroups(0, &gids[0]);
145*00c7fec1SAndroid Build Coastguard Worker if (size < 0) {
146*00c7fec1SAndroid Build Coastguard Worker error(1, errno, "getgroups failed");
147*00c7fec1SAndroid Build Coastguard Worker }
148*00c7fec1SAndroid Build Coastguard Worker gids.resize(size);
149*00c7fec1SAndroid Build Coastguard Worker size = getgroups(size, &gids[0]);
150*00c7fec1SAndroid Build Coastguard Worker if (size != static_cast<int>(gids.size())) {
151*00c7fec1SAndroid Build Coastguard Worker error(1, errno, "getgroups failed");
152*00c7fec1SAndroid Build Coastguard Worker }
153*00c7fec1SAndroid Build Coastguard Worker // Profile guide compiled oat files (like /data/app/xxx/oat/arm64/base.odex) are not readable
154*00c7fec1SAndroid Build Coastguard Worker // worldwide (DEXOPT_PUBLIC flag isn't set). To support reading them (needed by simpleperf for
155*00c7fec1SAndroid Build Coastguard Worker // profiling), add shared app gid to supplementary groups.
156*00c7fec1SAndroid Build Coastguard Worker gid_t shared_app_gid = userAppId % AID_USER_OFFSET - AID_APP_START + AID_SHARED_GID_START;
157*00c7fec1SAndroid Build Coastguard Worker gids.push_back(shared_app_gid);
158*00c7fec1SAndroid Build Coastguard Worker return gids;
159*00c7fec1SAndroid Build Coastguard Worker }
160*00c7fec1SAndroid Build Coastguard Worker
main(int argc,char * argv[])161*00c7fec1SAndroid Build Coastguard Worker int main(int argc, char* argv[]) {
162*00c7fec1SAndroid Build Coastguard Worker // Check arguments.
163*00c7fec1SAndroid Build Coastguard Worker if (argc < 2) {
164*00c7fec1SAndroid Build Coastguard Worker error(1, 0, "usage: run-as <package-name> [--user <uid>] <command> [<args>]\n");
165*00c7fec1SAndroid Build Coastguard Worker }
166*00c7fec1SAndroid Build Coastguard Worker
167*00c7fec1SAndroid Build Coastguard Worker // This program runs with CAP_SETUID and CAP_SETGID capabilities on Android
168*00c7fec1SAndroid Build Coastguard Worker // production devices. Check user id of caller --- must be 'shell' or 'root'.
169*00c7fec1SAndroid Build Coastguard Worker if (getuid() != AID_SHELL && getuid() != AID_ROOT) {
170*00c7fec1SAndroid Build Coastguard Worker error(1, 0, "only 'shell' or 'root' users can run this program");
171*00c7fec1SAndroid Build Coastguard Worker }
172*00c7fec1SAndroid Build Coastguard Worker
173*00c7fec1SAndroid Build Coastguard Worker // Some devices can disable running run-as, such as Chrome OS when running in
174*00c7fec1SAndroid Build Coastguard Worker // non-developer mode.
175*00c7fec1SAndroid Build Coastguard Worker if (android::base::GetBoolProperty("ro.boot.disable_runas", false)) {
176*00c7fec1SAndroid Build Coastguard Worker error(1, 0, "run-as is disabled from the kernel commandline");
177*00c7fec1SAndroid Build Coastguard Worker }
178*00c7fec1SAndroid Build Coastguard Worker
179*00c7fec1SAndroid Build Coastguard Worker char* pkgname = argv[1];
180*00c7fec1SAndroid Build Coastguard Worker int cmd_argv_offset = 2;
181*00c7fec1SAndroid Build Coastguard Worker
182*00c7fec1SAndroid Build Coastguard Worker // Get user_id from command line if provided.
183*00c7fec1SAndroid Build Coastguard Worker int userId = 0;
184*00c7fec1SAndroid Build Coastguard Worker if ((argc >= 4) && !strcmp(argv[2], "--user")) {
185*00c7fec1SAndroid Build Coastguard Worker userId = atoi(argv[3]);
186*00c7fec1SAndroid Build Coastguard Worker if (userId < 0) error(1, 0, "negative user id: %d", userId);
187*00c7fec1SAndroid Build Coastguard Worker cmd_argv_offset += 2;
188*00c7fec1SAndroid Build Coastguard Worker }
189*00c7fec1SAndroid Build Coastguard Worker
190*00c7fec1SAndroid Build Coastguard Worker // Retrieve package information from system, switching egid so we can read the file.
191*00c7fec1SAndroid Build Coastguard Worker pkg_info info = {.name = pkgname};
192*00c7fec1SAndroid Build Coastguard Worker gid_t old_egid = getegid();
193*00c7fec1SAndroid Build Coastguard Worker if (setegid(AID_PACKAGE_INFO) == -1) error(1, errno, "setegid(AID_PACKAGE_INFO) failed");
194*00c7fec1SAndroid Build Coastguard Worker if (!packagelist_parse(packagelist_parse_callback, &info)) {
195*00c7fec1SAndroid Build Coastguard Worker error(1, errno, "packagelist_parse failed");
196*00c7fec1SAndroid Build Coastguard Worker }
197*00c7fec1SAndroid Build Coastguard Worker if (setegid(old_egid) == -1) error(1, errno, "couldn't restore egid");
198*00c7fec1SAndroid Build Coastguard Worker
199*00c7fec1SAndroid Build Coastguard Worker if (info.uid == 0) {
200*00c7fec1SAndroid Build Coastguard Worker error(1, 0, "unknown package: %s", pkgname);
201*00c7fec1SAndroid Build Coastguard Worker }
202*00c7fec1SAndroid Build Coastguard Worker
203*00c7fec1SAndroid Build Coastguard Worker // Verify that user id is not too big.
204*00c7fec1SAndroid Build Coastguard Worker if ((UID_MAX - info.uid) / AID_USER_OFFSET < (uid_t)userId) {
205*00c7fec1SAndroid Build Coastguard Worker error(1, 0, "user id too big: %d", userId);
206*00c7fec1SAndroid Build Coastguard Worker }
207*00c7fec1SAndroid Build Coastguard Worker
208*00c7fec1SAndroid Build Coastguard Worker // Calculate user app ID.
209*00c7fec1SAndroid Build Coastguard Worker uid_t userAppId = (AID_USER_OFFSET * userId) + info.uid;
210*00c7fec1SAndroid Build Coastguard Worker
211*00c7fec1SAndroid Build Coastguard Worker // Reject system packages.
212*00c7fec1SAndroid Build Coastguard Worker if (userAppId < AID_APP) {
213*00c7fec1SAndroid Build Coastguard Worker error(1, 0, "package not an application: %s", pkgname);
214*00c7fec1SAndroid Build Coastguard Worker }
215*00c7fec1SAndroid Build Coastguard Worker
216*00c7fec1SAndroid Build Coastguard Worker // Reject any non-debuggable package.
217*00c7fec1SAndroid Build Coastguard Worker if (!info.debuggable) {
218*00c7fec1SAndroid Build Coastguard Worker error(1, 0, "package not debuggable: %s", pkgname);
219*00c7fec1SAndroid Build Coastguard Worker }
220*00c7fec1SAndroid Build Coastguard Worker
221*00c7fec1SAndroid Build Coastguard Worker // Ensure we have the right data path for the specific user.
222*00c7fec1SAndroid Build Coastguard Worker free(info.data_dir);
223*00c7fec1SAndroid Build Coastguard Worker if (asprintf(&info.data_dir, "/data/user/%d/%s", userId, pkgname) == -1) {
224*00c7fec1SAndroid Build Coastguard Worker error(1, errno, "asprintf failed");
225*00c7fec1SAndroid Build Coastguard Worker }
226*00c7fec1SAndroid Build Coastguard Worker
227*00c7fec1SAndroid Build Coastguard Worker // Check that the data directory path is valid.
228*00c7fec1SAndroid Build Coastguard Worker check_data_path(pkgname, info.data_dir, userAppId);
229*00c7fec1SAndroid Build Coastguard Worker
230*00c7fec1SAndroid Build Coastguard Worker // Ensure that we change all real/effective/saved IDs at the
231*00c7fec1SAndroid Build Coastguard Worker // same time to avoid nasty surprises.
232*00c7fec1SAndroid Build Coastguard Worker uid_t uid = userAppId;
233*00c7fec1SAndroid Build Coastguard Worker uid_t gid = userAppId;
234*00c7fec1SAndroid Build Coastguard Worker std::vector<gid_t> supplementary_gids = get_supplementary_gids(userAppId);
235*00c7fec1SAndroid Build Coastguard Worker ScopedMinijail j(minijail_new());
236*00c7fec1SAndroid Build Coastguard Worker minijail_change_uid(j.get(), uid);
237*00c7fec1SAndroid Build Coastguard Worker minijail_change_gid(j.get(), gid);
238*00c7fec1SAndroid Build Coastguard Worker minijail_set_supplementary_gids(j.get(), supplementary_gids.size(), supplementary_gids.data());
239*00c7fec1SAndroid Build Coastguard Worker minijail_enter(j.get());
240*00c7fec1SAndroid Build Coastguard Worker
241*00c7fec1SAndroid Build Coastguard Worker std::string seinfo = std::string(info.seinfo) + ":fromRunAs";
242*00c7fec1SAndroid Build Coastguard Worker if (selinux_android_setcontext(uid, 0, seinfo.c_str(), pkgname) < 0) {
243*00c7fec1SAndroid Build Coastguard Worker error(1, errno, "couldn't set SELinux security context '%s'", seinfo.c_str());
244*00c7fec1SAndroid Build Coastguard Worker }
245*00c7fec1SAndroid Build Coastguard Worker
246*00c7fec1SAndroid Build Coastguard Worker // cd into the data directory, and set $HOME correspondingly.
247*00c7fec1SAndroid Build Coastguard Worker if (TEMP_FAILURE_RETRY(chdir(info.data_dir)) == -1) {
248*00c7fec1SAndroid Build Coastguard Worker error(1, errno, "couldn't chdir to package's data directory '%s'", info.data_dir);
249*00c7fec1SAndroid Build Coastguard Worker }
250*00c7fec1SAndroid Build Coastguard Worker setenv("HOME", info.data_dir, 1);
251*00c7fec1SAndroid Build Coastguard Worker
252*00c7fec1SAndroid Build Coastguard Worker // Reset parts of the environment, like su would.
253*00c7fec1SAndroid Build Coastguard Worker setenv("PATH", _PATH_DEFPATH, 1);
254*00c7fec1SAndroid Build Coastguard Worker unsetenv("IFS");
255*00c7fec1SAndroid Build Coastguard Worker
256*00c7fec1SAndroid Build Coastguard Worker // Set the user-specific parts for this user.
257*00c7fec1SAndroid Build Coastguard Worker passwd* pw = getpwuid(uid);
258*00c7fec1SAndroid Build Coastguard Worker setenv("LOGNAME", pw->pw_name, 1);
259*00c7fec1SAndroid Build Coastguard Worker setenv("SHELL", pw->pw_shell, 1);
260*00c7fec1SAndroid Build Coastguard Worker setenv("USER", pw->pw_name, 1);
261*00c7fec1SAndroid Build Coastguard Worker
262*00c7fec1SAndroid Build Coastguard Worker // User specified command for exec.
263*00c7fec1SAndroid Build Coastguard Worker if ((argc >= cmd_argv_offset + 1) &&
264*00c7fec1SAndroid Build Coastguard Worker (execvp(argv[cmd_argv_offset], argv+cmd_argv_offset) == -1)) {
265*00c7fec1SAndroid Build Coastguard Worker error(1, errno, "exec failed for %s", argv[cmd_argv_offset]);
266*00c7fec1SAndroid Build Coastguard Worker }
267*00c7fec1SAndroid Build Coastguard Worker
268*00c7fec1SAndroid Build Coastguard Worker // Default exec shell.
269*00c7fec1SAndroid Build Coastguard Worker execlp(_PATH_BSHELL, "sh", NULL);
270*00c7fec1SAndroid Build Coastguard Worker error(1, errno, "exec failed");
271*00c7fec1SAndroid Build Coastguard Worker }
272