1#include "idmap.h"
2
3#include <private/android_filesystem_config.h> // for AID_SYSTEM
4
5#include <stdlib.h>
6#include <string.h>
7
8namespace {
9    const char *usage = "NAME\n\
10      idmap - create or display idmap files\n\
11\n\
12SYNOPSIS \n\
13      idmap --help \n\
14      idmap --fd target overlay fd \n\
15      idmap --path target overlay idmap \n\
16      idmap --scan target-package-name-to-look-for path-to-target-apk dir-to-hold-idmaps \\\
17                   dir-to-scan [additional-dir-to-scan [additional-dir-to-scan [...]]]\n\
18      idmap --inspect idmap \n\
19      idmap --verify target overlay fd \n\
20\n\
21DESCRIPTION \n\
22      Idmap files play an integral part in the runtime resource overlay framework. An idmap \n\
23      file contains a mapping of resource identifiers between overlay package and its target \n\
24      package; this mapping is used during resource lookup. Idmap files also act as control \n\
25      files by their existence: if not present, the corresponding overlay package is ignored \n\
26      when the resource context is created. \n\
27\n\
28      Idmap files are stored in /data/resource-cache. For each pair (target package, overlay \n\
29      package), there exists exactly one idmap file, or none if the overlay should not be used. \n\
30\n\
31NOMENCLATURE \n\
32      target: the original, non-overlay, package. Each target package may be associated with \n\
33              any number of overlay packages. \n\
34\n\
35      overlay: an overlay package. Each overlay package is associated with exactly one target \n\
36               package, specified in the overlay's manifest using the <overlay target=\"...\"/> \n\
37               tag. \n\
38\n\
39OPTIONS \n\
40      --help: display this help \n\
41\n\
42      --fd: create idmap for target package 'target' (path to apk) and overlay package 'overlay' \n\
43            (path to apk); write results to file descriptor 'fd' (integer). This invocation \n\
44            version is intended to be used by a parent process with higher privileges to call \n\
45            idmap in a controlled way: the parent will open a suitable file descriptor, fork, \n\
46            drop its privileges and exec. This tool will continue execution without the extra \n\
47            privileges, but still have write access to a file it could not have opened on its \n\
48            own. \n\
49\n\
50      --path: create idmap for target package 'target' (path to apk) and overlay package \n\
51              'overlay' (path to apk); write results to 'idmap' (path). \n\
52\n\
53      --scan: non-recursively search directory 'dir-to-scan' (path) for static overlay packages \n\
54              with target package 'target-package-name-to-look-for' (package name) present at\n\
55              'path-to-target-apk' (path to apk). For each overlay package found, create an\n\
56              idmap file in 'dir-to-hold-idmaps' (path). \n\
57\n\
58      --inspect: decode the binary format of 'idmap' (path) and display the contents in a \n\
59                 debug-friendly format. \n\
60\n\
61      --verify: verify if idmap corresponding to file descriptor 'fd' (integer) is made from \n\
62                target package 'target' (path to apk) and overlay package 'overlay'. \n\
63\n\
64EXAMPLES \n\
65      Create an idmap file: \n\
66\n\
67      $ adb shell idmap --path /system/app/target.apk \\ \n\
68                               /vendor/overlay/overlay.apk \\ \n\
69                               /data/resource-cache/vendor@overlay@overlay.apk@idmap \n\
70\n\
71      Display an idmap file: \n\
72\n\
73      $ adb shell idmap --inspect /data/resource-cache/vendor@overlay@overlay.apk@idmap \n\
74      SECTION      ENTRY        VALUE      COMMENT \n\
75      IDMAP HEADER magic        0x706d6469 \n\
76                   base crc     0xb65a383f \n\
77                   overlay crc  0x7b9675e8 \n\
78                   base path    .......... /path/to/target.apk \n\
79                   overlay path .......... /path/to/overlay.apk \n\
80      DATA HEADER  target pkg   0x0000007f \n\
81                   types count  0x00000003 \n\
82      DATA BLOCK   target type  0x00000002 \n\
83                   overlay type 0x00000002 \n\
84                   entry count  0x00000001 \n\
85                   entry offset 0x00000000 \n\
86                   entry        0x00000000 drawable/drawable \n\
87      DATA BLOCK   target type  0x00000003 \n\
88                   overlay type 0x00000003 \n\
89                   entry count  0x00000001 \n\
90                   entry offset 0x00000000 \n\
91                   entry        0x00000000 xml/integer \n\
92      DATA BLOCK   target type  0x00000004 \n\
93                   overlay type 0x00000004 \n\
94                   entry count  0x00000001 \n\
95                   entry offset 0x00000000 \n\
96                   entry        0x00000000 raw/lorem_ipsum \n\
97\n\
98      In this example, the overlay package provides three alternative resource values:\n\
99      drawable/drawable, xml/integer, and raw/lorem_ipsum \n\
100\n\
101NOTES \n\
102      This tool and its expected invocation from installd is modelled on dexopt.";
103
104    bool verify_directory_readable(const char *path)
105    {
106        return access(path, R_OK | X_OK) == 0;
107    }
108
109    bool verify_directory_writable(const char *path)
110    {
111        return access(path, W_OK) == 0;
112    }
113
114    bool verify_file_readable(const char *path)
115    {
116        return access(path, R_OK) == 0;
117    }
118
119    bool verify_root_or_system()
120    {
121        uid_t uid = getuid();
122        gid_t gid = getgid();
123
124        return (uid == 0 && gid == 0) || (uid == AID_SYSTEM && gid == AID_SYSTEM);
125    }
126
127    int maybe_create_fd(const char *target_apk_path, const char *overlay_apk_path,
128            const char *idmap_str)
129    {
130        // anyone (not just root or system) may do --fd -- the file has
131        // already been opened by someone else on our behalf
132
133        char *endptr;
134        int idmap_fd = strtol(idmap_str, &endptr, 10);
135        if (*endptr != '\0') {
136            fprintf(stderr, "error: failed to parse file descriptor argument %s\n", idmap_str);
137            return -1;
138        }
139
140        if (!verify_file_readable(target_apk_path)) {
141            ALOGD("error: failed to read apk %s: %s\n", target_apk_path, strerror(errno));
142            return -1;
143        }
144
145        if (!verify_file_readable(overlay_apk_path)) {
146            ALOGD("error: failed to read apk %s: %s\n", overlay_apk_path, strerror(errno));
147            return -1;
148        }
149
150        return idmap_create_fd(target_apk_path, overlay_apk_path, idmap_fd);
151    }
152
153    int maybe_create_path(const char *target_apk_path, const char *overlay_apk_path,
154            const char *idmap_path)
155    {
156        if (!verify_root_or_system()) {
157            fprintf(stderr, "error: permission denied: not user root or user system\n");
158            return -1;
159        }
160
161        if (!verify_file_readable(target_apk_path)) {
162            ALOGD("error: failed to read apk %s: %s\n", target_apk_path, strerror(errno));
163            return -1;
164        }
165
166        if (!verify_file_readable(overlay_apk_path)) {
167            ALOGD("error: failed to read apk %s: %s\n", overlay_apk_path, strerror(errno));
168            return -1;
169        }
170
171        return idmap_create_path(target_apk_path, overlay_apk_path, idmap_path);
172    }
173
174    int maybe_verify_fd(const char *target_apk_path, const char *overlay_apk_path,
175            const char *idmap_str)
176    {
177        char *endptr;
178        int idmap_fd = strtol(idmap_str, &endptr, 10);
179        if (*endptr != '\0') {
180            fprintf(stderr, "error: failed to parse file descriptor argument %s\n", idmap_str);
181            return -1;
182        }
183
184        if (!verify_file_readable(target_apk_path)) {
185            ALOGD("error: failed to read apk %s: %s\n", target_apk_path, strerror(errno));
186            return -1;
187        }
188
189        if (!verify_file_readable(overlay_apk_path)) {
190            ALOGD("error: failed to read apk %s: %s\n", overlay_apk_path, strerror(errno));
191            return -1;
192        }
193
194        return idmap_verify_fd(target_apk_path, overlay_apk_path, idmap_fd);
195    }
196
197    int maybe_scan(const char *target_package_name, const char *target_apk_path,
198            const char *idmap_dir, const android::Vector<const char *> *overlay_dirs)
199    {
200        if (!verify_root_or_system()) {
201            fprintf(stderr, "error: permission denied: not user root or user system\n");
202            return -1;
203        }
204
205        if (!verify_file_readable(target_apk_path)) {
206            ALOGD("error: failed to read apk %s: %s\n", target_apk_path, strerror(errno));
207            return -1;
208        }
209
210        if (!verify_directory_writable(idmap_dir)) {
211            ALOGD("error: no write access to %s: %s\n", idmap_dir, strerror(errno));
212            return -1;
213        }
214
215        const size_t N = overlay_dirs->size();
216        for (size_t i = 0; i < N; i++) {
217            const char *dir = overlay_dirs->itemAt(i);
218            if (!verify_directory_readable(dir)) {
219                ALOGD("error: no read access to %s: %s\n", dir, strerror(errno));
220                return -1;
221            }
222        }
223
224        return idmap_scan(target_package_name, target_apk_path, idmap_dir, overlay_dirs);
225    }
226
227    int maybe_inspect(const char *idmap_path)
228    {
229        // anyone (not just root or system) may do --inspect
230        if (!verify_file_readable(idmap_path)) {
231            ALOGD("error: failed to read idmap %s: %s\n", idmap_path, strerror(errno));
232            return -1;
233        }
234        return idmap_inspect(idmap_path);
235    }
236}
237
238int main(int argc, char **argv)
239{
240#if 0
241    {
242        char buf[1024];
243        buf[0] = '\0';
244        for (int i = 0; i < argc; ++i) {
245            strncat(buf, argv[i], sizeof(buf) - 1);
246            strncat(buf, " ", sizeof(buf) - 1);
247        }
248        ALOGD("%s:%d: uid=%d gid=%d argv=%s\n", __FILE__, __LINE__, getuid(), getgid(), buf);
249    }
250#endif
251
252    if (argc == 2 && !strcmp(argv[1], "--help")) {
253        printf("%s\n", usage);
254        return 0;
255    }
256
257    if (argc == 5 && !strcmp(argv[1], "--fd")) {
258        return maybe_create_fd(argv[2], argv[3], argv[4]);
259    }
260
261    if (argc == 5 && !strcmp(argv[1], "--path")) {
262        return maybe_create_path(argv[2], argv[3], argv[4]);
263    }
264
265    if (argc == 5 && !strcmp(argv[1], "--verify")) {
266        return maybe_verify_fd(argv[2], argv[3], argv[4]);
267    }
268
269    if (argc >= 6 && !strcmp(argv[1], "--scan")) {
270        android::Vector<const char *> v;
271        for (int i = 5; i < argc; i++) {
272            v.push(argv[i]);
273        }
274        return maybe_scan(argv[2], argv[3], argv[4], &v);
275    }
276
277    if (argc == 3 && !strcmp(argv[1], "--inspect")) {
278        return maybe_inspect(argv[2]);
279    }
280
281    fprintf(stderr, "Usage: don't use this (cf dexopt usage).\n");
282    return EXIT_FAILURE;
283}
284