sdcard.c revision a5a4e9e0cad383f0c14dbe92a60b7d8150ae6b1f
1/* 2 * Copyright (C) 2010 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17#define LOG_TAG "sdcard" 18 19#include <ctype.h> 20#include <dirent.h> 21#include <errno.h> 22#include <fcntl.h> 23#include <inttypes.h> 24#include <limits.h> 25#include <linux/fuse.h> 26#include <pthread.h> 27#include <stdio.h> 28#include <stdlib.h> 29#include <string.h> 30#include <sys/inotify.h> 31#include <sys/mount.h> 32#include <sys/resource.h> 33#include <sys/stat.h> 34#include <sys/statfs.h> 35#include <sys/time.h> 36#include <sys/uio.h> 37#include <unistd.h> 38 39#include <cutils/fs.h> 40#include <cutils/hashmap.h> 41#include <cutils/log.h> 42#include <cutils/multiuser.h> 43 44#include <private/android_filesystem_config.h> 45 46/* README 47 * 48 * What is this? 49 * 50 * sdcard is a program that uses FUSE to emulate FAT-on-sdcard style 51 * directory permissions (all files are given fixed owner, group, and 52 * permissions at creation, owner, group, and permissions are not 53 * changeable, symlinks and hardlinks are not createable, etc. 54 * 55 * See usage() for command line options. 56 * 57 * It must be run as root, but will drop to requested UID/GID as soon as it 58 * mounts a filesystem. It will refuse to run if requested UID/GID are zero. 59 * 60 * Things I believe to be true: 61 * 62 * - ops that return a fuse_entry (LOOKUP, MKNOD, MKDIR, LINK, SYMLINK, 63 * CREAT) must bump that node's refcount 64 * - don't forget that FORGET can forget multiple references (req->nlookup) 65 * - if an op that returns a fuse_entry fails writing the reply to the 66 * kernel, you must rollback the refcount to reflect the reference the 67 * kernel did not actually acquire 68 * 69 * This daemon can also derive custom filesystem permissions based on directory 70 * structure when requested. These custom permissions support several features: 71 * 72 * - Apps can access their own files in /Android/data/com.example/ without 73 * requiring any additional GIDs. 74 * - Separate permissions for protecting directories like Pictures and Music. 75 * - Multi-user separation on the same physical device. 76 * 77 * The derived permissions look like this: 78 * 79 * rwxrwx--x root:sdcard_rw / 80 * rwxrwx--- root:sdcard_pics /Pictures 81 * rwxrwx--- root:sdcard_av /Music 82 * 83 * rwxrwx--x root:sdcard_rw /Android 84 * rwxrwx--x root:sdcard_rw /Android/data 85 * rwxrwx--- u0_a12:sdcard_rw /Android/data/com.example 86 * rwxrwx--x root:sdcard_rw /Android/obb/ 87 * rwxrwx--- u0_a12:sdcard_rw /Android/obb/com.example 88 * 89 * rwxrwx--- root:sdcard_all /Android/user 90 * rwxrwx--x root:sdcard_rw /Android/user/10 91 * rwxrwx--- u10_a12:sdcard_rw /Android/user/10/Android/data/com.example 92 */ 93 94#define FUSE_TRACE 0 95 96#if FUSE_TRACE 97#define TRACE(x...) ALOGD(x) 98#else 99#define TRACE(x...) do {} while (0) 100#endif 101 102#define ERROR(x...) ALOGE(x) 103 104#define FUSE_UNKNOWN_INO 0xffffffff 105 106/* Maximum number of bytes to write in one request. */ 107#define MAX_WRITE (256 * 1024) 108 109/* Maximum number of bytes to read in one request. */ 110#define MAX_READ (128 * 1024) 111 112/* Largest possible request. 113 * The request size is bounded by the maximum size of a FUSE_WRITE request because it has 114 * the largest possible data payload. */ 115#define MAX_REQUEST_SIZE (sizeof(struct fuse_in_header) + sizeof(struct fuse_write_in) + MAX_WRITE) 116 117/* Default number of threads. */ 118#define DEFAULT_NUM_THREADS 2 119 120/* Pseudo-error constant used to indicate that no fuse status is needed 121 * or that a reply has already been written. */ 122#define NO_STATUS 1 123 124/* Path to system-provided mapping of package name to appIds */ 125static const char* const kPackagesListFile = "/data/system/packages.list"; 126 127/* Supplementary groups to execute with */ 128static const gid_t kGroups[1] = { AID_PACKAGE_INFO }; 129 130/* Permission mode for a specific node. Controls how file permissions 131 * are derived for children nodes. */ 132typedef enum { 133 /* Nothing special; this node should just inherit from its parent. */ 134 PERM_INHERIT, 135 /* This node is one level above a normal root; used for legacy layouts 136 * which use the first level to represent user_id. */ 137 PERM_LEGACY_PRE_ROOT, 138 /* This node is "/" */ 139 PERM_ROOT, 140 /* This node is "/Android" */ 141 PERM_ANDROID, 142 /* This node is "/Android/data" */ 143 PERM_ANDROID_DATA, 144 /* This node is "/Android/obb" */ 145 PERM_ANDROID_OBB, 146 /* This node is "/Android/media" */ 147 PERM_ANDROID_MEDIA, 148 /* This node is "/Android/user" */ 149 PERM_ANDROID_USER, 150} perm_t; 151 152/* Permissions structure to derive */ 153typedef enum { 154 DERIVE_NONE, 155 DERIVE_LEGACY, 156 DERIVE_UNIFIED, 157} derive_t; 158 159struct handle { 160 int fd; 161}; 162 163struct dirhandle { 164 DIR *d; 165}; 166 167struct node { 168 __u32 refcount; 169 __u64 nid; 170 __u64 gen; 171 172 /* State derived based on current position in hierarchy. */ 173 perm_t perm; 174 userid_t userid; 175 uid_t uid; 176 gid_t gid; 177 mode_t mode; 178 179 struct node *next; /* per-dir sibling list */ 180 struct node *child; /* first contained file by this dir */ 181 struct node *parent; /* containing directory */ 182 183 size_t namelen; 184 char *name; 185 /* If non-null, this is the real name of the file in the underlying storage. 186 * This may differ from the field "name" only by case. 187 * strlen(actual_name) will always equal strlen(name), so it is safe to use 188 * namelen for both fields. 189 */ 190 char *actual_name; 191 192 /* If non-null, an exact underlying path that should be grafted into this 193 * position. Used to support things like OBB. */ 194 char* graft_path; 195 size_t graft_pathlen; 196}; 197 198static int str_hash(void *key) { 199 return hashmapHash(key, strlen(key)); 200} 201 202/** Test if two string keys are equal ignoring case */ 203static bool str_icase_equals(void *keyA, void *keyB) { 204 return strcasecmp(keyA, keyB) == 0; 205} 206 207static int int_hash(void *key) { 208 return (int) (uintptr_t) key; 209} 210 211static bool int_equals(void *keyA, void *keyB) { 212 return keyA == keyB; 213} 214 215/* Global data structure shared by all fuse handlers. */ 216struct fuse { 217 pthread_mutex_t lock; 218 219 __u64 next_generation; 220 int fd; 221 derive_t derive; 222 bool split_perms; 223 gid_t write_gid; 224 struct node root; 225 char obbpath[PATH_MAX]; 226 227 Hashmap* package_to_appid; 228 Hashmap* appid_with_rw; 229}; 230 231/* Private data used by a single fuse handler. */ 232struct fuse_handler { 233 struct fuse* fuse; 234 int token; 235 236 /* To save memory, we never use the contents of the request buffer and the read 237 * buffer at the same time. This allows us to share the underlying storage. */ 238 union { 239 __u8 request_buffer[MAX_REQUEST_SIZE]; 240 __u8 read_buffer[MAX_READ + PAGESIZE]; 241 }; 242}; 243 244static inline void *id_to_ptr(__u64 nid) 245{ 246 return (void *) (uintptr_t) nid; 247} 248 249static inline __u64 ptr_to_id(void *ptr) 250{ 251 return (__u64) (uintptr_t) ptr; 252} 253 254static void acquire_node_locked(struct node* node) 255{ 256 node->refcount++; 257 TRACE("ACQUIRE %p (%s) rc=%d\n", node, node->name, node->refcount); 258} 259 260static void remove_node_from_parent_locked(struct node* node); 261 262static void release_node_locked(struct node* node) 263{ 264 TRACE("RELEASE %p (%s) rc=%d\n", node, node->name, node->refcount); 265 if (node->refcount > 0) { 266 node->refcount--; 267 if (!node->refcount) { 268 TRACE("DESTROY %p (%s)\n", node, node->name); 269 remove_node_from_parent_locked(node); 270 271 /* TODO: remove debugging - poison memory */ 272 memset(node->name, 0xef, node->namelen); 273 free(node->name); 274 free(node->actual_name); 275 memset(node, 0xfc, sizeof(*node)); 276 free(node); 277 } 278 } else { 279 ERROR("Zero refcnt %p\n", node); 280 } 281} 282 283static void add_node_to_parent_locked(struct node *node, struct node *parent) { 284 node->parent = parent; 285 node->next = parent->child; 286 parent->child = node; 287 acquire_node_locked(parent); 288} 289 290static void remove_node_from_parent_locked(struct node* node) 291{ 292 if (node->parent) { 293 if (node->parent->child == node) { 294 node->parent->child = node->parent->child->next; 295 } else { 296 struct node *node2; 297 node2 = node->parent->child; 298 while (node2->next != node) 299 node2 = node2->next; 300 node2->next = node->next; 301 } 302 release_node_locked(node->parent); 303 node->parent = NULL; 304 node->next = NULL; 305 } 306} 307 308/* Gets the absolute path to a node into the provided buffer. 309 * 310 * Populates 'buf' with the path and returns the length of the path on success, 311 * or returns -1 if the path is too long for the provided buffer. 312 */ 313static ssize_t get_node_path_locked(struct node* node, char* buf, size_t bufsize) { 314 const char* name; 315 size_t namelen; 316 if (node->graft_path) { 317 name = node->graft_path; 318 namelen = node->graft_pathlen; 319 } else if (node->actual_name) { 320 name = node->actual_name; 321 namelen = node->namelen; 322 } else { 323 name = node->name; 324 namelen = node->namelen; 325 } 326 327 if (bufsize < namelen + 1) { 328 return -1; 329 } 330 331 ssize_t pathlen = 0; 332 if (node->parent && node->graft_path == NULL) { 333 pathlen = get_node_path_locked(node->parent, buf, bufsize - namelen - 2); 334 if (pathlen < 0) { 335 return -1; 336 } 337 buf[pathlen++] = '/'; 338 } 339 340 memcpy(buf + pathlen, name, namelen + 1); /* include trailing \0 */ 341 return pathlen + namelen; 342} 343 344/* Finds the absolute path of a file within a given directory. 345 * Performs a case-insensitive search for the file and sets the buffer to the path 346 * of the first matching file. If 'search' is zero or if no match is found, sets 347 * the buffer to the path that the file would have, assuming the name were case-sensitive. 348 * 349 * Populates 'buf' with the path and returns the actual name (within 'buf') on success, 350 * or returns NULL if the path is too long for the provided buffer. 351 */ 352static char* find_file_within(const char* path, const char* name, 353 char* buf, size_t bufsize, int search) 354{ 355 size_t pathlen = strlen(path); 356 size_t namelen = strlen(name); 357 size_t childlen = pathlen + namelen + 1; 358 char* actual; 359 360 if (bufsize <= childlen) { 361 return NULL; 362 } 363 364 memcpy(buf, path, pathlen); 365 buf[pathlen] = '/'; 366 actual = buf + pathlen + 1; 367 memcpy(actual, name, namelen + 1); 368 369 if (search && access(buf, F_OK)) { 370 struct dirent* entry; 371 DIR* dir = opendir(path); 372 if (!dir) { 373 ERROR("opendir %s failed: %s\n", path, strerror(errno)); 374 return actual; 375 } 376 while ((entry = readdir(dir))) { 377 if (!strcasecmp(entry->d_name, name)) { 378 /* we have a match - replace the name, don't need to copy the null again */ 379 memcpy(actual, entry->d_name, namelen); 380 break; 381 } 382 } 383 closedir(dir); 384 } 385 return actual; 386} 387 388static void attr_from_stat(struct fuse_attr *attr, const struct stat *s, const struct node* node) 389{ 390 attr->ino = node->nid; 391 attr->size = s->st_size; 392 attr->blocks = s->st_blocks; 393 attr->atime = s->st_atime; 394 attr->mtime = s->st_mtime; 395 attr->ctime = s->st_ctime; 396 attr->atimensec = s->st_atime_nsec; 397 attr->mtimensec = s->st_mtime_nsec; 398 attr->ctimensec = s->st_ctime_nsec; 399 attr->mode = s->st_mode; 400 attr->nlink = s->st_nlink; 401 402 attr->uid = node->uid; 403 attr->gid = node->gid; 404 405 /* Filter requested mode based on underlying file, and 406 * pass through file type. */ 407 int owner_mode = s->st_mode & 0700; 408 int filtered_mode = node->mode & (owner_mode | (owner_mode >> 3) | (owner_mode >> 6)); 409 attr->mode = (attr->mode & S_IFMT) | filtered_mode; 410} 411 412static int touch(char* path, mode_t mode) { 413 int fd = open(path, O_RDWR | O_CREAT | O_EXCL | O_NOFOLLOW, mode); 414 if (fd == -1) { 415 if (errno == EEXIST) { 416 return 0; 417 } else { 418 ERROR("Failed to open(%s): %s\n", path, strerror(errno)); 419 return -1; 420 } 421 } 422 close(fd); 423 return 0; 424} 425 426static void derive_permissions_locked(struct fuse* fuse, struct node *parent, 427 struct node *node) { 428 appid_t appid; 429 430 /* By default, each node inherits from its parent */ 431 node->perm = PERM_INHERIT; 432 node->userid = parent->userid; 433 node->uid = parent->uid; 434 node->gid = parent->gid; 435 node->mode = parent->mode; 436 437 if (fuse->derive == DERIVE_NONE) { 438 return; 439 } 440 441 /* Derive custom permissions based on parent and current node */ 442 switch (parent->perm) { 443 case PERM_INHERIT: 444 /* Already inherited above */ 445 break; 446 case PERM_LEGACY_PRE_ROOT: 447 /* Legacy internal layout places users at top level */ 448 node->perm = PERM_ROOT; 449 node->userid = strtoul(node->name, NULL, 10); 450 break; 451 case PERM_ROOT: 452 /* Assume masked off by default. */ 453 node->mode = 0770; 454 if (!strcasecmp(node->name, "Android")) { 455 /* App-specific directories inside; let anyone traverse */ 456 node->perm = PERM_ANDROID; 457 node->mode = 0771; 458 } else if (fuse->split_perms) { 459 if (!strcasecmp(node->name, "DCIM") 460 || !strcasecmp(node->name, "Pictures")) { 461 node->gid = AID_SDCARD_PICS; 462 } else if (!strcasecmp(node->name, "Alarms") 463 || !strcasecmp(node->name, "Movies") 464 || !strcasecmp(node->name, "Music") 465 || !strcasecmp(node->name, "Notifications") 466 || !strcasecmp(node->name, "Podcasts") 467 || !strcasecmp(node->name, "Ringtones")) { 468 node->gid = AID_SDCARD_AV; 469 } 470 } 471 break; 472 case PERM_ANDROID: 473 if (!strcasecmp(node->name, "data")) { 474 /* App-specific directories inside; let anyone traverse */ 475 node->perm = PERM_ANDROID_DATA; 476 node->mode = 0771; 477 } else if (!strcasecmp(node->name, "obb")) { 478 /* App-specific directories inside; let anyone traverse */ 479 node->perm = PERM_ANDROID_OBB; 480 node->mode = 0771; 481 /* Single OBB directory is always shared */ 482 node->graft_path = fuse->obbpath; 483 node->graft_pathlen = strlen(fuse->obbpath); 484 } else if (!strcasecmp(node->name, "media")) { 485 /* App-specific directories inside; let anyone traverse */ 486 node->perm = PERM_ANDROID_MEDIA; 487 node->mode = 0771; 488 } else if (!strcasecmp(node->name, "user")) { 489 /* User directories must only be accessible to system, protected 490 * by sdcard_all. Zygote will bind mount the appropriate user- 491 * specific path. */ 492 node->perm = PERM_ANDROID_USER; 493 node->gid = AID_SDCARD_ALL; 494 node->mode = 0770; 495 } 496 break; 497 case PERM_ANDROID_DATA: 498 case PERM_ANDROID_OBB: 499 case PERM_ANDROID_MEDIA: 500 appid = (appid_t) (uintptr_t) hashmapGet(fuse->package_to_appid, node->name); 501 if (appid != 0) { 502 node->uid = multiuser_get_uid(parent->userid, appid); 503 } 504 node->mode = 0770; 505 break; 506 case PERM_ANDROID_USER: 507 /* Root of a secondary user */ 508 node->perm = PERM_ROOT; 509 node->userid = strtoul(node->name, NULL, 10); 510 node->gid = AID_SDCARD_R; 511 node->mode = 0771; 512 break; 513 } 514} 515 516/* Return if the calling UID holds sdcard_rw. */ 517static bool get_caller_has_rw_locked(struct fuse* fuse, const struct fuse_in_header *hdr) { 518 /* No additional permissions enforcement */ 519 if (fuse->derive == DERIVE_NONE) { 520 return true; 521 } 522 523 appid_t appid = multiuser_get_app_id(hdr->uid); 524 return hashmapContainsKey(fuse->appid_with_rw, (void*) (uintptr_t) appid); 525} 526 527/* Kernel has already enforced everything we returned through 528 * derive_permissions_locked(), so this is used to lock down access 529 * even further, such as enforcing that apps hold sdcard_rw. */ 530static bool check_caller_access_to_name(struct fuse* fuse, 531 const struct fuse_in_header *hdr, const struct node* parent_node, 532 const char* name, int mode, bool has_rw) { 533 /* Always block security-sensitive files at root */ 534 if (parent_node && parent_node->perm == PERM_ROOT) { 535 if (!strcasecmp(name, "autorun.inf") 536 || !strcasecmp(name, ".android_secure") 537 || !strcasecmp(name, "android_secure")) { 538 return false; 539 } 540 } 541 542 /* No additional permissions enforcement */ 543 if (fuse->derive == DERIVE_NONE) { 544 return true; 545 } 546 547 /* Root always has access; access for any other UIDs should always 548 * be controlled through packages.list. */ 549 if (hdr->uid == 0) { 550 return true; 551 } 552 553 /* If asking to write, verify that caller either owns the 554 * parent or holds sdcard_rw. */ 555 if (mode & W_OK) { 556 if (parent_node && hdr->uid == parent_node->uid) { 557 return true; 558 } 559 560 return has_rw; 561 } 562 563 /* No extra permissions to enforce */ 564 return true; 565} 566 567static bool check_caller_access_to_node(struct fuse* fuse, 568 const struct fuse_in_header *hdr, const struct node* node, int mode, bool has_rw) { 569 return check_caller_access_to_name(fuse, hdr, node->parent, node->name, mode, has_rw); 570} 571 572struct node *create_node_locked(struct fuse* fuse, 573 struct node *parent, const char *name, const char* actual_name) 574{ 575 struct node *node; 576 size_t namelen = strlen(name); 577 578 node = calloc(1, sizeof(struct node)); 579 if (!node) { 580 return NULL; 581 } 582 node->name = malloc(namelen + 1); 583 if (!node->name) { 584 free(node); 585 return NULL; 586 } 587 memcpy(node->name, name, namelen + 1); 588 if (strcmp(name, actual_name)) { 589 node->actual_name = malloc(namelen + 1); 590 if (!node->actual_name) { 591 free(node->name); 592 free(node); 593 return NULL; 594 } 595 memcpy(node->actual_name, actual_name, namelen + 1); 596 } 597 node->namelen = namelen; 598 node->nid = ptr_to_id(node); 599 node->gen = fuse->next_generation++; 600 601 derive_permissions_locked(fuse, parent, node); 602 acquire_node_locked(node); 603 add_node_to_parent_locked(node, parent); 604 return node; 605} 606 607static int rename_node_locked(struct node *node, const char *name, 608 const char* actual_name) 609{ 610 size_t namelen = strlen(name); 611 int need_actual_name = strcmp(name, actual_name); 612 613 /* make the storage bigger without actually changing the name 614 * in case an error occurs part way */ 615 if (namelen > node->namelen) { 616 char* new_name = realloc(node->name, namelen + 1); 617 if (!new_name) { 618 return -ENOMEM; 619 } 620 node->name = new_name; 621 if (need_actual_name && node->actual_name) { 622 char* new_actual_name = realloc(node->actual_name, namelen + 1); 623 if (!new_actual_name) { 624 return -ENOMEM; 625 } 626 node->actual_name = new_actual_name; 627 } 628 } 629 630 /* update the name, taking care to allocate storage before overwriting the old name */ 631 if (need_actual_name) { 632 if (!node->actual_name) { 633 node->actual_name = malloc(namelen + 1); 634 if (!node->actual_name) { 635 return -ENOMEM; 636 } 637 } 638 memcpy(node->actual_name, actual_name, namelen + 1); 639 } else { 640 free(node->actual_name); 641 node->actual_name = NULL; 642 } 643 memcpy(node->name, name, namelen + 1); 644 node->namelen = namelen; 645 return 0; 646} 647 648static struct node *lookup_node_by_id_locked(struct fuse *fuse, __u64 nid) 649{ 650 if (nid == FUSE_ROOT_ID) { 651 return &fuse->root; 652 } else { 653 return id_to_ptr(nid); 654 } 655} 656 657static struct node* lookup_node_and_path_by_id_locked(struct fuse* fuse, __u64 nid, 658 char* buf, size_t bufsize) 659{ 660 struct node* node = lookup_node_by_id_locked(fuse, nid); 661 if (node && get_node_path_locked(node, buf, bufsize) < 0) { 662 node = NULL; 663 } 664 return node; 665} 666 667static struct node *lookup_child_by_name_locked(struct node *node, const char *name) 668{ 669 for (node = node->child; node; node = node->next) { 670 /* use exact string comparison, nodes that differ by case 671 * must be considered distinct even if they refer to the same 672 * underlying file as otherwise operations such as "mv x x" 673 * will not work because the source and target nodes are the same. */ 674 if (!strcmp(name, node->name)) { 675 return node; 676 } 677 } 678 return 0; 679} 680 681static struct node* acquire_or_create_child_locked( 682 struct fuse* fuse, struct node* parent, 683 const char* name, const char* actual_name) 684{ 685 struct node* child = lookup_child_by_name_locked(parent, name); 686 if (child) { 687 acquire_node_locked(child); 688 } else { 689 child = create_node_locked(fuse, parent, name, actual_name); 690 } 691 return child; 692} 693 694static void fuse_init(struct fuse *fuse, int fd, const char *source_path, 695 gid_t write_gid, derive_t derive, bool split_perms) { 696 pthread_mutex_init(&fuse->lock, NULL); 697 698 fuse->fd = fd; 699 fuse->next_generation = 0; 700 fuse->derive = derive; 701 fuse->split_perms = split_perms; 702 fuse->write_gid = write_gid; 703 704 memset(&fuse->root, 0, sizeof(fuse->root)); 705 fuse->root.nid = FUSE_ROOT_ID; /* 1 */ 706 fuse->root.refcount = 2; 707 fuse->root.namelen = strlen(source_path); 708 fuse->root.name = strdup(source_path); 709 fuse->root.userid = 0; 710 fuse->root.uid = AID_ROOT; 711 712 /* Set up root node for various modes of operation */ 713 switch (derive) { 714 case DERIVE_NONE: 715 /* Traditional behavior that treats entire device as being accessible 716 * to sdcard_rw, and no permissions are derived. */ 717 fuse->root.perm = PERM_ROOT; 718 fuse->root.mode = 0775; 719 fuse->root.gid = AID_SDCARD_RW; 720 break; 721 case DERIVE_LEGACY: 722 /* Legacy behavior used to support internal multiuser layout which 723 * places user_id at the top directory level, with the actual roots 724 * just below that. Shared OBB path is also at top level. */ 725 fuse->root.perm = PERM_LEGACY_PRE_ROOT; 726 fuse->root.mode = 0771; 727 fuse->root.gid = AID_SDCARD_R; 728 fuse->package_to_appid = hashmapCreate(256, str_hash, str_icase_equals); 729 fuse->appid_with_rw = hashmapCreate(128, int_hash, int_equals); 730 snprintf(fuse->obbpath, sizeof(fuse->obbpath), "%s/obb", source_path); 731 fs_prepare_dir(fuse->obbpath, 0775, getuid(), getgid()); 732 break; 733 case DERIVE_UNIFIED: 734 /* Unified multiuser layout which places secondary user_id under 735 * /Android/user and shared OBB path under /Android/obb. */ 736 fuse->root.perm = PERM_ROOT; 737 fuse->root.mode = 0771; 738 fuse->root.gid = AID_SDCARD_R; 739 fuse->package_to_appid = hashmapCreate(256, str_hash, str_icase_equals); 740 fuse->appid_with_rw = hashmapCreate(128, int_hash, int_equals); 741 snprintf(fuse->obbpath, sizeof(fuse->obbpath), "%s/Android/obb", source_path); 742 break; 743 } 744} 745 746static void fuse_status(struct fuse *fuse, __u64 unique, int err) 747{ 748 struct fuse_out_header hdr; 749 hdr.len = sizeof(hdr); 750 hdr.error = err; 751 hdr.unique = unique; 752 write(fuse->fd, &hdr, sizeof(hdr)); 753} 754 755static void fuse_reply(struct fuse *fuse, __u64 unique, void *data, int len) 756{ 757 struct fuse_out_header hdr; 758 struct iovec vec[2]; 759 int res; 760 761 hdr.len = len + sizeof(hdr); 762 hdr.error = 0; 763 hdr.unique = unique; 764 765 vec[0].iov_base = &hdr; 766 vec[0].iov_len = sizeof(hdr); 767 vec[1].iov_base = data; 768 vec[1].iov_len = len; 769 770 res = writev(fuse->fd, vec, 2); 771 if (res < 0) { 772 ERROR("*** REPLY FAILED *** %d\n", errno); 773 } 774} 775 776static int fuse_reply_entry(struct fuse* fuse, __u64 unique, 777 struct node* parent, const char* name, const char* actual_name, 778 const char* path) 779{ 780 struct node* node; 781 struct fuse_entry_out out; 782 struct stat s; 783 784 if (lstat(path, &s) < 0) { 785 return -errno; 786 } 787 788 pthread_mutex_lock(&fuse->lock); 789 node = acquire_or_create_child_locked(fuse, parent, name, actual_name); 790 if (!node) { 791 pthread_mutex_unlock(&fuse->lock); 792 return -ENOMEM; 793 } 794 memset(&out, 0, sizeof(out)); 795 attr_from_stat(&out.attr, &s, node); 796 out.attr_valid = 10; 797 out.entry_valid = 10; 798 out.nodeid = node->nid; 799 out.generation = node->gen; 800 pthread_mutex_unlock(&fuse->lock); 801 fuse_reply(fuse, unique, &out, sizeof(out)); 802 return NO_STATUS; 803} 804 805static int fuse_reply_attr(struct fuse* fuse, __u64 unique, const struct node* node, 806 const char* path) 807{ 808 struct fuse_attr_out out; 809 struct stat s; 810 811 if (lstat(path, &s) < 0) { 812 return -errno; 813 } 814 memset(&out, 0, sizeof(out)); 815 attr_from_stat(&out.attr, &s, node); 816 out.attr_valid = 10; 817 fuse_reply(fuse, unique, &out, sizeof(out)); 818 return NO_STATUS; 819} 820 821static int handle_lookup(struct fuse* fuse, struct fuse_handler* handler, 822 const struct fuse_in_header *hdr, const char* name) 823{ 824 struct node* parent_node; 825 char parent_path[PATH_MAX]; 826 char child_path[PATH_MAX]; 827 const char* actual_name; 828 829 pthread_mutex_lock(&fuse->lock); 830 parent_node = lookup_node_and_path_by_id_locked(fuse, hdr->nodeid, 831 parent_path, sizeof(parent_path)); 832 TRACE("[%d] LOOKUP %s @ %"PRIx64" (%s)\n", handler->token, name, hdr->nodeid, 833 parent_node ? parent_node->name : "?"); 834 pthread_mutex_unlock(&fuse->lock); 835 836 if (!parent_node || !(actual_name = find_file_within(parent_path, name, 837 child_path, sizeof(child_path), 1))) { 838 return -ENOENT; 839 } 840 if (!check_caller_access_to_name(fuse, hdr, parent_node, name, R_OK, false)) { 841 return -EACCES; 842 } 843 844 return fuse_reply_entry(fuse, hdr->unique, parent_node, name, actual_name, child_path); 845} 846 847static int handle_forget(struct fuse* fuse, struct fuse_handler* handler, 848 const struct fuse_in_header *hdr, const struct fuse_forget_in *req) 849{ 850 struct node* node; 851 852 pthread_mutex_lock(&fuse->lock); 853 node = lookup_node_by_id_locked(fuse, hdr->nodeid); 854 TRACE("[%d] FORGET #%"PRIu64" @ %"PRIx64" (%s)\n", handler->token, req->nlookup, 855 hdr->nodeid, node ? node->name : "?"); 856 if (node) { 857 __u64 n = req->nlookup; 858 while (n--) { 859 release_node_locked(node); 860 } 861 } 862 pthread_mutex_unlock(&fuse->lock); 863 return NO_STATUS; /* no reply */ 864} 865 866static int handle_getattr(struct fuse* fuse, struct fuse_handler* handler, 867 const struct fuse_in_header *hdr, const struct fuse_getattr_in *req) 868{ 869 struct node* node; 870 char path[PATH_MAX]; 871 872 pthread_mutex_lock(&fuse->lock); 873 node = lookup_node_and_path_by_id_locked(fuse, hdr->nodeid, path, sizeof(path)); 874 TRACE("[%d] GETATTR flags=%x fh=%"PRIx64" @ %"PRIx64" (%s)\n", handler->token, 875 req->getattr_flags, req->fh, hdr->nodeid, node ? node->name : "?"); 876 pthread_mutex_unlock(&fuse->lock); 877 878 if (!node) { 879 return -ENOENT; 880 } 881 if (!check_caller_access_to_node(fuse, hdr, node, R_OK, false)) { 882 return -EACCES; 883 } 884 885 return fuse_reply_attr(fuse, hdr->unique, node, path); 886} 887 888static int handle_setattr(struct fuse* fuse, struct fuse_handler* handler, 889 const struct fuse_in_header *hdr, const struct fuse_setattr_in *req) 890{ 891 bool has_rw; 892 struct node* node; 893 char path[PATH_MAX]; 894 struct timespec times[2]; 895 896 pthread_mutex_lock(&fuse->lock); 897 has_rw = get_caller_has_rw_locked(fuse, hdr); 898 node = lookup_node_and_path_by_id_locked(fuse, hdr->nodeid, path, sizeof(path)); 899 TRACE("[%d] SETATTR fh=%"PRIx64" valid=%x @ %"PRIx64" (%s)\n", handler->token, 900 req->fh, req->valid, hdr->nodeid, node ? node->name : "?"); 901 pthread_mutex_unlock(&fuse->lock); 902 903 if (!node) { 904 return -ENOENT; 905 } 906 if (!check_caller_access_to_node(fuse, hdr, node, W_OK, has_rw)) { 907 return -EACCES; 908 } 909 910 /* XXX: incomplete implementation on purpose. 911 * chmod/chown should NEVER be implemented.*/ 912 913 if ((req->valid & FATTR_SIZE) && truncate64(path, req->size) < 0) { 914 return -errno; 915 } 916 917 /* Handle changing atime and mtime. If FATTR_ATIME_and FATTR_ATIME_NOW 918 * are both set, then set it to the current time. Else, set it to the 919 * time specified in the request. Same goes for mtime. Use utimensat(2) 920 * as it allows ATIME and MTIME to be changed independently, and has 921 * nanosecond resolution which fuse also has. 922 */ 923 if (req->valid & (FATTR_ATIME | FATTR_MTIME)) { 924 times[0].tv_nsec = UTIME_OMIT; 925 times[1].tv_nsec = UTIME_OMIT; 926 if (req->valid & FATTR_ATIME) { 927 if (req->valid & FATTR_ATIME_NOW) { 928 times[0].tv_nsec = UTIME_NOW; 929 } else { 930 times[0].tv_sec = req->atime; 931 times[0].tv_nsec = req->atimensec; 932 } 933 } 934 if (req->valid & FATTR_MTIME) { 935 if (req->valid & FATTR_MTIME_NOW) { 936 times[1].tv_nsec = UTIME_NOW; 937 } else { 938 times[1].tv_sec = req->mtime; 939 times[1].tv_nsec = req->mtimensec; 940 } 941 } 942 TRACE("[%d] Calling utimensat on %s with atime %ld, mtime=%ld\n", 943 handler->token, path, times[0].tv_sec, times[1].tv_sec); 944 if (utimensat(-1, path, times, 0) < 0) { 945 return -errno; 946 } 947 } 948 return fuse_reply_attr(fuse, hdr->unique, node, path); 949} 950 951static int handle_mknod(struct fuse* fuse, struct fuse_handler* handler, 952 const struct fuse_in_header* hdr, const struct fuse_mknod_in* req, const char* name) 953{ 954 bool has_rw; 955 struct node* parent_node; 956 char parent_path[PATH_MAX]; 957 char child_path[PATH_MAX]; 958 const char* actual_name; 959 960 pthread_mutex_lock(&fuse->lock); 961 has_rw = get_caller_has_rw_locked(fuse, hdr); 962 parent_node = lookup_node_and_path_by_id_locked(fuse, hdr->nodeid, 963 parent_path, sizeof(parent_path)); 964 TRACE("[%d] MKNOD %s 0%o @ %"PRIx64" (%s)\n", handler->token, 965 name, req->mode, hdr->nodeid, parent_node ? parent_node->name : "?"); 966 pthread_mutex_unlock(&fuse->lock); 967 968 if (!parent_node || !(actual_name = find_file_within(parent_path, name, 969 child_path, sizeof(child_path), 1))) { 970 return -ENOENT; 971 } 972 if (!check_caller_access_to_name(fuse, hdr, parent_node, name, W_OK, has_rw)) { 973 return -EACCES; 974 } 975 __u32 mode = (req->mode & (~0777)) | 0664; 976 if (mknod(child_path, mode, req->rdev) < 0) { 977 return -errno; 978 } 979 return fuse_reply_entry(fuse, hdr->unique, parent_node, name, actual_name, child_path); 980} 981 982static int handle_mkdir(struct fuse* fuse, struct fuse_handler* handler, 983 const struct fuse_in_header* hdr, const struct fuse_mkdir_in* req, const char* name) 984{ 985 bool has_rw; 986 struct node* parent_node; 987 char parent_path[PATH_MAX]; 988 char child_path[PATH_MAX]; 989 const char* actual_name; 990 991 pthread_mutex_lock(&fuse->lock); 992 has_rw = get_caller_has_rw_locked(fuse, hdr); 993 parent_node = lookup_node_and_path_by_id_locked(fuse, hdr->nodeid, 994 parent_path, sizeof(parent_path)); 995 TRACE("[%d] MKDIR %s 0%o @ %"PRIx64" (%s)\n", handler->token, 996 name, req->mode, hdr->nodeid, parent_node ? parent_node->name : "?"); 997 pthread_mutex_unlock(&fuse->lock); 998 999 if (!parent_node || !(actual_name = find_file_within(parent_path, name, 1000 child_path, sizeof(child_path), 1))) { 1001 return -ENOENT; 1002 } 1003 if (!check_caller_access_to_name(fuse, hdr, parent_node, name, W_OK, has_rw)) { 1004 return -EACCES; 1005 } 1006 __u32 mode = (req->mode & (~0777)) | 0775; 1007 if (mkdir(child_path, mode) < 0) { 1008 return -errno; 1009 } 1010 1011 /* When creating /Android/data and /Android/obb, mark them as .nomedia */ 1012 if (parent_node->perm == PERM_ANDROID && !strcasecmp(name, "data")) { 1013 char nomedia[PATH_MAX]; 1014 snprintf(nomedia, PATH_MAX, "%s/.nomedia", child_path); 1015 if (touch(nomedia, 0664) != 0) { 1016 ERROR("Failed to touch(%s): %s\n", nomedia, strerror(errno)); 1017 return -ENOENT; 1018 } 1019 } 1020 if (parent_node->perm == PERM_ANDROID && !strcasecmp(name, "obb")) { 1021 char nomedia[PATH_MAX]; 1022 snprintf(nomedia, PATH_MAX, "%s/.nomedia", fuse->obbpath); 1023 if (touch(nomedia, 0664) != 0) { 1024 ERROR("Failed to touch(%s): %s\n", nomedia, strerror(errno)); 1025 return -ENOENT; 1026 } 1027 } 1028 1029 return fuse_reply_entry(fuse, hdr->unique, parent_node, name, actual_name, child_path); 1030} 1031 1032static int handle_unlink(struct fuse* fuse, struct fuse_handler* handler, 1033 const struct fuse_in_header* hdr, const char* name) 1034{ 1035 bool has_rw; 1036 struct node* parent_node; 1037 char parent_path[PATH_MAX]; 1038 char child_path[PATH_MAX]; 1039 1040 pthread_mutex_lock(&fuse->lock); 1041 has_rw = get_caller_has_rw_locked(fuse, hdr); 1042 parent_node = lookup_node_and_path_by_id_locked(fuse, hdr->nodeid, 1043 parent_path, sizeof(parent_path)); 1044 TRACE("[%d] UNLINK %s @ %"PRIx64" (%s)\n", handler->token, 1045 name, hdr->nodeid, parent_node ? parent_node->name : "?"); 1046 pthread_mutex_unlock(&fuse->lock); 1047 1048 if (!parent_node || !find_file_within(parent_path, name, 1049 child_path, sizeof(child_path), 1)) { 1050 return -ENOENT; 1051 } 1052 if (!check_caller_access_to_name(fuse, hdr, parent_node, name, W_OK, has_rw)) { 1053 return -EACCES; 1054 } 1055 if (unlink(child_path) < 0) { 1056 return -errno; 1057 } 1058 return 0; 1059} 1060 1061static int handle_rmdir(struct fuse* fuse, struct fuse_handler* handler, 1062 const struct fuse_in_header* hdr, const char* name) 1063{ 1064 bool has_rw; 1065 struct node* parent_node; 1066 char parent_path[PATH_MAX]; 1067 char child_path[PATH_MAX]; 1068 1069 pthread_mutex_lock(&fuse->lock); 1070 has_rw = get_caller_has_rw_locked(fuse, hdr); 1071 parent_node = lookup_node_and_path_by_id_locked(fuse, hdr->nodeid, 1072 parent_path, sizeof(parent_path)); 1073 TRACE("[%d] RMDIR %s @ %"PRIx64" (%s)\n", handler->token, 1074 name, hdr->nodeid, parent_node ? parent_node->name : "?"); 1075 pthread_mutex_unlock(&fuse->lock); 1076 1077 if (!parent_node || !find_file_within(parent_path, name, 1078 child_path, sizeof(child_path), 1)) { 1079 return -ENOENT; 1080 } 1081 if (!check_caller_access_to_name(fuse, hdr, parent_node, name, W_OK, has_rw)) { 1082 return -EACCES; 1083 } 1084 if (rmdir(child_path) < 0) { 1085 return -errno; 1086 } 1087 return 0; 1088} 1089 1090static int handle_rename(struct fuse* fuse, struct fuse_handler* handler, 1091 const struct fuse_in_header* hdr, const struct fuse_rename_in* req, 1092 const char* old_name, const char* new_name) 1093{ 1094 bool has_rw; 1095 struct node* old_parent_node; 1096 struct node* new_parent_node; 1097 struct node* child_node; 1098 char old_parent_path[PATH_MAX]; 1099 char new_parent_path[PATH_MAX]; 1100 char old_child_path[PATH_MAX]; 1101 char new_child_path[PATH_MAX]; 1102 const char* new_actual_name; 1103 int res; 1104 1105 pthread_mutex_lock(&fuse->lock); 1106 has_rw = get_caller_has_rw_locked(fuse, hdr); 1107 old_parent_node = lookup_node_and_path_by_id_locked(fuse, hdr->nodeid, 1108 old_parent_path, sizeof(old_parent_path)); 1109 new_parent_node = lookup_node_and_path_by_id_locked(fuse, req->newdir, 1110 new_parent_path, sizeof(new_parent_path)); 1111 TRACE("[%d] RENAME %s->%s @ %"PRIx64" (%s) -> %"PRIx64" (%s)\n", handler->token, 1112 old_name, new_name, 1113 hdr->nodeid, old_parent_node ? old_parent_node->name : "?", 1114 req->newdir, new_parent_node ? new_parent_node->name : "?"); 1115 if (!old_parent_node || !new_parent_node) { 1116 res = -ENOENT; 1117 goto lookup_error; 1118 } 1119 if (!check_caller_access_to_name(fuse, hdr, old_parent_node, old_name, W_OK, has_rw)) { 1120 res = -EACCES; 1121 goto lookup_error; 1122 } 1123 if (!check_caller_access_to_name(fuse, hdr, new_parent_node, new_name, W_OK, has_rw)) { 1124 res = -EACCES; 1125 goto lookup_error; 1126 } 1127 child_node = lookup_child_by_name_locked(old_parent_node, old_name); 1128 if (!child_node || get_node_path_locked(child_node, 1129 old_child_path, sizeof(old_child_path)) < 0) { 1130 res = -ENOENT; 1131 goto lookup_error; 1132 } 1133 acquire_node_locked(child_node); 1134 pthread_mutex_unlock(&fuse->lock); 1135 1136 /* Special case for renaming a file where destination is same path 1137 * differing only by case. In this case we don't want to look for a case 1138 * insensitive match. This allows commands like "mv foo FOO" to work as expected. 1139 */ 1140 int search = old_parent_node != new_parent_node 1141 || strcasecmp(old_name, new_name); 1142 if (!(new_actual_name = find_file_within(new_parent_path, new_name, 1143 new_child_path, sizeof(new_child_path), search))) { 1144 res = -ENOENT; 1145 goto io_error; 1146 } 1147 1148 TRACE("[%d] RENAME %s->%s\n", handler->token, old_child_path, new_child_path); 1149 res = rename(old_child_path, new_child_path); 1150 if (res < 0) { 1151 res = -errno; 1152 goto io_error; 1153 } 1154 1155 pthread_mutex_lock(&fuse->lock); 1156 res = rename_node_locked(child_node, new_name, new_actual_name); 1157 if (!res) { 1158 remove_node_from_parent_locked(child_node); 1159 add_node_to_parent_locked(child_node, new_parent_node); 1160 } 1161 goto done; 1162 1163io_error: 1164 pthread_mutex_lock(&fuse->lock); 1165done: 1166 release_node_locked(child_node); 1167lookup_error: 1168 pthread_mutex_unlock(&fuse->lock); 1169 return res; 1170} 1171 1172static int open_flags_to_access_mode(int open_flags) { 1173 if ((open_flags & O_ACCMODE) == O_RDONLY) { 1174 return R_OK; 1175 } else if ((open_flags & O_ACCMODE) == O_WRONLY) { 1176 return W_OK; 1177 } else { 1178 /* Probably O_RDRW, but treat as default to be safe */ 1179 return R_OK | W_OK; 1180 } 1181} 1182 1183static int handle_open(struct fuse* fuse, struct fuse_handler* handler, 1184 const struct fuse_in_header* hdr, const struct fuse_open_in* req) 1185{ 1186 bool has_rw; 1187 struct node* node; 1188 char path[PATH_MAX]; 1189 struct fuse_open_out out; 1190 struct handle *h; 1191 1192 pthread_mutex_lock(&fuse->lock); 1193 has_rw = get_caller_has_rw_locked(fuse, hdr); 1194 node = lookup_node_and_path_by_id_locked(fuse, hdr->nodeid, path, sizeof(path)); 1195 TRACE("[%d] OPEN 0%o @ %"PRIx64" (%s)\n", handler->token, 1196 req->flags, hdr->nodeid, node ? node->name : "?"); 1197 pthread_mutex_unlock(&fuse->lock); 1198 1199 if (!node) { 1200 return -ENOENT; 1201 } 1202 if (!check_caller_access_to_node(fuse, hdr, node, 1203 open_flags_to_access_mode(req->flags), has_rw)) { 1204 return -EACCES; 1205 } 1206 h = malloc(sizeof(*h)); 1207 if (!h) { 1208 return -ENOMEM; 1209 } 1210 TRACE("[%d] OPEN %s\n", handler->token, path); 1211 h->fd = open(path, req->flags); 1212 if (h->fd < 0) { 1213 free(h); 1214 return -errno; 1215 } 1216 out.fh = ptr_to_id(h); 1217 out.open_flags = 0; 1218 out.padding = 0; 1219 fuse_reply(fuse, hdr->unique, &out, sizeof(out)); 1220 return NO_STATUS; 1221} 1222 1223static int handle_read(struct fuse* fuse, struct fuse_handler* handler, 1224 const struct fuse_in_header* hdr, const struct fuse_read_in* req) 1225{ 1226 struct handle *h = id_to_ptr(req->fh); 1227 __u64 unique = hdr->unique; 1228 __u32 size = req->size; 1229 __u64 offset = req->offset; 1230 int res; 1231 __u8 *read_buffer = (__u8 *) ((uintptr_t)(handler->read_buffer + PAGESIZE) & ~((uintptr_t)PAGESIZE-1)); 1232 1233 /* Don't access any other fields of hdr or req beyond this point, the read buffer 1234 * overlaps the request buffer and will clobber data in the request. This 1235 * saves us 128KB per request handler thread at the cost of this scary comment. */ 1236 1237 TRACE("[%d] READ %p(%d) %u@%"PRIu64"\n", handler->token, 1238 h, h->fd, size, (uint64_t) offset); 1239 if (size > MAX_READ) { 1240 return -EINVAL; 1241 } 1242 res = pread64(h->fd, read_buffer, size, offset); 1243 if (res < 0) { 1244 return -errno; 1245 } 1246 fuse_reply(fuse, unique, read_buffer, res); 1247 return NO_STATUS; 1248} 1249 1250static int handle_write(struct fuse* fuse, struct fuse_handler* handler, 1251 const struct fuse_in_header* hdr, const struct fuse_write_in* req, 1252 const void* buffer) 1253{ 1254 struct fuse_write_out out; 1255 struct handle *h = id_to_ptr(req->fh); 1256 int res; 1257 __u8 aligned_buffer[req->size] __attribute__((__aligned__(PAGESIZE))); 1258 1259 if (req->flags & O_DIRECT) { 1260 memcpy(aligned_buffer, buffer, req->size); 1261 buffer = (const __u8*) aligned_buffer; 1262 } 1263 1264 TRACE("[%d] WRITE %p(%d) %u@%"PRIu64"\n", handler->token, 1265 h, h->fd, req->size, req->offset); 1266 res = pwrite64(h->fd, buffer, req->size, req->offset); 1267 if (res < 0) { 1268 return -errno; 1269 } 1270 out.size = res; 1271 fuse_reply(fuse, hdr->unique, &out, sizeof(out)); 1272 return NO_STATUS; 1273} 1274 1275static int handle_statfs(struct fuse* fuse, struct fuse_handler* handler, 1276 const struct fuse_in_header* hdr) 1277{ 1278 char path[PATH_MAX]; 1279 struct statfs stat; 1280 struct fuse_statfs_out out; 1281 int res; 1282 1283 pthread_mutex_lock(&fuse->lock); 1284 TRACE("[%d] STATFS\n", handler->token); 1285 res = get_node_path_locked(&fuse->root, path, sizeof(path)); 1286 pthread_mutex_unlock(&fuse->lock); 1287 if (res < 0) { 1288 return -ENOENT; 1289 } 1290 if (statfs(fuse->root.name, &stat) < 0) { 1291 return -errno; 1292 } 1293 memset(&out, 0, sizeof(out)); 1294 out.st.blocks = stat.f_blocks; 1295 out.st.bfree = stat.f_bfree; 1296 out.st.bavail = stat.f_bavail; 1297 out.st.files = stat.f_files; 1298 out.st.ffree = stat.f_ffree; 1299 out.st.bsize = stat.f_bsize; 1300 out.st.namelen = stat.f_namelen; 1301 out.st.frsize = stat.f_frsize; 1302 fuse_reply(fuse, hdr->unique, &out, sizeof(out)); 1303 return NO_STATUS; 1304} 1305 1306static int handle_release(struct fuse* fuse, struct fuse_handler* handler, 1307 const struct fuse_in_header* hdr, const struct fuse_release_in* req) 1308{ 1309 struct handle *h = id_to_ptr(req->fh); 1310 1311 TRACE("[%d] RELEASE %p(%d)\n", handler->token, h, h->fd); 1312 close(h->fd); 1313 free(h); 1314 return 0; 1315} 1316 1317static int handle_fsync(struct fuse* fuse, struct fuse_handler* handler, 1318 const struct fuse_in_header* hdr, const struct fuse_fsync_in* req) 1319{ 1320 bool is_dir = (hdr->opcode == FUSE_FSYNCDIR); 1321 bool is_data_sync = req->fsync_flags & 1; 1322 1323 int fd = -1; 1324 if (is_dir) { 1325 struct dirhandle *dh = id_to_ptr(req->fh); 1326 fd = dirfd(dh->d); 1327 } else { 1328 struct handle *h = id_to_ptr(req->fh); 1329 fd = h->fd; 1330 } 1331 1332 TRACE("[%d] %s %p(%d) is_data_sync=%d\n", handler->token, 1333 is_dir ? "FSYNCDIR" : "FSYNC", 1334 id_to_ptr(req->fh), fd, is_data_sync); 1335 int res = is_data_sync ? fdatasync(fd) : fsync(fd); 1336 if (res == -1) { 1337 return -errno; 1338 } 1339 return 0; 1340} 1341 1342static int handle_flush(struct fuse* fuse, struct fuse_handler* handler, 1343 const struct fuse_in_header* hdr) 1344{ 1345 TRACE("[%d] FLUSH\n", handler->token); 1346 return 0; 1347} 1348 1349static int handle_opendir(struct fuse* fuse, struct fuse_handler* handler, 1350 const struct fuse_in_header* hdr, const struct fuse_open_in* req) 1351{ 1352 struct node* node; 1353 char path[PATH_MAX]; 1354 struct fuse_open_out out; 1355 struct dirhandle *h; 1356 1357 pthread_mutex_lock(&fuse->lock); 1358 node = lookup_node_and_path_by_id_locked(fuse, hdr->nodeid, path, sizeof(path)); 1359 TRACE("[%d] OPENDIR @ %"PRIx64" (%s)\n", handler->token, 1360 hdr->nodeid, node ? node->name : "?"); 1361 pthread_mutex_unlock(&fuse->lock); 1362 1363 if (!node) { 1364 return -ENOENT; 1365 } 1366 if (!check_caller_access_to_node(fuse, hdr, node, R_OK, false)) { 1367 return -EACCES; 1368 } 1369 h = malloc(sizeof(*h)); 1370 if (!h) { 1371 return -ENOMEM; 1372 } 1373 TRACE("[%d] OPENDIR %s\n", handler->token, path); 1374 h->d = opendir(path); 1375 if (!h->d) { 1376 free(h); 1377 return -errno; 1378 } 1379 out.fh = ptr_to_id(h); 1380 out.open_flags = 0; 1381 out.padding = 0; 1382 fuse_reply(fuse, hdr->unique, &out, sizeof(out)); 1383 return NO_STATUS; 1384} 1385 1386static int handle_readdir(struct fuse* fuse, struct fuse_handler* handler, 1387 const struct fuse_in_header* hdr, const struct fuse_read_in* req) 1388{ 1389 char buffer[8192]; 1390 struct fuse_dirent *fde = (struct fuse_dirent*) buffer; 1391 struct dirent *de; 1392 struct dirhandle *h = id_to_ptr(req->fh); 1393 1394 TRACE("[%d] READDIR %p\n", handler->token, h); 1395 if (req->offset == 0) { 1396 /* rewinddir() might have been called above us, so rewind here too */ 1397 TRACE("[%d] calling rewinddir()\n", handler->token); 1398 rewinddir(h->d); 1399 } 1400 de = readdir(h->d); 1401 if (!de) { 1402 return 0; 1403 } 1404 fde->ino = FUSE_UNKNOWN_INO; 1405 /* increment the offset so we can detect when rewinddir() seeks back to the beginning */ 1406 fde->off = req->offset + 1; 1407 fde->type = de->d_type; 1408 fde->namelen = strlen(de->d_name); 1409 memcpy(fde->name, de->d_name, fde->namelen + 1); 1410 fuse_reply(fuse, hdr->unique, fde, 1411 FUSE_DIRENT_ALIGN(sizeof(struct fuse_dirent) + fde->namelen)); 1412 return NO_STATUS; 1413} 1414 1415static int handle_releasedir(struct fuse* fuse, struct fuse_handler* handler, 1416 const struct fuse_in_header* hdr, const struct fuse_release_in* req) 1417{ 1418 struct dirhandle *h = id_to_ptr(req->fh); 1419 1420 TRACE("[%d] RELEASEDIR %p\n", handler->token, h); 1421 closedir(h->d); 1422 free(h); 1423 return 0; 1424} 1425 1426static int handle_init(struct fuse* fuse, struct fuse_handler* handler, 1427 const struct fuse_in_header* hdr, const struct fuse_init_in* req) 1428{ 1429 struct fuse_init_out out; 1430 1431 TRACE("[%d] INIT ver=%d.%d maxread=%d flags=%x\n", 1432 handler->token, req->major, req->minor, req->max_readahead, req->flags); 1433 out.major = FUSE_KERNEL_VERSION; 1434 out.minor = FUSE_KERNEL_MINOR_VERSION; 1435 out.max_readahead = req->max_readahead; 1436 out.flags = FUSE_ATOMIC_O_TRUNC | FUSE_BIG_WRITES; 1437 out.max_background = 32; 1438 out.congestion_threshold = 32; 1439 out.max_write = MAX_WRITE; 1440 fuse_reply(fuse, hdr->unique, &out, sizeof(out)); 1441 return NO_STATUS; 1442} 1443 1444static int handle_fuse_request(struct fuse *fuse, struct fuse_handler* handler, 1445 const struct fuse_in_header *hdr, const void *data, size_t data_len) 1446{ 1447 switch (hdr->opcode) { 1448 case FUSE_LOOKUP: { /* bytez[] -> entry_out */ 1449 const char* name = data; 1450 return handle_lookup(fuse, handler, hdr, name); 1451 } 1452 1453 case FUSE_FORGET: { 1454 const struct fuse_forget_in *req = data; 1455 return handle_forget(fuse, handler, hdr, req); 1456 } 1457 1458 case FUSE_GETATTR: { /* getattr_in -> attr_out */ 1459 const struct fuse_getattr_in *req = data; 1460 return handle_getattr(fuse, handler, hdr, req); 1461 } 1462 1463 case FUSE_SETATTR: { /* setattr_in -> attr_out */ 1464 const struct fuse_setattr_in *req = data; 1465 return handle_setattr(fuse, handler, hdr, req); 1466 } 1467 1468// case FUSE_READLINK: 1469// case FUSE_SYMLINK: 1470 case FUSE_MKNOD: { /* mknod_in, bytez[] -> entry_out */ 1471 const struct fuse_mknod_in *req = data; 1472 const char *name = ((const char*) data) + sizeof(*req); 1473 return handle_mknod(fuse, handler, hdr, req, name); 1474 } 1475 1476 case FUSE_MKDIR: { /* mkdir_in, bytez[] -> entry_out */ 1477 const struct fuse_mkdir_in *req = data; 1478 const char *name = ((const char*) data) + sizeof(*req); 1479 return handle_mkdir(fuse, handler, hdr, req, name); 1480 } 1481 1482 case FUSE_UNLINK: { /* bytez[] -> */ 1483 const char* name = data; 1484 return handle_unlink(fuse, handler, hdr, name); 1485 } 1486 1487 case FUSE_RMDIR: { /* bytez[] -> */ 1488 const char* name = data; 1489 return handle_rmdir(fuse, handler, hdr, name); 1490 } 1491 1492 case FUSE_RENAME: { /* rename_in, oldname, newname -> */ 1493 const struct fuse_rename_in *req = data; 1494 const char *old_name = ((const char*) data) + sizeof(*req); 1495 const char *new_name = old_name + strlen(old_name) + 1; 1496 return handle_rename(fuse, handler, hdr, req, old_name, new_name); 1497 } 1498 1499// case FUSE_LINK: 1500 case FUSE_OPEN: { /* open_in -> open_out */ 1501 const struct fuse_open_in *req = data; 1502 return handle_open(fuse, handler, hdr, req); 1503 } 1504 1505 case FUSE_READ: { /* read_in -> byte[] */ 1506 const struct fuse_read_in *req = data; 1507 return handle_read(fuse, handler, hdr, req); 1508 } 1509 1510 case FUSE_WRITE: { /* write_in, byte[write_in.size] -> write_out */ 1511 const struct fuse_write_in *req = data; 1512 const void* buffer = (const __u8*)data + sizeof(*req); 1513 return handle_write(fuse, handler, hdr, req, buffer); 1514 } 1515 1516 case FUSE_STATFS: { /* getattr_in -> attr_out */ 1517 return handle_statfs(fuse, handler, hdr); 1518 } 1519 1520 case FUSE_RELEASE: { /* release_in -> */ 1521 const struct fuse_release_in *req = data; 1522 return handle_release(fuse, handler, hdr, req); 1523 } 1524 1525 case FUSE_FSYNC: 1526 case FUSE_FSYNCDIR: { 1527 const struct fuse_fsync_in *req = data; 1528 return handle_fsync(fuse, handler, hdr, req); 1529 } 1530 1531// case FUSE_SETXATTR: 1532// case FUSE_GETXATTR: 1533// case FUSE_LISTXATTR: 1534// case FUSE_REMOVEXATTR: 1535 case FUSE_FLUSH: { 1536 return handle_flush(fuse, handler, hdr); 1537 } 1538 1539 case FUSE_OPENDIR: { /* open_in -> open_out */ 1540 const struct fuse_open_in *req = data; 1541 return handle_opendir(fuse, handler, hdr, req); 1542 } 1543 1544 case FUSE_READDIR: { 1545 const struct fuse_read_in *req = data; 1546 return handle_readdir(fuse, handler, hdr, req); 1547 } 1548 1549 case FUSE_RELEASEDIR: { /* release_in -> */ 1550 const struct fuse_release_in *req = data; 1551 return handle_releasedir(fuse, handler, hdr, req); 1552 } 1553 1554 case FUSE_INIT: { /* init_in -> init_out */ 1555 const struct fuse_init_in *req = data; 1556 return handle_init(fuse, handler, hdr, req); 1557 } 1558 1559 default: { 1560 TRACE("[%d] NOTIMPL op=%d uniq=%"PRIx64" nid=%"PRIx64"\n", 1561 handler->token, hdr->opcode, hdr->unique, hdr->nodeid); 1562 return -ENOSYS; 1563 } 1564 } 1565} 1566 1567static void handle_fuse_requests(struct fuse_handler* handler) 1568{ 1569 struct fuse* fuse = handler->fuse; 1570 for (;;) { 1571 ssize_t len = read(fuse->fd, 1572 handler->request_buffer, sizeof(handler->request_buffer)); 1573 if (len < 0) { 1574 if (errno != EINTR) { 1575 ERROR("[%d] handle_fuse_requests: errno=%d\n", handler->token, errno); 1576 } 1577 continue; 1578 } 1579 1580 if ((size_t)len < sizeof(struct fuse_in_header)) { 1581 ERROR("[%d] request too short: len=%zu\n", handler->token, (size_t)len); 1582 continue; 1583 } 1584 1585 const struct fuse_in_header *hdr = (void*)handler->request_buffer; 1586 if (hdr->len != (size_t)len) { 1587 ERROR("[%d] malformed header: len=%zu, hdr->len=%u\n", 1588 handler->token, (size_t)len, hdr->len); 1589 continue; 1590 } 1591 1592 const void *data = handler->request_buffer + sizeof(struct fuse_in_header); 1593 size_t data_len = len - sizeof(struct fuse_in_header); 1594 __u64 unique = hdr->unique; 1595 int res = handle_fuse_request(fuse, handler, hdr, data, data_len); 1596 1597 /* We do not access the request again after this point because the underlying 1598 * buffer storage may have been reused while processing the request. */ 1599 1600 if (res != NO_STATUS) { 1601 if (res) { 1602 TRACE("[%d] ERROR %d\n", handler->token, res); 1603 } 1604 fuse_status(fuse, unique, res); 1605 } 1606 } 1607} 1608 1609static void* start_handler(void* data) 1610{ 1611 struct fuse_handler* handler = data; 1612 handle_fuse_requests(handler); 1613 return NULL; 1614} 1615 1616static bool remove_str_to_int(void *key, void *value, void *context) { 1617 Hashmap* map = context; 1618 hashmapRemove(map, key); 1619 free(key); 1620 return true; 1621} 1622 1623static bool remove_int_to_null(void *key, void *value, void *context) { 1624 Hashmap* map = context; 1625 hashmapRemove(map, key); 1626 return true; 1627} 1628 1629static int read_package_list(struct fuse *fuse) { 1630 pthread_mutex_lock(&fuse->lock); 1631 1632 hashmapForEach(fuse->package_to_appid, remove_str_to_int, fuse->package_to_appid); 1633 hashmapForEach(fuse->appid_with_rw, remove_int_to_null, fuse->appid_with_rw); 1634 1635 FILE* file = fopen(kPackagesListFile, "r"); 1636 if (!file) { 1637 ERROR("failed to open package list: %s\n", strerror(errno)); 1638 pthread_mutex_unlock(&fuse->lock); 1639 return -1; 1640 } 1641 1642 char buf[512]; 1643 while (fgets(buf, sizeof(buf), file) != NULL) { 1644 char package_name[512]; 1645 int appid; 1646 char gids[512]; 1647 1648 if (sscanf(buf, "%s %d %*d %*s %*s %s", package_name, &appid, gids) == 3) { 1649 char* package_name_dup = strdup(package_name); 1650 hashmapPut(fuse->package_to_appid, package_name_dup, (void*) (uintptr_t) appid); 1651 1652 char* token = strtok(gids, ","); 1653 while (token != NULL) { 1654 if (strtoul(token, NULL, 10) == fuse->write_gid) { 1655 hashmapPut(fuse->appid_with_rw, (void*) (uintptr_t) appid, (void*) (uintptr_t) 1); 1656 break; 1657 } 1658 token = strtok(NULL, ","); 1659 } 1660 } 1661 } 1662 1663 TRACE("read_package_list: found %zu packages, %zu with write_gid\n", 1664 hashmapSize(fuse->package_to_appid), 1665 hashmapSize(fuse->appid_with_rw)); 1666 fclose(file); 1667 pthread_mutex_unlock(&fuse->lock); 1668 return 0; 1669} 1670 1671static void watch_package_list(struct fuse* fuse) { 1672 struct inotify_event *event; 1673 char event_buf[512]; 1674 1675 int nfd = inotify_init(); 1676 if (nfd < 0) { 1677 ERROR("inotify_init failed: %s\n", strerror(errno)); 1678 return; 1679 } 1680 1681 bool active = false; 1682 while (1) { 1683 if (!active) { 1684 int res = inotify_add_watch(nfd, kPackagesListFile, IN_DELETE_SELF); 1685 if (res == -1) { 1686 if (errno == ENOENT || errno == EACCES) { 1687 /* Framework may not have created yet, sleep and retry */ 1688 ERROR("missing packages.list; retrying\n"); 1689 sleep(3); 1690 continue; 1691 } else { 1692 ERROR("inotify_add_watch failed: %s\n", strerror(errno)); 1693 return; 1694 } 1695 } 1696 1697 /* Watch above will tell us about any future changes, so 1698 * read the current state. */ 1699 if (read_package_list(fuse) == -1) { 1700 ERROR("read_package_list failed: %s\n", strerror(errno)); 1701 return; 1702 } 1703 active = true; 1704 } 1705 1706 int event_pos = 0; 1707 int res = read(nfd, event_buf, sizeof(event_buf)); 1708 if (res < (int) sizeof(*event)) { 1709 if (errno == EINTR) 1710 continue; 1711 ERROR("failed to read inotify event: %s\n", strerror(errno)); 1712 return; 1713 } 1714 1715 while (res >= (int) sizeof(*event)) { 1716 int event_size; 1717 event = (struct inotify_event *) (event_buf + event_pos); 1718 1719 TRACE("inotify event: %08x\n", event->mask); 1720 if ((event->mask & IN_IGNORED) == IN_IGNORED) { 1721 /* Previously watched file was deleted, probably due to move 1722 * that swapped in new data; re-arm the watch and read. */ 1723 active = false; 1724 } 1725 1726 event_size = sizeof(*event) + event->len; 1727 res -= event_size; 1728 event_pos += event_size; 1729 } 1730 } 1731} 1732 1733static int ignite_fuse(struct fuse* fuse, int num_threads) 1734{ 1735 struct fuse_handler* handlers; 1736 int i; 1737 1738 handlers = malloc(num_threads * sizeof(struct fuse_handler)); 1739 if (!handlers) { 1740 ERROR("cannot allocate storage for threads\n"); 1741 return -ENOMEM; 1742 } 1743 1744 for (i = 0; i < num_threads; i++) { 1745 handlers[i].fuse = fuse; 1746 handlers[i].token = i; 1747 } 1748 1749 /* When deriving permissions, this thread is used to process inotify events, 1750 * otherwise it becomes one of the FUSE handlers. */ 1751 i = (fuse->derive == DERIVE_NONE) ? 1 : 0; 1752 for (; i < num_threads; i++) { 1753 pthread_t thread; 1754 int res = pthread_create(&thread, NULL, start_handler, &handlers[i]); 1755 if (res) { 1756 ERROR("failed to start thread #%d, error=%d\n", i, res); 1757 goto quit; 1758 } 1759 } 1760 1761 if (fuse->derive == DERIVE_NONE) { 1762 handle_fuse_requests(&handlers[0]); 1763 } else { 1764 watch_package_list(fuse); 1765 } 1766 1767 ERROR("terminated prematurely\n"); 1768 1769 /* don't bother killing all of the other threads or freeing anything, 1770 * should never get here anyhow */ 1771quit: 1772 exit(1); 1773} 1774 1775static int usage() 1776{ 1777 ERROR("usage: sdcard [OPTIONS] <source_path> <dest_path>\n" 1778 " -u: specify UID to run as\n" 1779 " -g: specify GID to run as\n" 1780 " -w: specify GID required to write (default sdcard_rw, requires -d or -l)\n" 1781 " -t: specify number of threads to use (default %d)\n" 1782 " -d: derive file permissions based on path\n" 1783 " -l: derive file permissions based on legacy internal layout\n" 1784 " -s: split derived permissions for pics, av\n" 1785 "\n", DEFAULT_NUM_THREADS); 1786 return 1; 1787} 1788 1789static int run(const char* source_path, const char* dest_path, uid_t uid, 1790 gid_t gid, gid_t write_gid, int num_threads, derive_t derive, 1791 bool split_perms) { 1792 int fd; 1793 char opts[256]; 1794 int res; 1795 struct fuse fuse; 1796 1797 /* cleanup from previous instance, if necessary */ 1798 umount2(dest_path, 2); 1799 1800 fd = open("/dev/fuse", O_RDWR); 1801 if (fd < 0){ 1802 ERROR("cannot open fuse device: %s\n", strerror(errno)); 1803 return -1; 1804 } 1805 1806 snprintf(opts, sizeof(opts), 1807 "fd=%i,rootmode=40000,default_permissions,allow_other,user_id=%d,group_id=%d", 1808 fd, uid, gid); 1809 1810 res = mount("/dev/fuse", dest_path, "fuse", MS_NOSUID | MS_NODEV | MS_NOEXEC, opts); 1811 if (res < 0) { 1812 ERROR("cannot mount fuse filesystem: %s\n", strerror(errno)); 1813 goto error; 1814 } 1815 1816 res = setgroups(sizeof(kGroups) / sizeof(kGroups[0]), kGroups); 1817 if (res < 0) { 1818 ERROR("cannot setgroups: %s\n", strerror(errno)); 1819 goto error; 1820 } 1821 1822 res = setgid(gid); 1823 if (res < 0) { 1824 ERROR("cannot setgid: %s\n", strerror(errno)); 1825 goto error; 1826 } 1827 1828 res = setuid(uid); 1829 if (res < 0) { 1830 ERROR("cannot setuid: %s\n", strerror(errno)); 1831 goto error; 1832 } 1833 1834 fuse_init(&fuse, fd, source_path, write_gid, derive, split_perms); 1835 1836 umask(0); 1837 res = ignite_fuse(&fuse, num_threads); 1838 1839 /* we do not attempt to umount the file system here because we are no longer 1840 * running as the root user */ 1841 1842error: 1843 close(fd); 1844 return res; 1845} 1846 1847int main(int argc, char **argv) 1848{ 1849 int res; 1850 const char *source_path = NULL; 1851 const char *dest_path = NULL; 1852 uid_t uid = 0; 1853 gid_t gid = 0; 1854 gid_t write_gid = AID_SDCARD_RW; 1855 int num_threads = DEFAULT_NUM_THREADS; 1856 derive_t derive = DERIVE_NONE; 1857 bool split_perms = false; 1858 int i; 1859 struct rlimit rlim; 1860 int fs_version; 1861 1862 int opt; 1863 while ((opt = getopt(argc, argv, "u:g:w:t:dls")) != -1) { 1864 switch (opt) { 1865 case 'u': 1866 uid = strtoul(optarg, NULL, 10); 1867 break; 1868 case 'g': 1869 gid = strtoul(optarg, NULL, 10); 1870 break; 1871 case 'w': 1872 write_gid = strtoul(optarg, NULL, 10); 1873 break; 1874 case 't': 1875 num_threads = strtoul(optarg, NULL, 10); 1876 break; 1877 case 'd': 1878 derive = DERIVE_UNIFIED; 1879 break; 1880 case 'l': 1881 derive = DERIVE_LEGACY; 1882 break; 1883 case 's': 1884 split_perms = true; 1885 break; 1886 case '?': 1887 default: 1888 return usage(); 1889 } 1890 } 1891 1892 for (i = optind; i < argc; i++) { 1893 char* arg = argv[i]; 1894 if (!source_path) { 1895 source_path = arg; 1896 } else if (!dest_path) { 1897 dest_path = arg; 1898 } else if (!uid) { 1899 uid = strtoul(arg, NULL, 10); 1900 } else if (!gid) { 1901 gid = strtoul(arg, NULL, 10); 1902 } else { 1903 ERROR("too many arguments\n"); 1904 return usage(); 1905 } 1906 } 1907 1908 if (!source_path) { 1909 ERROR("no source path specified\n"); 1910 return usage(); 1911 } 1912 if (!dest_path) { 1913 ERROR("no dest path specified\n"); 1914 return usage(); 1915 } 1916 if (!uid || !gid) { 1917 ERROR("uid and gid must be nonzero\n"); 1918 return usage(); 1919 } 1920 if (num_threads < 1) { 1921 ERROR("number of threads must be at least 1\n"); 1922 return usage(); 1923 } 1924 if (split_perms && derive == DERIVE_NONE) { 1925 ERROR("cannot split permissions without deriving\n"); 1926 return usage(); 1927 } 1928 1929 rlim.rlim_cur = 8192; 1930 rlim.rlim_max = 8192; 1931 if (setrlimit(RLIMIT_NOFILE, &rlim)) { 1932 ERROR("Error setting RLIMIT_NOFILE, errno = %d\n", errno); 1933 } 1934 1935 while ((fs_read_atomic_int("/data/.layout_version", &fs_version) == -1) || (fs_version < 3)) { 1936 ERROR("installd fs upgrade not yet complete. Waiting...\n"); 1937 sleep(1); 1938 } 1939 1940 res = run(source_path, dest_path, uid, gid, write_gid, num_threads, derive, split_perms); 1941 return res < 0 ? 1 : 0; 1942} 1943