fd_utils-inl.h revision 1c15c635785c64aee961f895dabd184cc2e9e0b1
1/* 2 * Copyright (C) 2016 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17#include <string> 18#include <unordered_map> 19#include <set> 20#include <vector> 21#include <algorithm> 22 23#include <android-base/strings.h> 24#include <dirent.h> 25#include <fcntl.h> 26#include <grp.h> 27#include <inttypes.h> 28#include <stdlib.h> 29#include <sys/socket.h> 30#include <sys/stat.h> 31#include <sys/types.h> 32#include <sys/un.h> 33#include <unistd.h> 34 35#include <cutils/log.h> 36#include "JNIHelp.h" 37#include "ScopedPrimitiveArray.h" 38 39// Whitelist of open paths that the zygote is allowed to keep open. 40// 41// In addition to the paths listed here, all files ending with 42// ".jar" under /system/framework" are whitelisted. See 43// FileDescriptorInfo::IsWhitelisted for the canonical definition. 44// 45// If the whitelisted path is associated with a regular file or a 46// character device, the file is reopened after a fork with the same 47// offset and mode. If the whilelisted path is associated with a 48// AF_UNIX socket, the socket will refer to /dev/null after each 49// fork, and all operations on it will fail. 50static const char* kPathWhitelist[] = { 51 "/dev/null", 52 "/dev/socket/zygote", 53 "/dev/socket/zygote_secondary", 54 "/sys/kernel/debug/tracing/trace_marker", 55 "/system/framework/framework-res.apk", 56 "/dev/urandom", 57 "/dev/ion", 58 "/dev/dri/renderD129", // Fixes b/31172436 59}; 60 61static const char* kFdPath = "/proc/self/fd"; 62 63// Keeps track of all relevant information (flags, offset etc.) of an 64// open zygote file descriptor. 65class FileDescriptorInfo { 66 public: 67 // Create a FileDescriptorInfo for a given file descriptor. Returns 68 // |NULL| if an error occurred. 69 static FileDescriptorInfo* createFromFd(int fd) { 70 struct stat f_stat; 71 // This should never happen; the zygote should always have the right set 72 // of permissions required to stat all its open files. 73 if (TEMP_FAILURE_RETRY(fstat(fd, &f_stat)) == -1) { 74 ALOGE("Unable to stat fd %d : %s", fd, strerror(errno)); 75 return NULL; 76 } 77 78 if (S_ISSOCK(f_stat.st_mode)) { 79 std::string socket_name; 80 if (!GetSocketName(fd, &socket_name)) { 81 return NULL; 82 } 83 84 if (!IsWhitelisted(socket_name)) { 85 ALOGE("Socket name not whitelisted : %s (fd=%d)", socket_name.c_str(), fd); 86 return NULL; 87 } 88 89 return new FileDescriptorInfo(fd); 90 } 91 92 // We only handle whitelisted regular files and character devices. Whitelisted 93 // character devices must provide a guarantee of sensible behaviour when 94 // reopened. 95 // 96 // S_ISDIR : Not supported. (We could if we wanted to, but it's unused). 97 // S_ISLINK : Not supported. 98 // S_ISBLK : Not supported. 99 // S_ISFIFO : Not supported. Note that the zygote uses pipes to communicate 100 // with the child process across forks but those should have been closed 101 // before we got to this point. 102 if (!S_ISCHR(f_stat.st_mode) && !S_ISREG(f_stat.st_mode)) { 103 ALOGE("Unsupported st_mode %d", f_stat.st_mode); 104 return NULL; 105 } 106 107 std::string file_path; 108 if (!Readlink(fd, &file_path)) { 109 return NULL; 110 } 111 112 if (!IsWhitelisted(file_path)) { 113 ALOGE("Not whitelisted : %s", file_path.c_str()); 114 return NULL; 115 } 116 117 // File descriptor flags : currently on FD_CLOEXEC. We can set these 118 // using F_SETFD - we're single threaded at this point of execution so 119 // there won't be any races. 120 const int fd_flags = TEMP_FAILURE_RETRY(fcntl(fd, F_GETFD)); 121 if (fd_flags == -1) { 122 ALOGE("Failed fcntl(%d, F_GETFD) : %s", fd, strerror(errno)); 123 return NULL; 124 } 125 126 // File status flags : 127 // - File access mode : (O_RDONLY, O_WRONLY...) we'll pass these through 128 // to the open() call. 129 // 130 // - File creation flags : (O_CREAT, O_EXCL...) - there's not much we can 131 // do about these, since the file has already been created. We shall ignore 132 // them here. 133 // 134 // - Other flags : We'll have to set these via F_SETFL. On linux, F_SETFL 135 // can only set O_APPEND, O_ASYNC, O_DIRECT, O_NOATIME, and O_NONBLOCK. 136 // In particular, it can't set O_SYNC and O_DSYNC. We'll have to test for 137 // their presence and pass them in to open(). 138 int fs_flags = TEMP_FAILURE_RETRY(fcntl(fd, F_GETFL)); 139 if (fs_flags == -1) { 140 ALOGE("Failed fcntl(%d, F_GETFL) : %s", fd, strerror(errno)); 141 return NULL; 142 } 143 144 // File offset : Ignore the offset for non seekable files. 145 const off_t offset = TEMP_FAILURE_RETRY(lseek64(fd, 0, SEEK_CUR)); 146 147 // We pass the flags that open accepts to open, and use F_SETFL for 148 // the rest of them. 149 static const int kOpenFlags = (O_RDONLY | O_WRONLY | O_RDWR | O_DSYNC | O_SYNC); 150 int open_flags = fs_flags & (kOpenFlags); 151 fs_flags = fs_flags & (~(kOpenFlags)); 152 153 return new FileDescriptorInfo(f_stat, file_path, fd, open_flags, fd_flags, fs_flags, offset); 154 } 155 156 // Checks whether the file descriptor associated with this object 157 // refers to the same description. 158 bool Restat() const { 159 struct stat f_stat; 160 if (TEMP_FAILURE_RETRY(fstat(fd, &f_stat)) == -1) { 161 return false; 162 } 163 164 return f_stat.st_ino == stat.st_ino && f_stat.st_dev == stat.st_dev; 165 } 166 167 bool ReopenOrDetach() const { 168 if (is_sock) { 169 return DetachSocket(); 170 } 171 172 // NOTE: This might happen if the file was unlinked after being opened. 173 // It's a common pattern in the case of temporary files and the like but 174 // we should not allow such usage from the zygote. 175 const int new_fd = TEMP_FAILURE_RETRY(open(file_path.c_str(), open_flags)); 176 177 if (new_fd == -1) { 178 ALOGE("Failed open(%s, %d) : %s", file_path.c_str(), open_flags, strerror(errno)); 179 return false; 180 } 181 182 if (TEMP_FAILURE_RETRY(fcntl(new_fd, F_SETFD, fd_flags)) == -1) { 183 close(new_fd); 184 ALOGE("Failed fcntl(%d, F_SETFD, %x) : %s", new_fd, fd_flags, strerror(errno)); 185 return false; 186 } 187 188 if (TEMP_FAILURE_RETRY(fcntl(new_fd, F_SETFL, fs_flags)) == -1) { 189 close(new_fd); 190 ALOGE("Failed fcntl(%d, F_SETFL, %x) : %s", new_fd, fs_flags, strerror(errno)); 191 return false; 192 } 193 194 if (offset != -1 && TEMP_FAILURE_RETRY(lseek64(new_fd, offset, SEEK_SET)) == -1) { 195 close(new_fd); 196 ALOGE("Failed lseek64(%d, SEEK_SET) : %s", new_fd, strerror(errno)); 197 return false; 198 } 199 200 if (TEMP_FAILURE_RETRY(dup2(new_fd, fd)) == -1) { 201 close(new_fd); 202 ALOGE("Failed dup2(%d, %d) : %s", fd, new_fd, strerror(errno)); 203 return false; 204 } 205 206 close(new_fd); 207 208 return true; 209 } 210 211 const int fd; 212 const struct stat stat; 213 const std::string file_path; 214 const int open_flags; 215 const int fd_flags; 216 const int fs_flags; 217 const off_t offset; 218 const bool is_sock; 219 220 private: 221 FileDescriptorInfo(int fd) : 222 fd(fd), 223 stat(), 224 open_flags(0), 225 fd_flags(0), 226 fs_flags(0), 227 offset(0), 228 is_sock(true) { 229 } 230 231 FileDescriptorInfo(struct stat stat, const std::string& file_path, int fd, int open_flags, 232 int fd_flags, int fs_flags, off_t offset) : 233 fd(fd), 234 stat(stat), 235 file_path(file_path), 236 open_flags(open_flags), 237 fd_flags(fd_flags), 238 fs_flags(fs_flags), 239 offset(offset), 240 is_sock(false) { 241 } 242 243 // Returns true iff. a given path is whitelisted. A path is whitelisted 244 // if it belongs to the whitelist (see kPathWhitelist) or if it's a path 245 // under /system/framework that ends with ".jar" or if it is a system 246 // framework overlay. 247 static bool IsWhitelisted(const std::string& path) { 248 for (size_t i = 0; i < (sizeof(kPathWhitelist) / sizeof(kPathWhitelist[0])); ++i) { 249 if (kPathWhitelist[i] == path) { 250 return true; 251 } 252 } 253 254 static const char* kFrameworksPrefix = "/system/framework/"; 255 static const char* kJarSuffix = ".jar"; 256 if (android::base::StartsWith(path, kFrameworksPrefix) 257 && android::base::EndsWith(path, kJarSuffix)) { 258 return true; 259 } 260 261 // Whitelist files needed for Runtime Resource Overlay, like these: 262 // /system/vendor/overlay/framework-res.apk 263 // /system/vendor/overlay-subdir/pg/framework-res.apk 264 // /data/resource-cache/system@vendor@overlay@framework-res.apk@idmap 265 // /data/resource-cache/system@vendor@overlay-subdir@pg@framework-res.apk@idmap 266 // See AssetManager.cpp for more details on overlay-subdir. 267 static const char* kOverlayDir = "/system/vendor/overlay/"; 268 static const char* kOverlaySubdir = "/system/vendor/overlay-subdir/"; 269 static const char* kApkSuffix = ".apk"; 270 271 if ((android::base::StartsWith(path, kOverlayDir) 272 || android::base::StartsWith(path, kOverlaySubdir)) 273 && android::base::EndsWith(path, kApkSuffix) 274 && path.find("/../") == std::string::npos) { 275 return true; 276 } 277 278 static const char* kOverlayIdmapPrefix = "/data/resource-cache/"; 279 static const char* kOverlayIdmapSuffix = ".apk@idmap"; 280 if (android::base::StartsWith(path, kOverlayIdmapPrefix) 281 && android::base::EndsWith(path, kOverlayIdmapSuffix)) { 282 return true; 283 } 284 285 return false; 286 } 287 288 // TODO: Call android::base::Readlink instead of copying the code here. 289 static bool Readlink(const int fd, std::string* result) { 290 char path[64]; 291 snprintf(path, sizeof(path), "/proc/self/fd/%d", fd); 292 293 // Code copied from android::base::Readlink starts here : 294 295 // Annoyingly, the readlink system call returns EINVAL for a zero-sized buffer, 296 // and truncates to whatever size you do supply, so it can't be used to query. 297 // We could call lstat first, but that would introduce a race condition that 298 // we couldn't detect. 299 // ext2 and ext4 both have PAGE_SIZE limitations, so we assume that here. 300 char buf[4096]; 301 ssize_t len = readlink(path, buf, sizeof(buf)); 302 if (len == -1) return false; 303 304 result->assign(buf, len); 305 return true; 306 } 307 308 // Returns the locally-bound name of the socket |fd|. Returns true 309 // iff. all of the following hold : 310 // 311 // - the socket's sa_family is AF_UNIX. 312 // - the length of the path is greater than zero (i.e, not an unnamed socket). 313 // - the first byte of the path isn't zero (i.e, not a socket with an abstract 314 // address). 315 static bool GetSocketName(const int fd, std::string* result) { 316 sockaddr_storage ss; 317 sockaddr* addr = reinterpret_cast<sockaddr*>(&ss); 318 socklen_t addr_len = sizeof(ss); 319 320 if (TEMP_FAILURE_RETRY(getsockname(fd, addr, &addr_len)) == -1) { 321 ALOGE("Failed getsockname(%d) : %s", fd, strerror(errno)); 322 return false; 323 } 324 325 if (addr->sa_family != AF_UNIX) { 326 ALOGE("Unsupported socket (fd=%d) with family %d", fd, addr->sa_family); 327 return false; 328 } 329 330 const sockaddr_un* unix_addr = reinterpret_cast<const sockaddr_un*>(&ss); 331 332 size_t path_len = addr_len - offsetof(struct sockaddr_un, sun_path); 333 // This is an unnamed local socket, we do not accept it. 334 if (path_len == 0) { 335 ALOGE("Unsupported AF_UNIX socket (fd=%d) with empty path.", fd); 336 return false; 337 } 338 339 // This is a local socket with an abstract address, we do not accept it. 340 if (unix_addr->sun_path[0] == '\0') { 341 ALOGE("Unsupported AF_UNIX socket (fd=%d) with abstract address.", fd); 342 return false; 343 } 344 345 // If we're here, sun_path must refer to a null terminated filesystem 346 // pathname (man 7 unix). Remove the terminator before assigning it to an 347 // std::string. 348 if (unix_addr->sun_path[path_len - 1] == '\0') { 349 --path_len; 350 } 351 352 result->assign(unix_addr->sun_path, path_len); 353 return true; 354 } 355 356 bool DetachSocket() const { 357 const int dev_null_fd = open("/dev/null", O_RDWR); 358 if (dev_null_fd < 0) { 359 ALOGE("Failed to open /dev/null : %s", strerror(errno)); 360 return false; 361 } 362 363 if (dup2(dev_null_fd, fd) == -1) { 364 ALOGE("Failed dup2 on socket descriptor %d : %s", fd, strerror(errno)); 365 return false; 366 } 367 368 if (close(dev_null_fd) == -1) { 369 ALOGE("Failed close(%d) : %s", dev_null_fd, strerror(errno)); 370 return false; 371 } 372 373 return true; 374 } 375 376 DISALLOW_COPY_AND_ASSIGN(FileDescriptorInfo); 377}; 378 379// A FileDescriptorTable is a collection of FileDescriptorInfo objects 380// keyed by their FDs. 381class FileDescriptorTable { 382 public: 383 // Creates a new FileDescriptorTable. This function scans 384 // /proc/self/fd for the list of open file descriptors and collects 385 // information about them. Returns NULL if an error occurs. 386 static FileDescriptorTable* Create() { 387 DIR* d = opendir(kFdPath); 388 if (d == NULL) { 389 ALOGE("Unable to open directory %s: %s", kFdPath, strerror(errno)); 390 return NULL; 391 } 392 int dir_fd = dirfd(d); 393 dirent* e; 394 395 std::unordered_map<int, FileDescriptorInfo*> open_fd_map; 396 while ((e = readdir(d)) != NULL) { 397 const int fd = ParseFd(e, dir_fd); 398 if (fd == -1) { 399 continue; 400 } 401 402 FileDescriptorInfo* info = FileDescriptorInfo::createFromFd(fd); 403 if (info == NULL) { 404 if (closedir(d) == -1) { 405 ALOGE("Unable to close directory : %s", strerror(errno)); 406 } 407 return NULL; 408 } 409 open_fd_map[fd] = info; 410 } 411 412 if (closedir(d) == -1) { 413 ALOGE("Unable to close directory : %s", strerror(errno)); 414 return NULL; 415 } 416 return new FileDescriptorTable(open_fd_map); 417 } 418 419 bool Restat() { 420 std::set<int> open_fds; 421 422 // First get the list of open descriptors. 423 DIR* d = opendir(kFdPath); 424 if (d == NULL) { 425 ALOGE("Unable to open directory %s: %s", kFdPath, strerror(errno)); 426 return false; 427 } 428 429 int dir_fd = dirfd(d); 430 dirent* e; 431 while ((e = readdir(d)) != NULL) { 432 const int fd = ParseFd(e, dir_fd); 433 if (fd == -1) { 434 continue; 435 } 436 437 open_fds.insert(fd); 438 } 439 440 if (closedir(d) == -1) { 441 ALOGE("Unable to close directory : %s", strerror(errno)); 442 return false; 443 } 444 445 return RestatInternal(open_fds); 446 } 447 448 // Reopens all file descriptors that are contained in the table. Returns true 449 // if all descriptors were successfully re-opened or detached, and false if an 450 // error occurred. 451 bool ReopenOrDetach() { 452 std::unordered_map<int, FileDescriptorInfo*>::const_iterator it; 453 for (it = open_fd_map_.begin(); it != open_fd_map_.end(); ++it) { 454 const FileDescriptorInfo* info = it->second; 455 if (info == NULL || !info->ReopenOrDetach()) { 456 return false; 457 } 458 } 459 460 return true; 461 } 462 463 private: 464 FileDescriptorTable(const std::unordered_map<int, FileDescriptorInfo*>& map) 465 : open_fd_map_(map) { 466 } 467 468 bool RestatInternal(std::set<int>& open_fds) { 469 bool error = false; 470 471 // Iterate through the list of file descriptors we've already recorded 472 // and check whether : 473 // 474 // (a) they continue to be open. 475 // (b) they refer to the same file. 476 std::unordered_map<int, FileDescriptorInfo*>::iterator it = open_fd_map_.begin(); 477 while (it != open_fd_map_.end()) { 478 std::set<int>::const_iterator element = open_fds.find(it->first); 479 if (element == open_fds.end()) { 480 // The entry from the file descriptor table is no longer in the list 481 // of open files. We warn about this condition and remove it from 482 // the list of FDs under consideration. 483 // 484 // TODO(narayan): This will be an error in a future android release. 485 // error = true; 486 // ALOGW("Zygote closed file descriptor %d.", it->first); 487 it = open_fd_map_.erase(it); 488 } else { 489 // The entry from the file descriptor table is still open. Restat 490 // it and check whether it refers to the same file. 491 const bool same_file = it->second->Restat(); 492 if (!same_file) { 493 // The file descriptor refers to a different description. We must 494 // update our entry in the table. 495 delete it->second; 496 it->second = FileDescriptorInfo::createFromFd(*element); 497 if (it->second == NULL) { 498 // The descriptor no longer no longer refers to a whitelisted file. 499 // We flag an error and remove it from the list of files we're 500 // tracking. 501 error = true; 502 it = open_fd_map_.erase(it); 503 } else { 504 // Successfully restatted the file, move on to the next open FD. 505 ++it; 506 } 507 } else { 508 // It's the same file. Nothing to do here. Move on to the next open 509 // FD. 510 ++it; 511 } 512 513 // Finally, remove the FD from the set of open_fds. We do this last because 514 // |element| will not remain valid after a call to erase. 515 open_fds.erase(element); 516 } 517 } 518 519 if (open_fds.size() > 0) { 520 // The zygote has opened new file descriptors since our last inspection. 521 // We warn about this condition and add them to our table. 522 // 523 // TODO(narayan): This will be an error in a future android release. 524 // error = true; 525 // ALOGW("Zygote opened %zd new file descriptor(s).", open_fds.size()); 526 527 // TODO(narayan): This code will be removed in a future android release. 528 std::set<int>::const_iterator it; 529 for (it = open_fds.begin(); it != open_fds.end(); ++it) { 530 const int fd = (*it); 531 FileDescriptorInfo* info = FileDescriptorInfo::createFromFd(fd); 532 if (info == NULL) { 533 // A newly opened file is not on the whitelist. Flag an error and 534 // continue. 535 error = true; 536 } else { 537 // Track the newly opened file. 538 open_fd_map_[fd] = info; 539 } 540 } 541 } 542 543 return !error; 544 } 545 546 static int ParseFd(dirent* e, int dir_fd) { 547 char* end; 548 const int fd = strtol(e->d_name, &end, 10); 549 if ((*end) != '\0') { 550 return -1; 551 } 552 553 // Don't bother with the standard input/output/error, they're handled 554 // specially post-fork anyway. 555 if (fd <= STDERR_FILENO || fd == dir_fd) { 556 return -1; 557 } 558 559 return fd; 560 } 561 562 // Invariant: All values in this unordered_map are non-NULL. 563 std::unordered_map<int, FileDescriptorInfo*> open_fd_map_; 564 565 DISALLOW_COPY_AND_ASSIGN(FileDescriptorTable); 566}; 567