1/* 2 * Copyright (C) 2015 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17#include "service.h" 18 19#include <fcntl.h> 20#include <inttypes.h> 21#include <linux/securebits.h> 22#include <sched.h> 23#include <sys/mount.h> 24#include <sys/prctl.h> 25#include <sys/resource.h> 26#include <sys/stat.h> 27#include <sys/time.h> 28#include <sys/wait.h> 29#include <termios.h> 30#include <unistd.h> 31 32#include <android-base/file.h> 33#include <android-base/logging.h> 34#include <android-base/parseint.h> 35#include <android-base/stringprintf.h> 36#include <android-base/strings.h> 37#include <android-base/unique_fd.h> 38#include <hidl-util/FQName.h> 39#include <processgroup/processgroup.h> 40#include <selinux/selinux.h> 41#include <system/thread_defs.h> 42 43#include "rlimit_parser.h" 44#include "util.h" 45 46#if defined(__ANDROID__) 47#include <sys/system_properties.h> 48 49#include <android-base/properties.h> 50 51#include "init.h" 52#include "property_service.h" 53#else 54#include "host_init_stubs.h" 55#endif 56 57using android::base::boot_clock; 58using android::base::GetProperty; 59using android::base::Join; 60using android::base::ParseInt; 61using android::base::StartsWith; 62using android::base::StringPrintf; 63using android::base::unique_fd; 64using android::base::WriteStringToFile; 65 66namespace android { 67namespace init { 68 69static Result<std::string> ComputeContextFromExecutable(const std::string& service_path) { 70 std::string computed_context; 71 72 char* raw_con = nullptr; 73 char* raw_filecon = nullptr; 74 75 if (getcon(&raw_con) == -1) { 76 return Error() << "Could not get security context"; 77 } 78 std::unique_ptr<char> mycon(raw_con); 79 80 if (getfilecon(service_path.c_str(), &raw_filecon) == -1) { 81 return Error() << "Could not get file context"; 82 } 83 std::unique_ptr<char> filecon(raw_filecon); 84 85 char* new_con = nullptr; 86 int rc = security_compute_create(mycon.get(), filecon.get(), 87 string_to_security_class("process"), &new_con); 88 if (rc == 0) { 89 computed_context = new_con; 90 free(new_con); 91 } 92 if (rc == 0 && computed_context == mycon.get()) { 93 return Error() << "File " << service_path << "(labeled \"" << filecon.get() 94 << "\") has incorrect label or no domain transition from " << mycon.get() 95 << " to another SELinux domain defined. Have you configured your " 96 "service correctly? https://source.android.com/security/selinux/" 97 "device-policy#label_new_services_and_address_denials"; 98 } 99 if (rc < 0) { 100 return Error() << "Could not get process context"; 101 } 102 return computed_context; 103} 104 105Result<Success> Service::SetUpMountNamespace() const { 106 constexpr unsigned int kSafeFlags = MS_NODEV | MS_NOEXEC | MS_NOSUID; 107 108 // Recursively remount / as slave like zygote does so unmounting and mounting /proc 109 // doesn't interfere with the parent namespace's /proc mount. This will also 110 // prevent any other mounts/unmounts initiated by the service from interfering 111 // with the parent namespace but will still allow mount events from the parent 112 // namespace to propagate to the child. 113 if (mount("rootfs", "/", nullptr, (MS_SLAVE | MS_REC), nullptr) == -1) { 114 return ErrnoError() << "Could not remount(/) recursively as slave"; 115 } 116 117 // umount() then mount() /proc and/or /sys 118 // Note that it is not sufficient to mount with MS_REMOUNT. 119 if (namespace_flags_ & CLONE_NEWPID) { 120 if (umount("/proc") == -1) { 121 return ErrnoError() << "Could not umount(/proc)"; 122 } 123 if (mount("", "/proc", "proc", kSafeFlags, "") == -1) { 124 return ErrnoError() << "Could not mount(/proc)"; 125 } 126 } 127 bool remount_sys = std::any_of(namespaces_to_enter_.begin(), namespaces_to_enter_.end(), 128 [](const auto& entry) { return entry.first == CLONE_NEWNET; }); 129 if (remount_sys) { 130 if (umount2("/sys", MNT_DETACH) == -1) { 131 return ErrnoError() << "Could not umount(/sys)"; 132 } 133 if (mount("", "/sys", "sys", kSafeFlags, "") == -1) { 134 return ErrnoError() << "Could not mount(/sys)"; 135 } 136 } 137 return Success(); 138} 139 140Result<Success> Service::SetUpPidNamespace() const { 141 if (prctl(PR_SET_NAME, name_.c_str()) == -1) { 142 return ErrnoError() << "Could not set name"; 143 } 144 145 pid_t child_pid = fork(); 146 if (child_pid == -1) { 147 return ErrnoError() << "Could not fork init inside the PID namespace"; 148 } 149 150 if (child_pid > 0) { 151 // So that we exit with the right status. 152 static int init_exitstatus = 0; 153 signal(SIGTERM, [](int) { _exit(init_exitstatus); }); 154 155 pid_t waited_pid; 156 int status; 157 while ((waited_pid = wait(&status)) > 0) { 158 // This loop will end when there are no processes left inside the 159 // PID namespace or when the init process inside the PID namespace 160 // gets a signal. 161 if (waited_pid == child_pid) { 162 init_exitstatus = status; 163 } 164 } 165 if (!WIFEXITED(init_exitstatus)) { 166 _exit(EXIT_FAILURE); 167 } 168 _exit(WEXITSTATUS(init_exitstatus)); 169 } 170 return Success(); 171} 172 173Result<Success> Service::EnterNamespaces() const { 174 for (const auto& [nstype, path] : namespaces_to_enter_) { 175 auto fd = unique_fd{open(path.c_str(), O_RDONLY | O_CLOEXEC)}; 176 if (!fd) { 177 return ErrnoError() << "Could not open namespace at " << path; 178 } 179 if (setns(fd, nstype) == -1) { 180 return ErrnoError() << "Could not setns() namespace at " << path; 181 } 182 } 183 return Success(); 184} 185 186static bool ExpandArgsAndExecv(const std::vector<std::string>& args) { 187 std::vector<std::string> expanded_args; 188 std::vector<char*> c_strings; 189 190 expanded_args.resize(args.size()); 191 c_strings.push_back(const_cast<char*>(args[0].data())); 192 for (std::size_t i = 1; i < args.size(); ++i) { 193 if (!expand_props(args[i], &expanded_args[i])) { 194 LOG(FATAL) << args[0] << ": cannot expand '" << args[i] << "'"; 195 } 196 c_strings.push_back(expanded_args[i].data()); 197 } 198 c_strings.push_back(nullptr); 199 200 return execv(c_strings[0], c_strings.data()) == 0; 201} 202 203unsigned long Service::next_start_order_ = 1; 204bool Service::is_exec_service_running_ = false; 205 206Service::Service(const std::string& name, Subcontext* subcontext_for_restart_commands, 207 const std::vector<std::string>& args) 208 : Service(name, 0, 0, 0, {}, 0, 0, "", subcontext_for_restart_commands, args) {} 209 210Service::Service(const std::string& name, unsigned flags, uid_t uid, gid_t gid, 211 const std::vector<gid_t>& supp_gids, const CapSet& capabilities, 212 unsigned namespace_flags, const std::string& seclabel, 213 Subcontext* subcontext_for_restart_commands, const std::vector<std::string>& args) 214 : name_(name), 215 classnames_({"default"}), 216 flags_(flags), 217 pid_(0), 218 crash_count_(0), 219 uid_(uid), 220 gid_(gid), 221 supp_gids_(supp_gids), 222 capabilities_(capabilities), 223 namespace_flags_(namespace_flags), 224 seclabel_(seclabel), 225 onrestart_(false, subcontext_for_restart_commands, "<Service '" + name + "' onrestart>", 0, 226 "onrestart", {}), 227 keychord_id_(0), 228 ioprio_class_(IoSchedClass_NONE), 229 ioprio_pri_(0), 230 priority_(0), 231 oom_score_adjust_(-1000), 232 swappiness_(-1), 233 soft_limit_in_bytes_(-1), 234 limit_in_bytes_(-1), 235 start_order_(0), 236 args_(args) {} 237 238void Service::NotifyStateChange(const std::string& new_state) const { 239 if ((flags_ & SVC_TEMPORARY) != 0) { 240 // Services created by 'exec' are temporary and don't have properties tracking their state. 241 return; 242 } 243 244 std::string prop_name = "init.svc." + name_; 245 property_set(prop_name, new_state); 246 247 if (new_state == "running") { 248 uint64_t start_ns = time_started_.time_since_epoch().count(); 249 std::string boottime_property = "ro.boottime." + name_; 250 if (GetProperty(boottime_property, "").empty()) { 251 property_set(boottime_property, std::to_string(start_ns)); 252 } 253 } 254} 255 256void Service::KillProcessGroup(int signal) { 257 // If we've already seen a successful result from killProcessGroup*(), then we have removed 258 // the cgroup already and calling these functions a second time will simply result in an error. 259 // This is true regardless of which signal was sent. 260 // These functions handle their own logging, so no additional logging is needed. 261 if (!process_cgroup_empty_) { 262 LOG(INFO) << "Sending signal " << signal << " to service '" << name_ << "' (pid " << pid_ 263 << ") process group..."; 264 int r; 265 if (signal == SIGTERM) { 266 r = killProcessGroupOnce(uid_, pid_, signal); 267 } else { 268 r = killProcessGroup(uid_, pid_, signal); 269 } 270 271 if (r == 0) process_cgroup_empty_ = true; 272 } 273} 274 275void Service::SetProcessAttributes() { 276 for (const auto& rlimit : rlimits_) { 277 if (setrlimit(rlimit.first, &rlimit.second) == -1) { 278 LOG(FATAL) << StringPrintf("setrlimit(%d, {rlim_cur=%ld, rlim_max=%ld}) failed", 279 rlimit.first, rlimit.second.rlim_cur, rlimit.second.rlim_max); 280 } 281 } 282 // Keep capabilites on uid change. 283 if (capabilities_.any() && uid_) { 284 // If Android is running in a container, some securebits might already 285 // be locked, so don't change those. 286 unsigned long securebits = prctl(PR_GET_SECUREBITS); 287 if (securebits == -1UL) { 288 PLOG(FATAL) << "prctl(PR_GET_SECUREBITS) failed for " << name_; 289 } 290 securebits |= SECBIT_KEEP_CAPS | SECBIT_KEEP_CAPS_LOCKED; 291 if (prctl(PR_SET_SECUREBITS, securebits) != 0) { 292 PLOG(FATAL) << "prctl(PR_SET_SECUREBITS) failed for " << name_; 293 } 294 } 295 296 // TODO: work out why this fails for `console` then upgrade to FATAL. 297 if (setpgid(0, getpid()) == -1) PLOG(ERROR) << "setpgid failed for " << name_; 298 299 if (gid_) { 300 if (setgid(gid_) != 0) { 301 PLOG(FATAL) << "setgid failed for " << name_; 302 } 303 } 304 if (setgroups(supp_gids_.size(), &supp_gids_[0]) != 0) { 305 PLOG(FATAL) << "setgroups failed for " << name_; 306 } 307 if (uid_) { 308 if (setuid(uid_) != 0) { 309 PLOG(FATAL) << "setuid failed for " << name_; 310 } 311 } 312 if (!seclabel_.empty()) { 313 if (setexeccon(seclabel_.c_str()) < 0) { 314 PLOG(FATAL) << "cannot setexeccon('" << seclabel_ << "') for " << name_; 315 } 316 } 317 if (priority_ != 0) { 318 if (setpriority(PRIO_PROCESS, 0, priority_) != 0) { 319 PLOG(FATAL) << "setpriority failed for " << name_; 320 } 321 } 322 if (capabilities_.any()) { 323 if (!SetCapsForExec(capabilities_)) { 324 LOG(FATAL) << "cannot set capabilities for " << name_; 325 } 326 } else if (uid_) { 327 // Inheritable caps can be non-zero when running in a container. 328 if (!DropInheritableCaps()) { 329 LOG(FATAL) << "cannot drop inheritable caps for " << name_; 330 } 331 } 332} 333 334void Service::Reap(const siginfo_t& siginfo) { 335 if (!(flags_ & SVC_ONESHOT) || (flags_ & SVC_RESTART)) { 336 KillProcessGroup(SIGKILL); 337 } 338 339 // Remove any descriptor resources we may have created. 340 std::for_each(descriptors_.begin(), descriptors_.end(), 341 std::bind(&DescriptorInfo::Clean, std::placeholders::_1)); 342 343 for (const auto& f : reap_callbacks_) { 344 f(siginfo); 345 } 346 347 if (flags_ & SVC_EXEC) UnSetExec(); 348 349 if (flags_ & SVC_TEMPORARY) return; 350 351 pid_ = 0; 352 flags_ &= (~SVC_RUNNING); 353 start_order_ = 0; 354 355 // Oneshot processes go into the disabled state on exit, 356 // except when manually restarted. 357 if ((flags_ & SVC_ONESHOT) && !(flags_ & SVC_RESTART)) { 358 flags_ |= SVC_DISABLED; 359 } 360 361 // Disabled and reset processes do not get restarted automatically. 362 if (flags_ & (SVC_DISABLED | SVC_RESET)) { 363 NotifyStateChange("stopped"); 364 return; 365 } 366 367 // If we crash > 4 times in 4 minutes, reboot into recovery. 368 boot_clock::time_point now = boot_clock::now(); 369 if ((flags_ & SVC_CRITICAL) && !(flags_ & SVC_RESTART)) { 370 if (now < time_crashed_ + 4min) { 371 if (++crash_count_ > 4) { 372 LOG(FATAL) << "critical process '" << name_ << "' exited 4 times in 4 minutes"; 373 } 374 } else { 375 time_crashed_ = now; 376 crash_count_ = 1; 377 } 378 } 379 380 flags_ &= (~SVC_RESTART); 381 flags_ |= SVC_RESTARTING; 382 383 // Execute all onrestart commands for this service. 384 onrestart_.ExecuteAllCommands(); 385 386 NotifyStateChange("restarting"); 387 return; 388} 389 390void Service::DumpState() const { 391 LOG(INFO) << "service " << name_; 392 LOG(INFO) << " class '" << Join(classnames_, " ") << "'"; 393 LOG(INFO) << " exec " << Join(args_, " "); 394 std::for_each(descriptors_.begin(), descriptors_.end(), 395 [] (const auto& info) { LOG(INFO) << *info; }); 396} 397 398Result<Success> Service::ParseCapabilities(const std::vector<std::string>& args) { 399 capabilities_ = 0; 400 401 if (!CapAmbientSupported()) { 402 return Error() 403 << "capabilities requested but the kernel does not support ambient capabilities"; 404 } 405 406 unsigned int last_valid_cap = GetLastValidCap(); 407 if (last_valid_cap >= capabilities_.size()) { 408 LOG(WARNING) << "last valid run-time capability is larger than CAP_LAST_CAP"; 409 } 410 411 for (size_t i = 1; i < args.size(); i++) { 412 const std::string& arg = args[i]; 413 int res = LookupCap(arg); 414 if (res < 0) { 415 return Error() << StringPrintf("invalid capability '%s'", arg.c_str()); 416 } 417 unsigned int cap = static_cast<unsigned int>(res); // |res| is >= 0. 418 if (cap > last_valid_cap) { 419 return Error() << StringPrintf("capability '%s' not supported by the kernel", 420 arg.c_str()); 421 } 422 capabilities_[cap] = true; 423 } 424 return Success(); 425} 426 427Result<Success> Service::ParseClass(const std::vector<std::string>& args) { 428 classnames_ = std::set<std::string>(args.begin() + 1, args.end()); 429 return Success(); 430} 431 432Result<Success> Service::ParseConsole(const std::vector<std::string>& args) { 433 flags_ |= SVC_CONSOLE; 434 console_ = args.size() > 1 ? "/dev/" + args[1] : ""; 435 return Success(); 436} 437 438Result<Success> Service::ParseCritical(const std::vector<std::string>& args) { 439 flags_ |= SVC_CRITICAL; 440 return Success(); 441} 442 443Result<Success> Service::ParseDisabled(const std::vector<std::string>& args) { 444 flags_ |= SVC_DISABLED; 445 flags_ |= SVC_RC_DISABLED; 446 return Success(); 447} 448 449Result<Success> Service::ParseEnterNamespace(const std::vector<std::string>& args) { 450 if (args[1] != "net") { 451 return Error() << "Init only supports entering network namespaces"; 452 } 453 if (!namespaces_to_enter_.empty()) { 454 return Error() << "Only one network namespace may be entered"; 455 } 456 // Network namespaces require that /sys is remounted, otherwise the old adapters will still be 457 // present. Therefore, they also require mount namespaces. 458 namespace_flags_ |= CLONE_NEWNS; 459 namespaces_to_enter_.emplace_back(CLONE_NEWNET, args[2]); 460 return Success(); 461} 462 463Result<Success> Service::ParseGroup(const std::vector<std::string>& args) { 464 auto gid = DecodeUid(args[1]); 465 if (!gid) { 466 return Error() << "Unable to decode GID for '" << args[1] << "': " << gid.error(); 467 } 468 gid_ = *gid; 469 470 for (std::size_t n = 2; n < args.size(); n++) { 471 gid = DecodeUid(args[n]); 472 if (!gid) { 473 return Error() << "Unable to decode GID for '" << args[n] << "': " << gid.error(); 474 } 475 supp_gids_.emplace_back(*gid); 476 } 477 return Success(); 478} 479 480Result<Success> Service::ParsePriority(const std::vector<std::string>& args) { 481 priority_ = 0; 482 if (!ParseInt(args[1], &priority_, 483 static_cast<int>(ANDROID_PRIORITY_HIGHEST), // highest is negative 484 static_cast<int>(ANDROID_PRIORITY_LOWEST))) { 485 return Error() << StringPrintf("process priority value must be range %d - %d", 486 ANDROID_PRIORITY_HIGHEST, ANDROID_PRIORITY_LOWEST); 487 } 488 return Success(); 489} 490 491Result<Success> Service::ParseInterface(const std::vector<std::string>& args) { 492 const std::string& interface_name = args[1]; 493 const std::string& instance_name = args[2]; 494 495 const FQName fq_name = FQName(interface_name); 496 if (!fq_name.isValid()) { 497 return Error() << "Invalid fully-qualified name for interface '" << interface_name << "'"; 498 } 499 500 if (!fq_name.isFullyQualified()) { 501 return Error() << "Interface name not fully-qualified '" << interface_name << "'"; 502 } 503 504 if (fq_name.isValidValueName()) { 505 return Error() << "Interface name must not be a value name '" << interface_name << "'"; 506 } 507 508 const std::string fullname = interface_name + "/" + instance_name; 509 510 for (const auto& svc : ServiceList::GetInstance()) { 511 if (svc->interfaces().count(fullname) > 0) { 512 return Error() << "Interface '" << fullname << "' redefined in " << name() 513 << " but is already defined by " << svc->name(); 514 } 515 } 516 517 interfaces_.insert(fullname); 518 519 return Success(); 520} 521 522Result<Success> Service::ParseIoprio(const std::vector<std::string>& args) { 523 if (!ParseInt(args[2], &ioprio_pri_, 0, 7)) { 524 return Error() << "priority value must be range 0 - 7"; 525 } 526 527 if (args[1] == "rt") { 528 ioprio_class_ = IoSchedClass_RT; 529 } else if (args[1] == "be") { 530 ioprio_class_ = IoSchedClass_BE; 531 } else if (args[1] == "idle") { 532 ioprio_class_ = IoSchedClass_IDLE; 533 } else { 534 return Error() << "ioprio option usage: ioprio <rt|be|idle> <0-7>"; 535 } 536 537 return Success(); 538} 539 540Result<Success> Service::ParseKeycodes(const std::vector<std::string>& args) { 541 for (std::size_t i = 1; i < args.size(); i++) { 542 int code; 543 if (ParseInt(args[i], &code)) { 544 keycodes_.emplace_back(code); 545 } else { 546 LOG(WARNING) << "ignoring invalid keycode: " << args[i]; 547 } 548 } 549 return Success(); 550} 551 552Result<Success> Service::ParseOneshot(const std::vector<std::string>& args) { 553 flags_ |= SVC_ONESHOT; 554 return Success(); 555} 556 557Result<Success> Service::ParseOnrestart(const std::vector<std::string>& args) { 558 std::vector<std::string> str_args(args.begin() + 1, args.end()); 559 int line = onrestart_.NumCommands() + 1; 560 if (auto result = onrestart_.AddCommand(str_args, line); !result) { 561 return Error() << "cannot add Onrestart command: " << result.error(); 562 } 563 return Success(); 564} 565 566Result<Success> Service::ParseNamespace(const std::vector<std::string>& args) { 567 for (size_t i = 1; i < args.size(); i++) { 568 if (args[i] == "pid") { 569 namespace_flags_ |= CLONE_NEWPID; 570 // PID namespaces require mount namespaces. 571 namespace_flags_ |= CLONE_NEWNS; 572 } else if (args[i] == "mnt") { 573 namespace_flags_ |= CLONE_NEWNS; 574 } else { 575 return Error() << "namespace must be 'pid' or 'mnt'"; 576 } 577 } 578 return Success(); 579} 580 581Result<Success> Service::ParseOomScoreAdjust(const std::vector<std::string>& args) { 582 if (!ParseInt(args[1], &oom_score_adjust_, -1000, 1000)) { 583 return Error() << "oom_score_adjust value must be in range -1000 - +1000"; 584 } 585 return Success(); 586} 587 588Result<Success> Service::ParseOverride(const std::vector<std::string>& args) { 589 override_ = true; 590 return Success(); 591} 592 593Result<Success> Service::ParseMemcgSwappiness(const std::vector<std::string>& args) { 594 if (!ParseInt(args[1], &swappiness_, 0)) { 595 return Error() << "swappiness value must be equal or greater than 0"; 596 } 597 return Success(); 598} 599 600Result<Success> Service::ParseMemcgLimitInBytes(const std::vector<std::string>& args) { 601 if (!ParseInt(args[1], &limit_in_bytes_, 0)) { 602 return Error() << "limit_in_bytes value must be equal or greater than 0"; 603 } 604 return Success(); 605} 606 607Result<Success> Service::ParseMemcgSoftLimitInBytes(const std::vector<std::string>& args) { 608 if (!ParseInt(args[1], &soft_limit_in_bytes_, 0)) { 609 return Error() << "soft_limit_in_bytes value must be equal or greater than 0"; 610 } 611 return Success(); 612} 613 614Result<Success> Service::ParseProcessRlimit(const std::vector<std::string>& args) { 615 auto rlimit = ParseRlimit(args); 616 if (!rlimit) return rlimit.error(); 617 618 rlimits_.emplace_back(*rlimit); 619 return Success(); 620} 621 622Result<Success> Service::ParseSeclabel(const std::vector<std::string>& args) { 623 seclabel_ = args[1]; 624 return Success(); 625} 626 627Result<Success> Service::ParseSetenv(const std::vector<std::string>& args) { 628 environment_vars_.emplace_back(args[1], args[2]); 629 return Success(); 630} 631 632Result<Success> Service::ParseShutdown(const std::vector<std::string>& args) { 633 if (args[1] == "critical") { 634 flags_ |= SVC_SHUTDOWN_CRITICAL; 635 return Success(); 636 } 637 return Error() << "Invalid shutdown option"; 638} 639 640template <typename T> 641Result<Success> Service::AddDescriptor(const std::vector<std::string>& args) { 642 int perm = args.size() > 3 ? std::strtoul(args[3].c_str(), 0, 8) : -1; 643 Result<uid_t> uid = 0; 644 Result<gid_t> gid = 0; 645 std::string context = args.size() > 6 ? args[6] : ""; 646 647 if (args.size() > 4) { 648 uid = DecodeUid(args[4]); 649 if (!uid) { 650 return Error() << "Unable to find UID for '" << args[4] << "': " << uid.error(); 651 } 652 } 653 654 if (args.size() > 5) { 655 gid = DecodeUid(args[5]); 656 if (!gid) { 657 return Error() << "Unable to find GID for '" << args[5] << "': " << gid.error(); 658 } 659 } 660 661 auto descriptor = std::make_unique<T>(args[1], args[2], *uid, *gid, perm, context); 662 663 auto old = 664 std::find_if(descriptors_.begin(), descriptors_.end(), 665 [&descriptor] (const auto& other) { return descriptor.get() == other.get(); }); 666 667 if (old != descriptors_.end()) { 668 return Error() << "duplicate descriptor " << args[1] << " " << args[2]; 669 } 670 671 descriptors_.emplace_back(std::move(descriptor)); 672 return Success(); 673} 674 675// name type perm [ uid gid context ] 676Result<Success> Service::ParseSocket(const std::vector<std::string>& args) { 677 if (!StartsWith(args[2], "dgram") && !StartsWith(args[2], "stream") && 678 !StartsWith(args[2], "seqpacket")) { 679 return Error() << "socket type must be 'dgram', 'stream' or 'seqpacket'"; 680 } 681 return AddDescriptor<SocketInfo>(args); 682} 683 684// name type perm [ uid gid context ] 685Result<Success> Service::ParseFile(const std::vector<std::string>& args) { 686 if (args[2] != "r" && args[2] != "w" && args[2] != "rw") { 687 return Error() << "file type must be 'r', 'w' or 'rw'"; 688 } 689 if ((args[1][0] != '/') || (args[1].find("../") != std::string::npos)) { 690 return Error() << "file name must not be relative"; 691 } 692 return AddDescriptor<FileInfo>(args); 693} 694 695Result<Success> Service::ParseUser(const std::vector<std::string>& args) { 696 auto uid = DecodeUid(args[1]); 697 if (!uid) { 698 return Error() << "Unable to find UID for '" << args[1] << "': " << uid.error(); 699 } 700 uid_ = *uid; 701 return Success(); 702} 703 704Result<Success> Service::ParseWritepid(const std::vector<std::string>& args) { 705 writepid_files_.assign(args.begin() + 1, args.end()); 706 return Success(); 707} 708 709class Service::OptionParserMap : public KeywordMap<OptionParser> { 710 public: 711 OptionParserMap() {} 712 713 private: 714 const Map& map() const override; 715}; 716 717const Service::OptionParserMap::Map& Service::OptionParserMap::map() const { 718 constexpr std::size_t kMax = std::numeric_limits<std::size_t>::max(); 719 // clang-format off 720 static const Map option_parsers = { 721 {"capabilities", 722 {1, kMax, &Service::ParseCapabilities}}, 723 {"class", {1, kMax, &Service::ParseClass}}, 724 {"console", {0, 1, &Service::ParseConsole}}, 725 {"critical", {0, 0, &Service::ParseCritical}}, 726 {"disabled", {0, 0, &Service::ParseDisabled}}, 727 {"enter_namespace", 728 {2, 2, &Service::ParseEnterNamespace}}, 729 {"group", {1, NR_SVC_SUPP_GIDS + 1, &Service::ParseGroup}}, 730 {"interface", {2, 2, &Service::ParseInterface}}, 731 {"ioprio", {2, 2, &Service::ParseIoprio}}, 732 {"priority", {1, 1, &Service::ParsePriority}}, 733 {"keycodes", {1, kMax, &Service::ParseKeycodes}}, 734 {"oneshot", {0, 0, &Service::ParseOneshot}}, 735 {"onrestart", {1, kMax, &Service::ParseOnrestart}}, 736 {"override", {0, 0, &Service::ParseOverride}}, 737 {"oom_score_adjust", 738 {1, 1, &Service::ParseOomScoreAdjust}}, 739 {"memcg.swappiness", 740 {1, 1, &Service::ParseMemcgSwappiness}}, 741 {"memcg.soft_limit_in_bytes", 742 {1, 1, &Service::ParseMemcgSoftLimitInBytes}}, 743 {"memcg.limit_in_bytes", 744 {1, 1, &Service::ParseMemcgLimitInBytes}}, 745 {"namespace", {1, 2, &Service::ParseNamespace}}, 746 {"rlimit", {3, 3, &Service::ParseProcessRlimit}}, 747 {"seclabel", {1, 1, &Service::ParseSeclabel}}, 748 {"setenv", {2, 2, &Service::ParseSetenv}}, 749 {"shutdown", {1, 1, &Service::ParseShutdown}}, 750 {"socket", {3, 6, &Service::ParseSocket}}, 751 {"file", {2, 2, &Service::ParseFile}}, 752 {"user", {1, 1, &Service::ParseUser}}, 753 {"writepid", {1, kMax, &Service::ParseWritepid}}, 754 }; 755 // clang-format on 756 return option_parsers; 757} 758 759Result<Success> Service::ParseLine(const std::vector<std::string>& args) { 760 static const OptionParserMap parser_map; 761 auto parser = parser_map.FindFunction(args); 762 763 if (!parser) return parser.error(); 764 765 return std::invoke(*parser, this, args); 766} 767 768Result<Success> Service::ExecStart() { 769 flags_ |= SVC_ONESHOT; 770 771 if (auto result = Start(); !result) { 772 return result; 773 } 774 775 flags_ |= SVC_EXEC; 776 is_exec_service_running_ = true; 777 778 LOG(INFO) << "SVC_EXEC pid " << pid_ << " (uid " << uid_ << " gid " << gid_ << "+" 779 << supp_gids_.size() << " context " << (!seclabel_.empty() ? seclabel_ : "default") 780 << ") started; waiting..."; 781 782 return Success(); 783} 784 785Result<Success> Service::Start() { 786 bool disabled = (flags_ & (SVC_DISABLED | SVC_RESET)); 787 // Starting a service removes it from the disabled or reset state and 788 // immediately takes it out of the restarting state if it was in there. 789 flags_ &= (~(SVC_DISABLED|SVC_RESTARTING|SVC_RESET|SVC_RESTART|SVC_DISABLED_START)); 790 791 // Running processes require no additional work --- if they're in the 792 // process of exiting, we've ensured that they will immediately restart 793 // on exit, unless they are ONESHOT. For ONESHOT service, if it's in 794 // stopping status, we just set SVC_RESTART flag so it will get restarted 795 // in Reap(). 796 if (flags_ & SVC_RUNNING) { 797 if ((flags_ & SVC_ONESHOT) && disabled) { 798 flags_ |= SVC_RESTART; 799 } 800 // It is not an error to try to start a service that is already running. 801 return Success(); 802 } 803 804 bool needs_console = (flags_ & SVC_CONSOLE); 805 if (needs_console) { 806 if (console_.empty()) { 807 console_ = default_console; 808 } 809 810 // Make sure that open call succeeds to ensure a console driver is 811 // properly registered for the device node 812 int console_fd = open(console_.c_str(), O_RDWR | O_CLOEXEC); 813 if (console_fd < 0) { 814 flags_ |= SVC_DISABLED; 815 return ErrnoError() << "Couldn't open console '" << console_ << "'"; 816 } 817 close(console_fd); 818 } 819 820 struct stat sb; 821 if (stat(args_[0].c_str(), &sb) == -1) { 822 flags_ |= SVC_DISABLED; 823 return ErrnoError() << "Cannot find '" << args_[0] << "'"; 824 } 825 826 std::string scon; 827 if (!seclabel_.empty()) { 828 scon = seclabel_; 829 } else { 830 auto result = ComputeContextFromExecutable(args_[0]); 831 if (!result) { 832 return result.error(); 833 } 834 scon = *result; 835 } 836 837 LOG(INFO) << "starting service '" << name_ << "'..."; 838 839 pid_t pid = -1; 840 if (namespace_flags_) { 841 pid = clone(nullptr, nullptr, namespace_flags_ | SIGCHLD, nullptr); 842 } else { 843 pid = fork(); 844 } 845 846 if (pid == 0) { 847 umask(077); 848 849 if (auto result = EnterNamespaces(); !result) { 850 LOG(FATAL) << "Service '" << name_ << "' could not enter namespaces: " << result.error(); 851 } 852 853 if (namespace_flags_ & CLONE_NEWNS) { 854 if (auto result = SetUpMountNamespace(); !result) { 855 LOG(FATAL) << "Service '" << name_ 856 << "' could not set up mount namespace: " << result.error(); 857 } 858 } 859 860 if (namespace_flags_ & CLONE_NEWPID) { 861 // This will fork again to run an init process inside the PID 862 // namespace. 863 if (auto result = SetUpPidNamespace(); !result) { 864 LOG(FATAL) << "Service '" << name_ 865 << "' could not set up PID namespace: " << result.error(); 866 } 867 } 868 869 for (const auto& [key, value] : environment_vars_) { 870 setenv(key.c_str(), value.c_str(), 1); 871 } 872 873 std::for_each(descriptors_.begin(), descriptors_.end(), 874 std::bind(&DescriptorInfo::CreateAndPublish, std::placeholders::_1, scon)); 875 876 // See if there were "writepid" instructions to write to files under /dev/cpuset/. 877 auto cpuset_predicate = [](const std::string& path) { 878 return StartsWith(path, "/dev/cpuset/"); 879 }; 880 auto iter = std::find_if(writepid_files_.begin(), writepid_files_.end(), cpuset_predicate); 881 if (iter == writepid_files_.end()) { 882 // There were no "writepid" instructions for cpusets, check if the system default 883 // cpuset is specified to be used for the process. 884 std::string default_cpuset = GetProperty("ro.cpuset.default", ""); 885 if (!default_cpuset.empty()) { 886 // Make sure the cpuset name starts and ends with '/'. 887 // A single '/' means the 'root' cpuset. 888 if (default_cpuset.front() != '/') { 889 default_cpuset.insert(0, 1, '/'); 890 } 891 if (default_cpuset.back() != '/') { 892 default_cpuset.push_back('/'); 893 } 894 writepid_files_.push_back( 895 StringPrintf("/dev/cpuset%stasks", default_cpuset.c_str())); 896 } 897 } 898 std::string pid_str = std::to_string(getpid()); 899 for (const auto& file : writepid_files_) { 900 if (!WriteStringToFile(pid_str, file)) { 901 PLOG(ERROR) << "couldn't write " << pid_str << " to " << file; 902 } 903 } 904 905 if (ioprio_class_ != IoSchedClass_NONE) { 906 if (android_set_ioprio(getpid(), ioprio_class_, ioprio_pri_)) { 907 PLOG(ERROR) << "failed to set pid " << getpid() 908 << " ioprio=" << ioprio_class_ << "," << ioprio_pri_; 909 } 910 } 911 912 if (needs_console) { 913 setsid(); 914 OpenConsole(); 915 } else { 916 ZapStdio(); 917 } 918 919 // As requested, set our gid, supplemental gids, uid, context, and 920 // priority. Aborts on failure. 921 SetProcessAttributes(); 922 923 if (!ExpandArgsAndExecv(args_)) { 924 PLOG(ERROR) << "cannot execve('" << args_[0] << "')"; 925 } 926 927 _exit(127); 928 } 929 930 if (pid < 0) { 931 pid_ = 0; 932 return ErrnoError() << "Failed to fork"; 933 } 934 935 if (oom_score_adjust_ != -1000) { 936 std::string oom_str = std::to_string(oom_score_adjust_); 937 std::string oom_file = StringPrintf("/proc/%d/oom_score_adj", pid); 938 if (!WriteStringToFile(oom_str, oom_file)) { 939 PLOG(ERROR) << "couldn't write oom_score_adj: " << strerror(errno); 940 } 941 } 942 943 time_started_ = boot_clock::now(); 944 pid_ = pid; 945 flags_ |= SVC_RUNNING; 946 start_order_ = next_start_order_++; 947 process_cgroup_empty_ = false; 948 949 errno = -createProcessGroup(uid_, pid_); 950 if (errno != 0) { 951 PLOG(ERROR) << "createProcessGroup(" << uid_ << ", " << pid_ << ") failed for service '" 952 << name_ << "'"; 953 } else { 954 if (swappiness_ != -1) { 955 if (!setProcessGroupSwappiness(uid_, pid_, swappiness_)) { 956 PLOG(ERROR) << "setProcessGroupSwappiness failed"; 957 } 958 } 959 960 if (soft_limit_in_bytes_ != -1) { 961 if (!setProcessGroupSoftLimit(uid_, pid_, soft_limit_in_bytes_)) { 962 PLOG(ERROR) << "setProcessGroupSoftLimit failed"; 963 } 964 } 965 966 if (limit_in_bytes_ != -1) { 967 if (!setProcessGroupLimit(uid_, pid_, limit_in_bytes_)) { 968 PLOG(ERROR) << "setProcessGroupLimit failed"; 969 } 970 } 971 } 972 973 NotifyStateChange("running"); 974 return Success(); 975} 976 977Result<Success> Service::StartIfNotDisabled() { 978 if (!(flags_ & SVC_DISABLED)) { 979 return Start(); 980 } else { 981 flags_ |= SVC_DISABLED_START; 982 } 983 return Success(); 984} 985 986Result<Success> Service::Enable() { 987 flags_ &= ~(SVC_DISABLED | SVC_RC_DISABLED); 988 if (flags_ & SVC_DISABLED_START) { 989 return Start(); 990 } 991 return Success(); 992} 993 994void Service::Reset() { 995 StopOrReset(SVC_RESET); 996} 997 998void Service::Stop() { 999 StopOrReset(SVC_DISABLED); 1000} 1001 1002void Service::Terminate() { 1003 flags_ &= ~(SVC_RESTARTING | SVC_DISABLED_START); 1004 flags_ |= SVC_DISABLED; 1005 if (pid_) { 1006 KillProcessGroup(SIGTERM); 1007 NotifyStateChange("stopping"); 1008 } 1009} 1010 1011void Service::Restart() { 1012 if (flags_ & SVC_RUNNING) { 1013 /* Stop, wait, then start the service. */ 1014 StopOrReset(SVC_RESTART); 1015 } else if (!(flags_ & SVC_RESTARTING)) { 1016 /* Just start the service since it's not running. */ 1017 if (auto result = Start(); !result) { 1018 LOG(ERROR) << "Could not restart '" << name_ << "': " << result.error(); 1019 } 1020 } /* else: Service is restarting anyways. */ 1021} 1022 1023// The how field should be either SVC_DISABLED, SVC_RESET, or SVC_RESTART. 1024void Service::StopOrReset(int how) { 1025 // The service is still SVC_RUNNING until its process exits, but if it has 1026 // already exited it shoudn't attempt a restart yet. 1027 flags_ &= ~(SVC_RESTARTING | SVC_DISABLED_START); 1028 1029 if ((how != SVC_DISABLED) && (how != SVC_RESET) && (how != SVC_RESTART)) { 1030 // An illegal flag: default to SVC_DISABLED. 1031 how = SVC_DISABLED; 1032 } 1033 1034 // If the service has not yet started, prevent it from auto-starting with its class. 1035 if (how == SVC_RESET) { 1036 flags_ |= (flags_ & SVC_RC_DISABLED) ? SVC_DISABLED : SVC_RESET; 1037 } else { 1038 flags_ |= how; 1039 } 1040 // Make sure it's in right status when a restart immediately follow a 1041 // stop/reset or vice versa. 1042 if (how == SVC_RESTART) { 1043 flags_ &= (~(SVC_DISABLED | SVC_RESET)); 1044 } else { 1045 flags_ &= (~SVC_RESTART); 1046 } 1047 1048 if (pid_) { 1049 KillProcessGroup(SIGKILL); 1050 NotifyStateChange("stopping"); 1051 } else { 1052 NotifyStateChange("stopped"); 1053 } 1054} 1055 1056void Service::ZapStdio() const { 1057 int fd; 1058 fd = open("/dev/null", O_RDWR); 1059 dup2(fd, 0); 1060 dup2(fd, 1); 1061 dup2(fd, 2); 1062 close(fd); 1063} 1064 1065void Service::OpenConsole() const { 1066 int fd = open(console_.c_str(), O_RDWR); 1067 if (fd == -1) fd = open("/dev/null", O_RDWR); 1068 ioctl(fd, TIOCSCTTY, 0); 1069 dup2(fd, 0); 1070 dup2(fd, 1); 1071 dup2(fd, 2); 1072 close(fd); 1073} 1074 1075ServiceList::ServiceList() {} 1076 1077ServiceList& ServiceList::GetInstance() { 1078 static ServiceList instance; 1079 return instance; 1080} 1081 1082void ServiceList::AddService(std::unique_ptr<Service> service) { 1083 services_.emplace_back(std::move(service)); 1084} 1085 1086std::unique_ptr<Service> Service::MakeTemporaryOneshotService(const std::vector<std::string>& args) { 1087 // Parse the arguments: exec [SECLABEL [UID [GID]*] --] COMMAND ARGS... 1088 // SECLABEL can be a - to denote default 1089 std::size_t command_arg = 1; 1090 for (std::size_t i = 1; i < args.size(); ++i) { 1091 if (args[i] == "--") { 1092 command_arg = i + 1; 1093 break; 1094 } 1095 } 1096 if (command_arg > 4 + NR_SVC_SUPP_GIDS) { 1097 LOG(ERROR) << "exec called with too many supplementary group ids"; 1098 return nullptr; 1099 } 1100 1101 if (command_arg >= args.size()) { 1102 LOG(ERROR) << "exec called without command"; 1103 return nullptr; 1104 } 1105 std::vector<std::string> str_args(args.begin() + command_arg, args.end()); 1106 1107 static size_t exec_count = 0; 1108 exec_count++; 1109 std::string name = "exec " + std::to_string(exec_count) + " (" + Join(str_args, " ") + ")"; 1110 1111 unsigned flags = SVC_ONESHOT | SVC_TEMPORARY; 1112 CapSet no_capabilities; 1113 unsigned namespace_flags = 0; 1114 1115 std::string seclabel = ""; 1116 if (command_arg > 2 && args[1] != "-") { 1117 seclabel = args[1]; 1118 } 1119 Result<uid_t> uid = 0; 1120 if (command_arg > 3) { 1121 uid = DecodeUid(args[2]); 1122 if (!uid) { 1123 LOG(ERROR) << "Unable to decode UID for '" << args[2] << "': " << uid.error(); 1124 return nullptr; 1125 } 1126 } 1127 Result<gid_t> gid = 0; 1128 std::vector<gid_t> supp_gids; 1129 if (command_arg > 4) { 1130 gid = DecodeUid(args[3]); 1131 if (!gid) { 1132 LOG(ERROR) << "Unable to decode GID for '" << args[3] << "': " << gid.error(); 1133 return nullptr; 1134 } 1135 std::size_t nr_supp_gids = command_arg - 1 /* -- */ - 4 /* exec SECLABEL UID GID */; 1136 for (size_t i = 0; i < nr_supp_gids; ++i) { 1137 auto supp_gid = DecodeUid(args[4 + i]); 1138 if (!supp_gid) { 1139 LOG(ERROR) << "Unable to decode GID for '" << args[4 + i] 1140 << "': " << supp_gid.error(); 1141 return nullptr; 1142 } 1143 supp_gids.push_back(*supp_gid); 1144 } 1145 } 1146 1147 return std::make_unique<Service>(name, flags, *uid, *gid, supp_gids, no_capabilities, 1148 namespace_flags, seclabel, nullptr, str_args); 1149} 1150 1151// Shutdown services in the opposite order that they were started. 1152const std::vector<Service*> ServiceList::services_in_shutdown_order() const { 1153 std::vector<Service*> shutdown_services; 1154 for (const auto& service : services_) { 1155 if (service->start_order() > 0) shutdown_services.emplace_back(service.get()); 1156 } 1157 std::sort(shutdown_services.begin(), shutdown_services.end(), 1158 [](const auto& a, const auto& b) { return a->start_order() > b->start_order(); }); 1159 return shutdown_services; 1160} 1161 1162void ServiceList::RemoveService(const Service& svc) { 1163 auto svc_it = std::find_if(services_.begin(), services_.end(), 1164 [&svc] (const std::unique_ptr<Service>& s) { 1165 return svc.name() == s->name(); 1166 }); 1167 if (svc_it == services_.end()) { 1168 return; 1169 } 1170 1171 services_.erase(svc_it); 1172} 1173 1174void ServiceList::DumpState() const { 1175 for (const auto& s : services_) { 1176 s->DumpState(); 1177 } 1178} 1179 1180Result<Success> ServiceParser::ParseSection(std::vector<std::string>&& args, 1181 const std::string& filename, int line) { 1182 if (args.size() < 3) { 1183 return Error() << "services must have a name and a program"; 1184 } 1185 1186 const std::string& name = args[1]; 1187 if (!IsValidName(name)) { 1188 return Error() << "invalid service name '" << name << "'"; 1189 } 1190 1191 Subcontext* restart_action_subcontext = nullptr; 1192 if (subcontexts_) { 1193 for (auto& subcontext : *subcontexts_) { 1194 if (StartsWith(filename, subcontext.path_prefix())) { 1195 restart_action_subcontext = &subcontext; 1196 break; 1197 } 1198 } 1199 } 1200 1201 std::vector<std::string> str_args(args.begin() + 2, args.end()); 1202 service_ = std::make_unique<Service>(name, restart_action_subcontext, str_args); 1203 return Success(); 1204} 1205 1206Result<Success> ServiceParser::ParseLineSection(std::vector<std::string>&& args, int line) { 1207 return service_ ? service_->ParseLine(std::move(args)) : Success(); 1208} 1209 1210Result<Success> ServiceParser::EndSection() { 1211 if (service_) { 1212 Service* old_service = service_list_->FindService(service_->name()); 1213 if (old_service) { 1214 if (!service_->is_override()) { 1215 return Error() << "ignored duplicate definition of service '" << service_->name() 1216 << "'"; 1217 } 1218 1219 service_list_->RemoveService(*old_service); 1220 old_service = nullptr; 1221 } 1222 1223 service_list_->AddService(std::move(service_)); 1224 } 1225 1226 return Success(); 1227} 1228 1229bool ServiceParser::IsValidName(const std::string& name) const { 1230 // Property names can be any length, but may only contain certain characters. 1231 // Property values can contain any characters, but may only be a certain length. 1232 // (The latter restriction is needed because `start` and `stop` work by writing 1233 // the service name to the "ctl.start" and "ctl.stop" properties.) 1234 return IsLegalPropertyName("init.svc." + name) && name.size() <= PROP_VALUE_MAX; 1235} 1236 1237} // namespace init 1238} // namespace android 1239