Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 1 | /* Copyright 2008 The Android Open Source Project |
| 2 | */ |
| 3 | |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 4 | #include <errno.h> |
| 5 | #include <fcntl.h> |
Elliott Hughes | 0b41ad5 | 2015-04-03 16:51:18 -0700 | [diff] [blame] | 6 | #include <inttypes.h> |
Mark Salyzyn | 13df5f5 | 2015-04-01 07:52:12 -0700 | [diff] [blame] | 7 | #include <stdio.h> |
| 8 | #include <stdlib.h> |
| 9 | #include <string.h> |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 10 | |
Arve Hjønnevåg | e6bbe69 | 2016-08-18 15:42:35 -0700 | [diff] [blame] | 11 | #include <cutils/multiuser.h> |
| 12 | |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 13 | #include <private/android_filesystem_config.h> |
| 14 | |
Riley Spahn | 69154df | 2014-06-05 11:07:18 -0700 | [diff] [blame] | 15 | #include <selinux/android.h> |
Nick Kralevich | 7d42a3c | 2014-07-12 16:34:01 -0700 | [diff] [blame] | 16 | #include <selinux/avc.h> |
Riley Spahn | 69154df | 2014-06-05 11:07:18 -0700 | [diff] [blame] | 17 | |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 18 | #include "binder.h" |
| 19 | |
| 20 | #if 0 |
| 21 | #define ALOGI(x...) fprintf(stderr, "svcmgr: " x) |
| 22 | #define ALOGE(x...) fprintf(stderr, "svcmgr: " x) |
| 23 | #else |
| 24 | #define LOG_TAG "ServiceManager" |
| 25 | #include <cutils/log.h> |
| 26 | #endif |
| 27 | |
William Roberts | 8fb0f92 | 2015-10-01 22:02:15 -0700 | [diff] [blame] | 28 | struct audit_data { |
| 29 | pid_t pid; |
| 30 | uid_t uid; |
| 31 | const char *name; |
| 32 | }; |
| 33 | |
Nick Kralevich | 7d42a3c | 2014-07-12 16:34:01 -0700 | [diff] [blame] | 34 | const char *str8(const uint16_t *x, size_t x_len) |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 35 | { |
| 36 | static char buf[128]; |
Nick Kralevich | 7d42a3c | 2014-07-12 16:34:01 -0700 | [diff] [blame] | 37 | size_t max = 127; |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 38 | char *p = buf; |
| 39 | |
Nick Kralevich | 7d42a3c | 2014-07-12 16:34:01 -0700 | [diff] [blame] | 40 | if (x_len < max) { |
| 41 | max = x_len; |
| 42 | } |
| 43 | |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 44 | if (x) { |
Nick Kralevich | 7d42a3c | 2014-07-12 16:34:01 -0700 | [diff] [blame] | 45 | while ((max > 0) && (*x != '\0')) { |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 46 | *p++ = *x++; |
Nick Kralevich | 7d42a3c | 2014-07-12 16:34:01 -0700 | [diff] [blame] | 47 | max--; |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 48 | } |
| 49 | } |
| 50 | *p++ = 0; |
| 51 | return buf; |
| 52 | } |
| 53 | |
Serban Constantinescu | 9b738bb | 2014-01-10 15:48:29 +0000 | [diff] [blame] | 54 | int str16eq(const uint16_t *a, const char *b) |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 55 | { |
| 56 | while (*a && *b) |
| 57 | if (*a++ != *b++) return 0; |
| 58 | if (*a || *b) |
| 59 | return 0; |
| 60 | return 1; |
| 61 | } |
| 62 | |
Riley Spahn | c67e630 | 2014-07-08 09:03:00 -0700 | [diff] [blame] | 63 | static int selinux_enabled; |
| 64 | static char *service_manager_context; |
Riley Spahn | 69154df | 2014-06-05 11:07:18 -0700 | [diff] [blame] | 65 | static struct selabel_handle* sehandle; |
| 66 | |
William Roberts | 8fb0f92 | 2015-10-01 22:02:15 -0700 | [diff] [blame] | 67 | static bool check_mac_perms(pid_t spid, uid_t uid, const char *tctx, const char *perm, const char *name) |
Riley Spahn | 69154df | 2014-06-05 11:07:18 -0700 | [diff] [blame] | 68 | { |
Riley Spahn | 69154df | 2014-06-05 11:07:18 -0700 | [diff] [blame] | 69 | char *sctx = NULL; |
Riley Spahn | c67e630 | 2014-07-08 09:03:00 -0700 | [diff] [blame] | 70 | const char *class = "service_manager"; |
| 71 | bool allowed; |
William Roberts | 8fb0f92 | 2015-10-01 22:02:15 -0700 | [diff] [blame] | 72 | struct audit_data ad; |
Riley Spahn | 69154df | 2014-06-05 11:07:18 -0700 | [diff] [blame] | 73 | |
| 74 | if (getpidcon(spid, &sctx) < 0) { |
Riley Spahn | c67e630 | 2014-07-08 09:03:00 -0700 | [diff] [blame] | 75 | ALOGE("SELinux: getpidcon(pid=%d) failed to retrieve pid context.\n", spid); |
Riley Spahn | 69154df | 2014-06-05 11:07:18 -0700 | [diff] [blame] | 76 | return false; |
| 77 | } |
| 78 | |
William Roberts | 8fb0f92 | 2015-10-01 22:02:15 -0700 | [diff] [blame] | 79 | ad.pid = spid; |
| 80 | ad.uid = uid; |
| 81 | ad.name = name; |
| 82 | |
| 83 | int result = selinux_check_access(sctx, tctx, class, perm, (void *) &ad); |
Riley Spahn | 69154df | 2014-06-05 11:07:18 -0700 | [diff] [blame] | 84 | allowed = (result == 0); |
| 85 | |
| 86 | freecon(sctx); |
Riley Spahn | c67e630 | 2014-07-08 09:03:00 -0700 | [diff] [blame] | 87 | return allowed; |
| 88 | } |
| 89 | |
William Roberts | 8fb0f92 | 2015-10-01 22:02:15 -0700 | [diff] [blame] | 90 | static bool check_mac_perms_from_getcon(pid_t spid, uid_t uid, const char *perm) |
Riley Spahn | c67e630 | 2014-07-08 09:03:00 -0700 | [diff] [blame] | 91 | { |
| 92 | if (selinux_enabled <= 0) { |
| 93 | return true; |
| 94 | } |
| 95 | |
William Roberts | 8fb0f92 | 2015-10-01 22:02:15 -0700 | [diff] [blame] | 96 | return check_mac_perms(spid, uid, service_manager_context, perm, NULL); |
Riley Spahn | c67e630 | 2014-07-08 09:03:00 -0700 | [diff] [blame] | 97 | } |
| 98 | |
William Roberts | 8fb0f92 | 2015-10-01 22:02:15 -0700 | [diff] [blame] | 99 | static bool check_mac_perms_from_lookup(pid_t spid, uid_t uid, const char *perm, const char *name) |
Riley Spahn | c67e630 | 2014-07-08 09:03:00 -0700 | [diff] [blame] | 100 | { |
| 101 | bool allowed; |
| 102 | char *tctx = NULL; |
| 103 | |
| 104 | if (selinux_enabled <= 0) { |
| 105 | return true; |
| 106 | } |
| 107 | |
| 108 | if (!sehandle) { |
| 109 | ALOGE("SELinux: Failed to find sehandle. Aborting service_manager.\n"); |
| 110 | abort(); |
| 111 | } |
| 112 | |
| 113 | if (selabel_lookup(sehandle, &tctx, name, 0) != 0) { |
| 114 | ALOGE("SELinux: No match for %s in service_contexts.\n", name); |
| 115 | return false; |
| 116 | } |
| 117 | |
William Roberts | 8fb0f92 | 2015-10-01 22:02:15 -0700 | [diff] [blame] | 118 | allowed = check_mac_perms(spid, uid, tctx, perm, name); |
Riley Spahn | 69154df | 2014-06-05 11:07:18 -0700 | [diff] [blame] | 119 | freecon(tctx); |
| 120 | return allowed; |
| 121 | } |
| 122 | |
William Roberts | 8fb0f92 | 2015-10-01 22:02:15 -0700 | [diff] [blame] | 123 | static int svc_can_register(const uint16_t *name, size_t name_len, pid_t spid, uid_t uid) |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 124 | { |
Riley Spahn | c67e630 | 2014-07-08 09:03:00 -0700 | [diff] [blame] | 125 | const char *perm = "add"; |
Arve Hjønnevåg | 2b74d2c | 2016-08-01 16:05:17 -0700 | [diff] [blame] | 126 | |
Arve Hjønnevåg | e6bbe69 | 2016-08-18 15:42:35 -0700 | [diff] [blame] | 127 | if (multiuser_get_app_id(uid) >= AID_APP) { |
Arve Hjønnevåg | 2b74d2c | 2016-08-01 16:05:17 -0700 | [diff] [blame] | 128 | return 0; /* Don't allow apps to register services */ |
| 129 | } |
| 130 | |
William Roberts | 8fb0f92 | 2015-10-01 22:02:15 -0700 | [diff] [blame] | 131 | return check_mac_perms_from_lookup(spid, uid, perm, str8(name, name_len)) ? 1 : 0; |
Riley Spahn | c67e630 | 2014-07-08 09:03:00 -0700 | [diff] [blame] | 132 | } |
| 133 | |
William Roberts | 8fb0f92 | 2015-10-01 22:02:15 -0700 | [diff] [blame] | 134 | static int svc_can_list(pid_t spid, uid_t uid) |
Riley Spahn | c67e630 | 2014-07-08 09:03:00 -0700 | [diff] [blame] | 135 | { |
| 136 | const char *perm = "list"; |
William Roberts | 8fb0f92 | 2015-10-01 22:02:15 -0700 | [diff] [blame] | 137 | return check_mac_perms_from_getcon(spid, uid, perm) ? 1 : 0; |
Riley Spahn | c67e630 | 2014-07-08 09:03:00 -0700 | [diff] [blame] | 138 | } |
| 139 | |
William Roberts | 8fb0f92 | 2015-10-01 22:02:15 -0700 | [diff] [blame] | 140 | static int svc_can_find(const uint16_t *name, size_t name_len, pid_t spid, uid_t uid) |
Riley Spahn | c67e630 | 2014-07-08 09:03:00 -0700 | [diff] [blame] | 141 | { |
| 142 | const char *perm = "find"; |
William Roberts | 8fb0f92 | 2015-10-01 22:02:15 -0700 | [diff] [blame] | 143 | return check_mac_perms_from_lookup(spid, uid, perm, str8(name, name_len)) ? 1 : 0; |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 144 | } |
| 145 | |
Serban Constantinescu | 9b738bb | 2014-01-10 15:48:29 +0000 | [diff] [blame] | 146 | struct svcinfo |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 147 | { |
| 148 | struct svcinfo *next; |
Serban Constantinescu | 5fb1b88 | 2014-01-30 14:07:34 +0000 | [diff] [blame] | 149 | uint32_t handle; |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 150 | struct binder_death death; |
| 151 | int allow_isolated; |
Serban Constantinescu | 9b738bb | 2014-01-10 15:48:29 +0000 | [diff] [blame] | 152 | size_t len; |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 153 | uint16_t name[0]; |
| 154 | }; |
| 155 | |
Serban Constantinescu | 9b738bb | 2014-01-10 15:48:29 +0000 | [diff] [blame] | 156 | struct svcinfo *svclist = NULL; |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 157 | |
Serban Constantinescu | 9b738bb | 2014-01-10 15:48:29 +0000 | [diff] [blame] | 158 | struct svcinfo *find_svc(const uint16_t *s16, size_t len) |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 159 | { |
| 160 | struct svcinfo *si; |
| 161 | |
| 162 | for (si = svclist; si; si = si->next) { |
| 163 | if ((len == si->len) && |
| 164 | !memcmp(s16, si->name, len * sizeof(uint16_t))) { |
| 165 | return si; |
| 166 | } |
| 167 | } |
Serban Constantinescu | 9b738bb | 2014-01-10 15:48:29 +0000 | [diff] [blame] | 168 | return NULL; |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 169 | } |
| 170 | |
| 171 | void svcinfo_death(struct binder_state *bs, void *ptr) |
| 172 | { |
Serban Constantinescu | 9b738bb | 2014-01-10 15:48:29 +0000 | [diff] [blame] | 173 | struct svcinfo *si = (struct svcinfo* ) ptr; |
| 174 | |
Nick Kralevich | 7d42a3c | 2014-07-12 16:34:01 -0700 | [diff] [blame] | 175 | ALOGI("service '%s' died\n", str8(si->name, si->len)); |
Serban Constantinescu | 5fb1b88 | 2014-01-30 14:07:34 +0000 | [diff] [blame] | 176 | if (si->handle) { |
| 177 | binder_release(bs, si->handle); |
| 178 | si->handle = 0; |
Serban Constantinescu | 9b738bb | 2014-01-10 15:48:29 +0000 | [diff] [blame] | 179 | } |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 180 | } |
| 181 | |
Serban Constantinescu | 9b738bb | 2014-01-10 15:48:29 +0000 | [diff] [blame] | 182 | uint16_t svcmgr_id[] = { |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 183 | 'a','n','d','r','o','i','d','.','o','s','.', |
Serban Constantinescu | 9b738bb | 2014-01-10 15:48:29 +0000 | [diff] [blame] | 184 | 'I','S','e','r','v','i','c','e','M','a','n','a','g','e','r' |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 185 | }; |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 186 | |
Serban Constantinescu | 9b738bb | 2014-01-10 15:48:29 +0000 | [diff] [blame] | 187 | |
Ian Pedowitz | d57d9b9 | 2016-02-19 08:34:43 +0000 | [diff] [blame] | 188 | uint32_t do_find_service(const uint16_t *s, size_t len, uid_t uid, pid_t spid) |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 189 | { |
Nick Kralevich | b27bbd1 | 2015-03-05 10:58:40 -0800 | [diff] [blame] | 190 | struct svcinfo *si = find_svc(s, len); |
| 191 | |
| 192 | if (!si || !si->handle) { |
| 193 | return 0; |
| 194 | } |
| 195 | |
| 196 | if (!si->allow_isolated) { |
| 197 | // If this service doesn't allow access from isolated processes, |
| 198 | // then check the uid to see if it is isolated. |
| 199 | uid_t appid = uid % AID_USER; |
| 200 | if (appid >= AID_ISOLATED_START && appid <= AID_ISOLATED_END) { |
| 201 | return 0; |
| 202 | } |
| 203 | } |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 204 | |
William Roberts | 8fb0f92 | 2015-10-01 22:02:15 -0700 | [diff] [blame] | 205 | if (!svc_can_find(s, len, spid, uid)) { |
Riley Spahn | c67e630 | 2014-07-08 09:03:00 -0700 | [diff] [blame] | 206 | return 0; |
| 207 | } |
Nick Kralevich | b27bbd1 | 2015-03-05 10:58:40 -0800 | [diff] [blame] | 208 | |
| 209 | return si->handle; |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 210 | } |
| 211 | |
| 212 | int do_add_service(struct binder_state *bs, |
Serban Constantinescu | 9b738bb | 2014-01-10 15:48:29 +0000 | [diff] [blame] | 213 | const uint16_t *s, size_t len, |
Riley Spahn | 69154df | 2014-06-05 11:07:18 -0700 | [diff] [blame] | 214 | uint32_t handle, uid_t uid, int allow_isolated, |
| 215 | pid_t spid) |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 216 | { |
| 217 | struct svcinfo *si; |
Serban Constantinescu | 3a345f0 | 2013-12-19 09:11:41 +0000 | [diff] [blame] | 218 | |
Nick Kralevich | 7d42a3c | 2014-07-12 16:34:01 -0700 | [diff] [blame] | 219 | //ALOGI("add_service('%s',%x,%s) uid=%d\n", str8(s, len), handle, |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 220 | // allow_isolated ? "allow_isolated" : "!allow_isolated", uid); |
| 221 | |
Serban Constantinescu | 5fb1b88 | 2014-01-30 14:07:34 +0000 | [diff] [blame] | 222 | if (!handle || (len == 0) || (len > 127)) |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 223 | return -1; |
| 224 | |
William Roberts | 8fb0f92 | 2015-10-01 22:02:15 -0700 | [diff] [blame] | 225 | if (!svc_can_register(s, len, spid, uid)) { |
Serban Constantinescu | 5fb1b88 | 2014-01-30 14:07:34 +0000 | [diff] [blame] | 226 | ALOGE("add_service('%s',%x) uid=%d - PERMISSION DENIED\n", |
Nick Kralevich | 7d42a3c | 2014-07-12 16:34:01 -0700 | [diff] [blame] | 227 | str8(s, len), handle, uid); |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 228 | return -1; |
| 229 | } |
| 230 | |
| 231 | si = find_svc(s, len); |
| 232 | if (si) { |
Serban Constantinescu | 5fb1b88 | 2014-01-30 14:07:34 +0000 | [diff] [blame] | 233 | if (si->handle) { |
| 234 | ALOGE("add_service('%s',%x) uid=%d - ALREADY REGISTERED, OVERRIDE\n", |
Nick Kralevich | 7d42a3c | 2014-07-12 16:34:01 -0700 | [diff] [blame] | 235 | str8(s, len), handle, uid); |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 236 | svcinfo_death(bs, si); |
| 237 | } |
Serban Constantinescu | 5fb1b88 | 2014-01-30 14:07:34 +0000 | [diff] [blame] | 238 | si->handle = handle; |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 239 | } else { |
| 240 | si = malloc(sizeof(*si) + (len + 1) * sizeof(uint16_t)); |
| 241 | if (!si) { |
Serban Constantinescu | 5fb1b88 | 2014-01-30 14:07:34 +0000 | [diff] [blame] | 242 | ALOGE("add_service('%s',%x) uid=%d - OUT OF MEMORY\n", |
Nick Kralevich | 7d42a3c | 2014-07-12 16:34:01 -0700 | [diff] [blame] | 243 | str8(s, len), handle, uid); |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 244 | return -1; |
| 245 | } |
Serban Constantinescu | 5fb1b88 | 2014-01-30 14:07:34 +0000 | [diff] [blame] | 246 | si->handle = handle; |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 247 | si->len = len; |
| 248 | memcpy(si->name, s, (len + 1) * sizeof(uint16_t)); |
| 249 | si->name[len] = '\0'; |
Serban Constantinescu | 9b738bb | 2014-01-10 15:48:29 +0000 | [diff] [blame] | 250 | si->death.func = (void*) svcinfo_death; |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 251 | si->death.ptr = si; |
| 252 | si->allow_isolated = allow_isolated; |
| 253 | si->next = svclist; |
| 254 | svclist = si; |
| 255 | } |
| 256 | |
Serban Constantinescu | 5fb1b88 | 2014-01-30 14:07:34 +0000 | [diff] [blame] | 257 | binder_acquire(bs, handle); |
| 258 | binder_link_to_death(bs, handle, &si->death); |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 259 | return 0; |
| 260 | } |
| 261 | |
| 262 | int svcmgr_handler(struct binder_state *bs, |
Serban Constantinescu | bcf3888 | 2014-01-10 13:56:27 +0000 | [diff] [blame] | 263 | struct binder_transaction_data *txn, |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 264 | struct binder_io *msg, |
| 265 | struct binder_io *reply) |
| 266 | { |
| 267 | struct svcinfo *si; |
| 268 | uint16_t *s; |
Serban Constantinescu | 9b738bb | 2014-01-10 15:48:29 +0000 | [diff] [blame] | 269 | size_t len; |
Serban Constantinescu | 5fb1b88 | 2014-01-30 14:07:34 +0000 | [diff] [blame] | 270 | uint32_t handle; |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 271 | uint32_t strict_policy; |
| 272 | int allow_isolated; |
| 273 | |
Elliott Hughes | 0b41ad5 | 2015-04-03 16:51:18 -0700 | [diff] [blame] | 274 | //ALOGI("target=%p code=%d pid=%d uid=%d\n", |
| 275 | // (void*) txn->target.ptr, txn->code, txn->sender_pid, txn->sender_euid); |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 276 | |
Elliott Hughes | 0b41ad5 | 2015-04-03 16:51:18 -0700 | [diff] [blame] | 277 | if (txn->target.ptr != BINDER_SERVICE_MANAGER) |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 278 | return -1; |
| 279 | |
Arve Hjønnevåg | e5245cb | 2014-01-28 21:35:03 -0800 | [diff] [blame] | 280 | if (txn->code == PING_TRANSACTION) |
| 281 | return 0; |
| 282 | |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 283 | // Equivalent to Parcel::enforceInterface(), reading the RPC |
| 284 | // header with the strict mode policy mask and the interface name. |
| 285 | // Note that we ignore the strict_policy and don't propagate it |
| 286 | // further (since we do no outbound RPCs anyway). |
| 287 | strict_policy = bio_get_uint32(msg); |
| 288 | s = bio_get_string16(msg, &len); |
Nick Kralevich | 7d42a3c | 2014-07-12 16:34:01 -0700 | [diff] [blame] | 289 | if (s == NULL) { |
| 290 | return -1; |
| 291 | } |
| 292 | |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 293 | if ((len != (sizeof(svcmgr_id) / 2)) || |
| 294 | memcmp(svcmgr_id, s, sizeof(svcmgr_id))) { |
Nick Kralevich | 7d42a3c | 2014-07-12 16:34:01 -0700 | [diff] [blame] | 295 | fprintf(stderr,"invalid id %s\n", str8(s, len)); |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 296 | return -1; |
| 297 | } |
| 298 | |
Riley Spahn | 69154df | 2014-06-05 11:07:18 -0700 | [diff] [blame] | 299 | if (sehandle && selinux_status_updated() > 0) { |
| 300 | struct selabel_handle *tmp_sehandle = selinux_android_service_context_handle(); |
| 301 | if (tmp_sehandle) { |
| 302 | selabel_close(sehandle); |
| 303 | sehandle = tmp_sehandle; |
| 304 | } |
| 305 | } |
| 306 | |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 307 | switch(txn->code) { |
| 308 | case SVC_MGR_GET_SERVICE: |
| 309 | case SVC_MGR_CHECK_SERVICE: |
| 310 | s = bio_get_string16(msg, &len); |
Nick Kralevich | 7d42a3c | 2014-07-12 16:34:01 -0700 | [diff] [blame] | 311 | if (s == NULL) { |
| 312 | return -1; |
| 313 | } |
Ian Pedowitz | d57d9b9 | 2016-02-19 08:34:43 +0000 | [diff] [blame] | 314 | handle = do_find_service(s, len, txn->sender_euid, txn->sender_pid); |
Serban Constantinescu | 5fb1b88 | 2014-01-30 14:07:34 +0000 | [diff] [blame] | 315 | if (!handle) |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 316 | break; |
Serban Constantinescu | 5fb1b88 | 2014-01-30 14:07:34 +0000 | [diff] [blame] | 317 | bio_put_ref(reply, handle); |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 318 | return 0; |
| 319 | |
| 320 | case SVC_MGR_ADD_SERVICE: |
| 321 | s = bio_get_string16(msg, &len); |
Nick Kralevich | 7d42a3c | 2014-07-12 16:34:01 -0700 | [diff] [blame] | 322 | if (s == NULL) { |
| 323 | return -1; |
| 324 | } |
Serban Constantinescu | 5fb1b88 | 2014-01-30 14:07:34 +0000 | [diff] [blame] | 325 | handle = bio_get_ref(msg); |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 326 | allow_isolated = bio_get_uint32(msg) ? 1 : 0; |
Riley Spahn | 69154df | 2014-06-05 11:07:18 -0700 | [diff] [blame] | 327 | if (do_add_service(bs, s, len, handle, txn->sender_euid, |
| 328 | allow_isolated, txn->sender_pid)) |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 329 | return -1; |
| 330 | break; |
| 331 | |
| 332 | case SVC_MGR_LIST_SERVICES: { |
Serban Constantinescu | 3a345f0 | 2013-12-19 09:11:41 +0000 | [diff] [blame] | 333 | uint32_t n = bio_get_uint32(msg); |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 334 | |
William Roberts | 8fb0f92 | 2015-10-01 22:02:15 -0700 | [diff] [blame] | 335 | if (!svc_can_list(txn->sender_pid, txn->sender_euid)) { |
Riley Spahn | c67e630 | 2014-07-08 09:03:00 -0700 | [diff] [blame] | 336 | ALOGE("list_service() uid=%d - PERMISSION DENIED\n", |
| 337 | txn->sender_euid); |
| 338 | return -1; |
| 339 | } |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 340 | si = svclist; |
| 341 | while ((n-- > 0) && si) |
| 342 | si = si->next; |
| 343 | if (si) { |
| 344 | bio_put_string16(reply, si->name); |
| 345 | return 0; |
| 346 | } |
| 347 | return -1; |
| 348 | } |
| 349 | default: |
| 350 | ALOGE("unknown code %d\n", txn->code); |
| 351 | return -1; |
| 352 | } |
| 353 | |
| 354 | bio_put_uint32(reply, 0); |
| 355 | return 0; |
| 356 | } |
| 357 | |
Riley Spahn | 69154df | 2014-06-05 11:07:18 -0700 | [diff] [blame] | 358 | |
Ian Pedowitz | d57d9b9 | 2016-02-19 08:34:43 +0000 | [diff] [blame] | 359 | static int audit_callback(void *data, __unused security_class_t cls, char *buf, size_t len) |
Riley Spahn | 69154df | 2014-06-05 11:07:18 -0700 | [diff] [blame] | 360 | { |
William Roberts | 8fb0f92 | 2015-10-01 22:02:15 -0700 | [diff] [blame] | 361 | struct audit_data *ad = (struct audit_data *)data; |
| 362 | |
| 363 | if (!ad || !ad->name) { |
| 364 | ALOGE("No service manager audit data"); |
| 365 | return 0; |
| 366 | } |
| 367 | |
| 368 | snprintf(buf, len, "service=%s pid=%d uid=%d", ad->name, ad->pid, ad->uid); |
Riley Spahn | 69154df | 2014-06-05 11:07:18 -0700 | [diff] [blame] | 369 | return 0; |
| 370 | } |
| 371 | |
Ian Pedowitz | d57d9b9 | 2016-02-19 08:34:43 +0000 | [diff] [blame] | 372 | int main() |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 373 | { |
| 374 | struct binder_state *bs; |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 375 | |
| 376 | bs = binder_open(128*1024); |
Serban Constantinescu | a44542c | 2014-01-30 15:16:45 +0000 | [diff] [blame] | 377 | if (!bs) { |
| 378 | ALOGE("failed to open binder driver\n"); |
| 379 | return -1; |
| 380 | } |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 381 | |
| 382 | if (binder_become_context_manager(bs)) { |
| 383 | ALOGE("cannot become context manager (%s)\n", strerror(errno)); |
| 384 | return -1; |
| 385 | } |
| 386 | |
Riley Spahn | c67e630 | 2014-07-08 09:03:00 -0700 | [diff] [blame] | 387 | selinux_enabled = is_selinux_enabled(); |
Riley Spahn | 69154df | 2014-06-05 11:07:18 -0700 | [diff] [blame] | 388 | sehandle = selinux_android_service_context_handle(); |
Stephen Smalley | bea0746 | 2015-06-03 09:25:37 -0400 | [diff] [blame] | 389 | selinux_status_open(true); |
Riley Spahn | 69154df | 2014-06-05 11:07:18 -0700 | [diff] [blame] | 390 | |
Riley Spahn | c67e630 | 2014-07-08 09:03:00 -0700 | [diff] [blame] | 391 | if (selinux_enabled > 0) { |
| 392 | if (sehandle == NULL) { |
| 393 | ALOGE("SELinux: Failed to acquire sehandle. Aborting.\n"); |
| 394 | abort(); |
| 395 | } |
| 396 | |
| 397 | if (getcon(&service_manager_context) != 0) { |
| 398 | ALOGE("SELinux: Failed to acquire service_manager context. Aborting.\n"); |
| 399 | abort(); |
| 400 | } |
| 401 | } |
| 402 | |
Riley Spahn | 69154df | 2014-06-05 11:07:18 -0700 | [diff] [blame] | 403 | union selinux_callback cb; |
| 404 | cb.func_audit = audit_callback; |
| 405 | selinux_set_callback(SELINUX_CB_AUDIT, cb); |
| 406 | cb.func_log = selinux_log_callback; |
| 407 | selinux_set_callback(SELINUX_CB_LOG, cb); |
| 408 | |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 409 | binder_loop(bs, svcmgr_handler); |
Serban Constantinescu | 9b738bb | 2014-01-10 15:48:29 +0000 | [diff] [blame] | 410 | |
Mike Lockwood | 94afecf | 2012-10-24 10:45:23 -0700 | [diff] [blame] | 411 | return 0; |
| 412 | } |