blob: 368b8f1e6a708c94b1c291ad16f5a9afe38ca16a [file] [log] [blame]
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -08001/*
2**
3** Copyright 2010, The Android Open Source Project
4**
5** Licensed under the Apache License, Version 2.0 (the "License");
6** you may not use this file except in compliance with the License.
7** You may obtain a copy of the License at
8**
9** http://www.apache.org/licenses/LICENSE-2.0
10**
11** Unless required by applicable law or agreed to in writing, software
12** distributed under the License is distributed on an "AS IS" BASIS,
13** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14** See the License for the specific language governing permissions and
15** limitations under the License.
16*/
17
Mark Salyzyndb5334a2015-03-25 16:11:53 -070018#define PROGNAME "run-as"
19#define LOG_TAG PROGNAME
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -080020
Mark Salyzyndb5334a2015-03-25 16:11:53 -070021#include <dirent.h>
22#include <errno.h>
23#include <stdarg.h>
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -080024#include <stdio.h>
25#include <stdlib.h>
26#include <string.h>
Mark Salyzyndb5334a2015-03-25 16:11:53 -070027#include <sys/capability.h>
28#include <sys/cdefs.h>
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -080029#include <sys/stat.h>
Mark Salyzyndb5334a2015-03-25 16:11:53 -070030#include <sys/types.h>
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -080031#include <time.h>
Mark Salyzyndb5334a2015-03-25 16:11:53 -070032#include <unistd.h>
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -080033
34#include <private/android_filesystem_config.h>
Mark Salyzyndb5334a2015-03-25 16:11:53 -070035#include <selinux/android.h>
36
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -080037#include "package.h"
38
39/*
40 * WARNING WARNING WARNING WARNING
41 *
Alex Klyubinb0739c62013-08-05 13:03:58 -070042 * This program runs with CAP_SETUID and CAP_SETGID capabilities on Android
43 * production devices. Be very conservative when modifying it to avoid any
44 * serious security issue. Keep in mind the following:
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -080045 *
46 * - This program should only run for the 'root' or 'shell' users
47 *
Nick Kralevichb2d8f892012-01-23 11:00:36 -080048 * - Avoid anything that is more complex than simple system calls
49 * until the uid/gid has been dropped to that of a normal user
50 * or you are sure to exit.
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -080051 *
52 * This avoids depending on environment variables, system properties
53 * and other external factors that may affect the C library in
54 * unpredictable ways.
55 *
56 * - Do not trust user input and/or the filesystem whenever possible.
57 *
58 * Read README.TXT for more details.
59 *
60 *
61 *
62 * The purpose of this program is to run a command as a specific
63 * application user-id. Typical usage is:
64 *
65 * run-as <package-name> <command> <args>
66 *
Alex Klyubinb0739c62013-08-05 13:03:58 -070067 * The 'run-as' binary is installed with CAP_SETUID and CAP_SETGID file
68 * capabilities, but will check the following:
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -080069 *
70 * - that it is invoked from the 'shell' or 'root' user (abort otherwise)
71 * - that '<package-name>' is the name of an installed and debuggable package
72 * - that the package's data directory is well-formed (see package.c)
73 *
Alex Klyubinb0739c62013-08-05 13:03:58 -070074 * If so, it will drop to the application's user id / group id, cd to the
75 * package's data directory, then run the command there.
76 *
77 * NOTE: In the future it might not be possible to cd to the package's data
78 * directory under that package's user id / group id, in which case this
79 * utility will need to be changed accordingly.
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -080080 *
81 * This can be useful for a number of different things on production devices:
82 *
83 * - Allow application developers to look at their own applicative data
84 * during development.
85 *
86 * - Run the 'gdbserver' binary executable to allow native debugging
87 */
88
Mark Salyzyndb5334a2015-03-25 16:11:53 -070089__noreturn static void
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -080090panic(const char* format, ...)
91{
92 va_list args;
Mark Salyzyndb5334a2015-03-25 16:11:53 -070093 int e = errno;
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -080094
95 fprintf(stderr, "%s: ", PROGNAME);
96 va_start(args, format);
97 vfprintf(stderr, format, args);
98 va_end(args);
Mark Salyzyndb5334a2015-03-25 16:11:53 -070099 exit(e ? -e : 1);
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -0800100}
101
Mark Salyzyndb5334a2015-03-25 16:11:53 -0700102static void
103usage(void)
104{
105 panic("Usage:\n " PROGNAME " <package-name> <command> [<args>]\n");
106}
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -0800107
108int main(int argc, char **argv)
109{
110 const char* pkgname;
111 int myuid, uid, gid;
112 PackageInfo info;
Mark Salyzyndb5334a2015-03-25 16:11:53 -0700113 struct __user_cap_header_struct capheader;
114 struct __user_cap_data_struct capdata[2];
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -0800115
116 /* check arguments */
Mark Salyzyndb5334a2015-03-25 16:11:53 -0700117 if (argc < 2) {
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -0800118 usage();
Mark Salyzyndb5334a2015-03-25 16:11:53 -0700119 }
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -0800120
121 /* check userid of caller - must be 'shell' or 'root' */
122 myuid = getuid();
123 if (myuid != AID_SHELL && myuid != AID_ROOT) {
124 panic("only 'shell' or 'root' users can run this program\n");
125 }
126
Mark Salyzyndb5334a2015-03-25 16:11:53 -0700127 memset(&capheader, 0, sizeof(capheader));
128 memset(&capdata, 0, sizeof(capdata));
129 capheader.version = _LINUX_CAPABILITY_VERSION_3;
130 capdata[CAP_TO_INDEX(CAP_SETUID)].effective |= CAP_TO_MASK(CAP_SETUID);
131 capdata[CAP_TO_INDEX(CAP_SETGID)].effective |= CAP_TO_MASK(CAP_SETGID);
132 capdata[CAP_TO_INDEX(CAP_SETUID)].permitted |= CAP_TO_MASK(CAP_SETUID);
133 capdata[CAP_TO_INDEX(CAP_SETGID)].permitted |= CAP_TO_MASK(CAP_SETGID);
134
135 if (capset(&capheader, &capdata[0]) < 0) {
136 panic("Could not set capabilities: %s\n", strerror(errno));
137 }
138
139 /* retrieve package information from system (does setegid) */
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -0800140 pkgname = argv[1];
141 if (get_package_info(pkgname, &info) < 0) {
142 panic("Package '%s' is unknown\n", pkgname);
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -0800143 }
144
145 /* reject system packages */
146 if (info.uid < AID_APP) {
147 panic("Package '%s' is not an application\n", pkgname);
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -0800148 }
149
150 /* reject any non-debuggable package */
151 if (!info.isDebuggable) {
152 panic("Package '%s' is not debuggable\n", pkgname);
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -0800153 }
154
155 /* check that the data directory path is valid */
156 if (check_data_path(info.dataDir, info.uid) < 0) {
157 panic("Package '%s' has corrupt installation\n", pkgname);
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -0800158 }
159
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -0800160 /* Ensure that we change all real/effective/saved IDs at the
161 * same time to avoid nasty surprises.
162 */
163 uid = gid = info.uid;
164 if(setresgid(gid,gid,gid) || setresuid(uid,uid,uid)) {
165 panic("Permission denied\n");
Mark Salyzyndb5334a2015-03-25 16:11:53 -0700166 }
167
168 /* Required if caller has uid and gid all non-zero */
169 memset(&capdata, 0, sizeof(capdata));
170 if (capset(&capheader, &capdata[0]) < 0) {
171 panic("Could not clear all capabilities: %s\n", strerror(errno));
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -0800172 }
173
Robert Craigfced3de2013-03-26 08:09:09 -0400174 if (selinux_android_setcontext(uid, 0, info.seinfo, pkgname) < 0) {
Mark Salyzyndb5334a2015-03-25 16:11:53 -0700175 panic("Could not set SELinux security context: %s\n", strerror(errno));
Stephen Smalley4ead8be2012-11-13 12:56:48 -0500176 }
177
Alex Klyubinb0739c62013-08-05 13:03:58 -0700178 /* cd into the data directory */
Mark Salyzyndb5334a2015-03-25 16:11:53 -0700179 if (TEMP_FAILURE_RETRY(chdir(info.dataDir)) < 0) {
180 panic("Could not cd to package's data directory: %s\n", strerror(errno));
Alex Klyubinb0739c62013-08-05 13:03:58 -0700181 }
182
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -0800183 /* User specified command for exec. */
Mark Salyzyndb5334a2015-03-25 16:11:53 -0700184 if ((argc >= 3) && (execvp(argv[2], argv+2) < 0)) {
185 panic("exec failed for %s: %s\n", argv[2], strerror(errno));
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -0800186 }
187
188 /* Default exec shell. */
189 execlp("/system/bin/sh", "sh", NULL);
190
Mark Salyzyndb5334a2015-03-25 16:11:53 -0700191 panic("exec failed: %s\n", strerror(errno));
David 'Digit' Turner1f4d9522010-03-02 18:05:23 -0800192}