blob: 8efbacc9921963cd8220678cec76efcad34f0315 [file] [log] [blame]
Christopher Ferris20303f82014-01-10 16:33:16 -08001/*
2 * Copyright 2006, The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080016
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080017#include <dirent.h>
Josh Gao7c89f9e2016-01-13 17:57:14 -080018#include <errno.h>
19#include <fcntl.h>
20#include <pthread.h>
21#include <signal.h>
22#include <stdarg.h>
23#include <stdio.h>
24#include <sys/types.h>
Jeff Brown053b8652012-06-06 16:25:03 -070025#include <time.h>
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080026
Elliott Hughescac5d8c2014-01-10 14:40:53 -080027#include <elf.h>
Jeff Brown9524e412011-10-24 11:10:16 -070028#include <sys/poll.h>
Josh Gaoe7a9e522015-11-17 13:57:03 -080029#include <sys/prctl.h>
30#include <sys/ptrace.h>
31#include <sys/stat.h>
32#include <sys/wait.h>
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080033
Josh Gao7c89f9e2016-01-13 17:57:14 -080034#include <set>
35
Stephen Smalley69b80032014-07-24 15:23:05 -040036#include <selinux/android.h>
37
Colin Cross9227bd32013-07-23 16:59:20 -070038#include <log/logger.h>
39
Jeff Brown053b8652012-06-06 16:25:03 -070040#include <cutils/debugger.h>
Josh Gao8ab7fd42015-11-16 17:26:33 -080041#include <cutils/properties.h>
42#include <cutils/sockets.h>
43#include <nativehelper/ScopedFd.h>
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080044
45#include <linux/input.h>
46
47#include <private/android_filesystem_config.h>
48
Jeff Brown053b8652012-06-06 16:25:03 -070049#include "backtrace.h"
Jeff Brown13e715b2011-10-21 12:14:56 -070050#include "getevent.h"
Jeff Brown053b8652012-06-06 16:25:03 -070051#include "tombstone.h"
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080052#include "utility.h"
53
Christopher Ferris9774df62015-01-15 14:47:36 -080054// If the 32 bit executable is compiled on a 64 bit system,
55// use the 32 bit socket name.
56#if defined(TARGET_IS_64_BIT) && !defined(__LP64__)
57#define SOCKET_NAME DEBUGGER32_SOCKET_NAME
58#else
59#define SOCKET_NAME DEBUGGER_SOCKET_NAME
60#endif
61
Elliott Hughes0df8e4f2014-02-07 12:13:30 -080062struct debugger_request_t {
Christopher Ferris20303f82014-01-10 16:33:16 -080063 debugger_action_t action;
64 pid_t pid, tid;
65 uid_t uid, gid;
66 uintptr_t abort_msg_address;
Elliott Hughes855fcc32014-04-25 16:05:34 -070067 int32_t original_si_code;
Elliott Hughes0df8e4f2014-02-07 12:13:30 -080068};
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080069
Elliott Hughes39a28c22015-07-07 14:34:39 -070070static void wait_for_user_action(const debugger_request_t& request) {
Elliott Hughesd9bf2b22014-05-16 19:16:22 -070071 // Explain how to attach the debugger.
Elliott Hughes39a28c22015-07-07 14:34:39 -070072 ALOGI("***********************************************************\n"
Brigid Smith50eb5462014-06-18 14:17:57 -070073 "* Process %d has been suspended while crashing.\n"
Elliott Hughes39a28c22015-07-07 14:34:39 -070074 "* To attach gdbserver and start gdb, run this on the host:\n"
Brigid Smith50eb5462014-06-18 14:17:57 -070075 "*\n"
Josh Gaoc362c452016-01-14 15:51:06 -080076 "* gdbclient.py -p %d\n"
Brigid Smith50eb5462014-06-18 14:17:57 -070077 "*\n"
78 "* Wait for gdb to start, then press the VOLUME DOWN key\n"
79 "* to let the process continue crashing.\n"
Elliott Hughes39a28c22015-07-07 14:34:39 -070080 "***********************************************************",
81 request.pid, request.tid);
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080082
Elliott Hughesd9bf2b22014-05-16 19:16:22 -070083 // Wait for VOLUME DOWN.
Josh Gaoc362c452016-01-14 15:51:06 -080084 while (true) {
85 input_event e;
86 if (get_event(&e, -1) == 0) {
87 if (e.type == EV_KEY && e.code == KEY_VOLUMEDOWN && e.value == 0) {
88 break;
Christopher Ferris20303f82014-01-10 16:33:16 -080089 }
Elliott Hughesd9bf2b22014-05-16 19:16:22 -070090 }
Christopher Ferris20303f82014-01-10 16:33:16 -080091 }
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080092
Brigid Smith75582952014-06-26 13:22:48 -070093 ALOGI("debuggerd resuming process %d", request.pid);
Jeff Brown9524e412011-10-24 11:10:16 -070094}
Ben Cheng09e71372009-09-28 11:06:09 -070095
Jeff Brown9524e412011-10-24 11:10:16 -070096static int get_process_info(pid_t tid, pid_t* out_pid, uid_t* out_uid, uid_t* out_gid) {
Christopher Ferris20303f82014-01-10 16:33:16 -080097 char path[64];
98 snprintf(path, sizeof(path), "/proc/%d/status", tid);
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080099
Christopher Ferris20303f82014-01-10 16:33:16 -0800100 FILE* fp = fopen(path, "r");
101 if (!fp) {
102 return -1;
103 }
Jeff Brown9524e412011-10-24 11:10:16 -0700104
Christopher Ferris20303f82014-01-10 16:33:16 -0800105 int fields = 0;
106 char line[1024];
107 while (fgets(line, sizeof(line), fp)) {
108 size_t len = strlen(line);
109 if (len > 6 && !memcmp(line, "Tgid:\t", 6)) {
110 *out_pid = atoi(line + 6);
111 fields |= 1;
112 } else if (len > 5 && !memcmp(line, "Uid:\t", 5)) {
113 *out_uid = atoi(line + 5);
114 fields |= 2;
115 } else if (len > 5 && !memcmp(line, "Gid:\t", 5)) {
116 *out_gid = atoi(line + 5);
117 fields |= 4;
Jeff Brown9524e412011-10-24 11:10:16 -0700118 }
Christopher Ferris20303f82014-01-10 16:33:16 -0800119 }
120 fclose(fp);
121 return fields == 7 ? 0 : -1;
Jeff Brown9524e412011-10-24 11:10:16 -0700122}
123
Stephen Smalley69b80032014-07-24 15:23:05 -0400124/*
125 * Corresponds with debugger_action_t enum type in
126 * include/cutils/debugger.h.
127 */
128static const char *debuggerd_perms[] = {
129 NULL, /* crash is only used on self, no check applied */
130 "dump_tombstone",
131 "dump_backtrace"
132};
133
William Roberts46857392015-10-06 12:03:01 -0700134static int audit_callback(void* data, security_class_t /* cls */, char* buf, size_t len)
135{
136 struct debugger_request_t* req = reinterpret_cast<debugger_request_t*>(data);
137
138 if (!req) {
139 ALOGE("No debuggerd request audit data");
140 return 0;
141 }
142
143 snprintf(buf, len, "pid=%d uid=%d gid=%d", req->pid, req->uid, req->gid);
144 return 0;
145}
146
147static bool selinux_action_allowed(int s, debugger_request_t* request)
Stephen Smalley69b80032014-07-24 15:23:05 -0400148{
149 char *scon = NULL, *tcon = NULL;
150 const char *tclass = "debuggerd";
151 const char *perm;
152 bool allowed = false;
153
William Roberts46857392015-10-06 12:03:01 -0700154 if (request->action <= 0 || request->action >= (sizeof(debuggerd_perms)/sizeof(debuggerd_perms[0]))) {
155 ALOGE("SELinux: No permission defined for debugger action %d", request->action);
Stephen Smalley69b80032014-07-24 15:23:05 -0400156 return false;
157 }
158
William Roberts46857392015-10-06 12:03:01 -0700159 perm = debuggerd_perms[request->action];
Stephen Smalley69b80032014-07-24 15:23:05 -0400160
161 if (getpeercon(s, &scon) < 0) {
162 ALOGE("Cannot get peer context from socket\n");
163 goto out;
164 }
165
William Roberts46857392015-10-06 12:03:01 -0700166 if (getpidcon(request->tid, &tcon) < 0) {
167 ALOGE("Cannot get context for tid %d\n", request->tid);
Stephen Smalley69b80032014-07-24 15:23:05 -0400168 goto out;
169 }
170
William Roberts46857392015-10-06 12:03:01 -0700171 allowed = (selinux_check_access(scon, tcon, tclass, perm, reinterpret_cast<void*>(request)) == 0);
Stephen Smalley69b80032014-07-24 15:23:05 -0400172
173out:
174 freecon(scon);
175 freecon(tcon);
176 return allowed;
177}
178
Jeff Brown053b8652012-06-06 16:25:03 -0700179static int read_request(int fd, debugger_request_t* out_request) {
Elliott Hughes0df8e4f2014-02-07 12:13:30 -0800180 ucred cr;
181 socklen_t len = sizeof(cr);
Christopher Ferris20303f82014-01-10 16:33:16 -0800182 int status = getsockopt(fd, SOL_SOCKET, SO_PEERCRED, &cr, &len);
183 if (status != 0) {
Christopher Ferris1072f912014-10-31 21:34:38 -0700184 ALOGE("cannot get credentials");
Christopher Ferris20303f82014-01-10 16:33:16 -0800185 return -1;
186 }
187
Christopher Ferris1072f912014-10-31 21:34:38 -0700188 ALOGV("reading tid");
Christopher Ferris20303f82014-01-10 16:33:16 -0800189 fcntl(fd, F_SETFL, O_NONBLOCK);
190
Elliott Hughes0df8e4f2014-02-07 12:13:30 -0800191 pollfd pollfds[1];
Christopher Ferris20303f82014-01-10 16:33:16 -0800192 pollfds[0].fd = fd;
193 pollfds[0].events = POLLIN;
194 pollfds[0].revents = 0;
195 status = TEMP_FAILURE_RETRY(poll(pollfds, 1, 3000));
196 if (status != 1) {
Brigid Smith50eb5462014-06-18 14:17:57 -0700197 ALOGE("timed out reading tid (from pid=%d uid=%d)\n", cr.pid, cr.uid);
Christopher Ferris20303f82014-01-10 16:33:16 -0800198 return -1;
199 }
200
201 debugger_msg_t msg;
202 memset(&msg, 0, sizeof(msg));
203 status = TEMP_FAILURE_RETRY(read(fd, &msg, sizeof(msg)));
204 if (status < 0) {
Brigid Smith50eb5462014-06-18 14:17:57 -0700205 ALOGE("read failure? %s (pid=%d uid=%d)\n", strerror(errno), cr.pid, cr.uid);
Christopher Ferris20303f82014-01-10 16:33:16 -0800206 return -1;
207 }
Elliott Hughese901c1b2014-06-19 11:46:27 -0700208 if (status != sizeof(debugger_msg_t)) {
Brigid Smith50eb5462014-06-18 14:17:57 -0700209 ALOGE("invalid crash request of size %d (from pid=%d uid=%d)\n", status, cr.pid, cr.uid);
Christopher Ferris20303f82014-01-10 16:33:16 -0800210 return -1;
211 }
212
Christopher Ferris9774df62015-01-15 14:47:36 -0800213 out_request->action = static_cast<debugger_action_t>(msg.action);
Christopher Ferris20303f82014-01-10 16:33:16 -0800214 out_request->tid = msg.tid;
215 out_request->pid = cr.pid;
216 out_request->uid = cr.uid;
217 out_request->gid = cr.gid;
218 out_request->abort_msg_address = msg.abort_msg_address;
Elliott Hughes855fcc32014-04-25 16:05:34 -0700219 out_request->original_si_code = msg.original_si_code;
Christopher Ferris20303f82014-01-10 16:33:16 -0800220
221 if (msg.action == DEBUGGER_ACTION_CRASH) {
222 // Ensure that the tid reported by the crashing process is valid.
223 char buf[64];
224 struct stat s;
225 snprintf(buf, sizeof buf, "/proc/%d/task/%d", out_request->pid, out_request->tid);
226 if (stat(buf, &s)) {
Brigid Smith50eb5462014-06-18 14:17:57 -0700227 ALOGE("tid %d does not exist in pid %d. ignoring debug request\n",
Christopher Ferris20303f82014-01-10 16:33:16 -0800228 out_request->tid, out_request->pid);
229 return -1;
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800230 }
Christopher Ferris20303f82014-01-10 16:33:16 -0800231 } else if (cr.uid == 0
Jeff Brown053b8652012-06-06 16:25:03 -0700232 || (cr.uid == AID_SYSTEM && msg.action == DEBUGGER_ACTION_DUMP_BACKTRACE)) {
Christopher Ferris20303f82014-01-10 16:33:16 -0800233 // Only root or system can ask us to attach to any process and dump it explicitly.
234 // However, system is only allowed to collect backtraces but cannot dump tombstones.
235 status = get_process_info(out_request->tid, &out_request->pid,
236 &out_request->uid, &out_request->gid);
237 if (status < 0) {
Brigid Smith50eb5462014-06-18 14:17:57 -0700238 ALOGE("tid %d does not exist. ignoring explicit dump request\n", out_request->tid);
Christopher Ferris20303f82014-01-10 16:33:16 -0800239 return -1;
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800240 }
Stephen Smalley69b80032014-07-24 15:23:05 -0400241
William Roberts46857392015-10-06 12:03:01 -0700242 if (!selinux_action_allowed(fd, out_request))
Stephen Smalley69b80032014-07-24 15:23:05 -0400243 return -1;
Christopher Ferris20303f82014-01-10 16:33:16 -0800244 } else {
245 // No one else is allowed to dump arbitrary processes.
246 return -1;
247 }
248 return 0;
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800249}
250
Jeff Brown053b8652012-06-06 16:25:03 -0700251static bool should_attach_gdb(debugger_request_t* request) {
Christopher Ferris20303f82014-01-10 16:33:16 -0800252 if (request->action == DEBUGGER_ACTION_CRASH) {
Christopher Ferrisd79f2be2015-07-01 15:42:05 -0700253 return property_get_bool("debug.debuggerd.wait_for_gdb", false);
Christopher Ferris20303f82014-01-10 16:33:16 -0800254 }
255 return false;
Jeff Brown9524e412011-10-24 11:10:16 -0700256}
Bruce Beare84924902010-10-13 14:21:30 -0700257
Christopher Ferris9774df62015-01-15 14:47:36 -0800258#if defined(__LP64__)
259static bool is32bit(pid_t tid) {
260 char* exeline;
261 if (asprintf(&exeline, "/proc/%d/exe", tid) == -1) {
262 return false;
263 }
264 int fd = TEMP_FAILURE_RETRY(open(exeline, O_RDONLY | O_CLOEXEC));
265 int saved_errno = errno;
266 free(exeline);
267 if (fd == -1) {
268 ALOGW("Failed to open /proc/%d/exe %s", tid, strerror(saved_errno));
269 return false;
270 }
271
272 char ehdr[EI_NIDENT];
273 ssize_t bytes = TEMP_FAILURE_RETRY(read(fd, &ehdr, sizeof(ehdr)));
Elliott Hughes47b01342015-05-15 19:16:40 -0700274 close(fd);
Christopher Ferris9774df62015-01-15 14:47:36 -0800275 if (bytes != (ssize_t) sizeof(ehdr) || memcmp(ELFMAG, ehdr, SELFMAG) != 0) {
276 return false;
277 }
278 if (ehdr[EI_CLASS] == ELFCLASS32) {
279 return true;
280 }
281 return false;
282}
283
284static void redirect_to_32(int fd, debugger_request_t* request) {
285 debugger_msg_t msg;
286 memset(&msg, 0, sizeof(msg));
287 msg.tid = request->tid;
288 msg.action = request->action;
289
290 int sock_fd = socket_local_client(DEBUGGER32_SOCKET_NAME, ANDROID_SOCKET_NAMESPACE_ABSTRACT,
291 SOCK_STREAM | SOCK_CLOEXEC);
292 if (sock_fd < 0) {
293 ALOGE("Failed to connect to debuggerd32: %s", strerror(errno));
294 return;
295 }
296
297 if (TEMP_FAILURE_RETRY(write(sock_fd, &msg, sizeof(msg))) != (ssize_t) sizeof(msg)) {
298 ALOGE("Failed to write request to debuggerd32 socket: %s", strerror(errno));
Elliott Hughes47b01342015-05-15 19:16:40 -0700299 close(sock_fd);
Christopher Ferris9774df62015-01-15 14:47:36 -0800300 return;
301 }
302
303 char ack;
304 if (TEMP_FAILURE_RETRY(read(sock_fd, &ack, 1)) == -1) {
305 ALOGE("Failed to read ack from debuggerd32 socket: %s", strerror(errno));
Elliott Hughes47b01342015-05-15 19:16:40 -0700306 close(sock_fd);
Christopher Ferris9774df62015-01-15 14:47:36 -0800307 return;
308 }
309
310 char buffer[1024];
311 ssize_t bytes_read;
312 while ((bytes_read = TEMP_FAILURE_RETRY(read(sock_fd, buffer, sizeof(buffer)))) > 0) {
313 ssize_t bytes_to_send = bytes_read;
314 ssize_t bytes_written;
315 do {
316 bytes_written = TEMP_FAILURE_RETRY(write(fd, buffer + bytes_read - bytes_to_send,
317 bytes_to_send));
318 if (bytes_written == -1) {
319 if (errno == EAGAIN) {
320 // Retry the write.
321 continue;
322 }
323 ALOGE("Error while writing data to fd: %s", strerror(errno));
324 break;
325 }
326 bytes_to_send -= bytes_written;
327 } while (bytes_written != 0 && bytes_to_send > 0);
328 if (bytes_to_send != 0) {
329 ALOGE("Failed to write all data to fd: read %zd, sent %zd", bytes_read, bytes_to_send);
330 break;
331 }
332 }
Elliott Hughes47b01342015-05-15 19:16:40 -0700333 close(sock_fd);
Christopher Ferris9774df62015-01-15 14:47:36 -0800334}
335#endif
336
Josh Gao7c89f9e2016-01-13 17:57:14 -0800337static void ptrace_siblings(pid_t pid, pid_t main_tid, std::set<pid_t>& tids) {
338 char task_path[64];
339
340 snprintf(task_path, sizeof(task_path), "/proc/%d/task", pid);
341
342 std::unique_ptr<DIR, int (*)(DIR*)> d(opendir(task_path), closedir);
343
344 // Bail early if the task directory cannot be opened.
345 if (!d) {
346 ALOGE("debuggerd: failed to open /proc/%d/task: %s", pid, strerror(errno));
347 return;
348 }
349
350 struct dirent* de;
351 while ((de = readdir(d.get())) != NULL) {
352 // Ignore "." and "..".
353 if (!strcmp(de->d_name, ".") || !strcmp(de->d_name, "..")) {
354 continue;
355 }
356
357 char* end;
358 pid_t tid = strtoul(de->d_name, &end, 10);
359 if (*end) {
360 continue;
361 }
362
363 if (tid == main_tid) {
364 continue;
365 }
366
367 if (ptrace(PTRACE_ATTACH, tid, 0, 0) < 0) {
368 ALOGE("debuggerd: ptrace attach to %d failed: %s", tid, strerror(errno));
369 continue;
370 }
371
372 tids.insert(tid);
373 }
374}
375
376static bool perform_dump(const debugger_request_t& request, int fd, int tombstone_fd,
377 BacktraceMap* backtrace_map, const std::set<pid_t>& siblings) {
378 if (TEMP_FAILURE_RETRY(write(fd, "\0", 1)) != 1) {
379 ALOGE("debuggerd: failed to respond to client: %s\n", strerror(errno));
380 return false;
381 }
382
383 int total_sleep_time_usec = 0;
384 while (true) {
385 int signal = wait_for_signal(request.tid, &total_sleep_time_usec);
386 switch (signal) {
387 case -1:
388 ALOGE("debuggerd: timed out waiting for signal");
389 return false;
390
391 case SIGSTOP:
392 if (request.action == DEBUGGER_ACTION_DUMP_TOMBSTONE) {
393 ALOGV("debuggerd: stopped -- dumping to tombstone");
394 engrave_tombstone(tombstone_fd, backtrace_map, request.pid, request.tid, siblings, signal,
395 request.original_si_code, request.abort_msg_address);
396 } else if (request.action == DEBUGGER_ACTION_DUMP_BACKTRACE) {
397 ALOGV("debuggerd: stopped -- dumping to fd");
398 dump_backtrace(fd, -1, backtrace_map, request.pid, request.tid, siblings);
399 } else {
400 ALOGV("debuggerd: stopped -- continuing");
401 if (ptrace(PTRACE_CONT, request.tid, 0, 0) != 0) {
402 ALOGE("debuggerd: ptrace continue failed: %s", strerror(errno));
403 return false;
404 }
405 continue; // loop again
406 }
407 break;
408
409 case SIGABRT:
410 case SIGBUS:
411 case SIGFPE:
412 case SIGILL:
413 case SIGSEGV:
414#ifdef SIGSTKFLT
415 case SIGSTKFLT:
416#endif
417 case SIGTRAP:
418 ALOGV("stopped -- fatal signal\n");
419 // Send a SIGSTOP to the process to make all of
420 // the non-signaled threads stop moving. Without
421 // this we get a lot of "ptrace detach failed:
422 // No such process".
423 kill(request.pid, SIGSTOP);
424 engrave_tombstone(tombstone_fd, backtrace_map, request.pid, request.tid, siblings, signal,
425 request.original_si_code, request.abort_msg_address);
426 break;
427
428 default:
429 ALOGE("debuggerd: process stopped due to unexpected signal %d\n", signal);
430 break;
431 }
432 break;
433 }
434
435 return true;
436}
437
438static bool drop_privileges() {
439 if (setresgid(AID_DEBUGGERD, AID_DEBUGGERD, AID_DEBUGGERD) != 0) {
440 ALOGE("debuggerd: failed to setresgid");
441 return false;
442 }
443
444 if (setresuid(AID_DEBUGGERD, AID_DEBUGGERD, AID_DEBUGGERD) != 0) {
445 ALOGE("debuggerd: failed to setresuid");
446 return false;
447 }
448
449 return true;
450}
451
Josh Gaoc362c452016-01-14 15:51:06 -0800452static bool fork_signal_sender(int* in_fd, int* out_fd, pid_t* sender_pid, pid_t target_pid) {
453 int input_pipe[2];
454 int output_pipe[2];
455 if (pipe(input_pipe) != 0) {
456 ALOGE("debuggerd: failed to create input pipe for signal sender: %s", strerror(errno));
457 return false;
458 }
459
460 if (pipe(output_pipe) != 0) {
461 close(input_pipe[0]);
462 close(input_pipe[1]);
463 ALOGE("debuggerd: failed to create output pipe for signal sender: %s", strerror(errno));
464 return false;
465 }
466
467 pid_t fork_pid = fork();
468 if (fork_pid == -1) {
469 ALOGE("debuggerd: failed to initialize signal sender: fork failed: %s", strerror(errno));
470 return false;
471 } else if (fork_pid == 0) {
472 close(input_pipe[1]);
473 close(output_pipe[0]);
474 auto wait = [=]() {
475 char buf[1];
476 if (TEMP_FAILURE_RETRY(read(input_pipe[0], buf, 1)) != 1) {
477 ALOGE("debuggerd: signal sender failed to read from pipe");
478 exit(1);
479 }
480 };
481 auto notify_done = [=]() {
482 if (TEMP_FAILURE_RETRY(write(output_pipe[1], "", 1)) != 1) {
483 ALOGE("debuggerd: signal sender failed to write to pipe");
484 exit(1);
485 }
486 };
487
488 wait();
489 if (kill(target_pid, SIGSTOP) != 0) {
490 ALOGE("debuggerd: failed to stop target '%d': %s", target_pid, strerror(errno));
491 }
492 notify_done();
493
494 wait();
495 if (kill(target_pid, SIGCONT) != 0) {
496 ALOGE("debuggerd: failed to resume target '%d': %s", target_pid, strerror(errno));
497 }
498 notify_done();
499
500 exit(0);
501 } else {
502 close(input_pipe[0]);
503 close(output_pipe[1]);
504 *in_fd = input_pipe[1];
505 *out_fd = output_pipe[0];
506 *sender_pid = fork_pid;
507 return true;
508 }
509}
510
Jeff Brown9524e412011-10-24 11:10:16 -0700511static void handle_request(int fd) {
Brigid Smith50eb5462014-06-18 14:17:57 -0700512 ALOGV("handle_request(%d)\n", fd);
Jeff Brown9524e412011-10-24 11:10:16 -0700513
Josh Gao8ab7fd42015-11-16 17:26:33 -0800514 ScopedFd closer(fd);
Christopher Ferris20303f82014-01-10 16:33:16 -0800515 debugger_request_t request;
516 memset(&request, 0, sizeof(request));
517 int status = read_request(fd, &request);
Josh Gao8ab7fd42015-11-16 17:26:33 -0800518 if (status != 0) {
519 return;
520 }
521
522 ALOGV("BOOM: pid=%d uid=%d gid=%d tid=%d\n", request.pid, request.uid, request.gid, request.tid);
Jeff Brown9524e412011-10-24 11:10:16 -0700523
Christopher Ferris9774df62015-01-15 14:47:36 -0800524#if defined(__LP64__)
Josh Gao8ab7fd42015-11-16 17:26:33 -0800525 // On 64 bit systems, requests to dump 32 bit and 64 bit tids come
526 // to the 64 bit debuggerd. If the process is a 32 bit executable,
527 // redirect the request to the 32 bit debuggerd.
528 if (is32bit(request.tid)) {
529 // Only dump backtrace and dump tombstone requests can be redirected.
530 if (request.action == DEBUGGER_ACTION_DUMP_BACKTRACE ||
531 request.action == DEBUGGER_ACTION_DUMP_TOMBSTONE) {
532 redirect_to_32(fd, &request);
Christopher Ferris20303f82014-01-10 16:33:16 -0800533 } else {
Josh Gao8ab7fd42015-11-16 17:26:33 -0800534 ALOGE("debuggerd: Not allowed to redirect action %d to 32 bit debuggerd\n", request.action);
535 }
536 return;
537 }
Christopher Ferris20303f82014-01-10 16:33:16 -0800538#endif
Christopher Ferris20303f82014-01-10 16:33:16 -0800539
Josh Gaoe7a9e522015-11-17 13:57:03 -0800540 // Fork a child to handle the rest of the request.
541 pid_t fork_pid = fork();
542 if (fork_pid == -1) {
543 ALOGE("debuggerd: failed to fork: %s\n", strerror(errno));
544 return;
545 } else if (fork_pid != 0) {
546 waitpid(fork_pid, nullptr, 0);
547 return;
548 }
549
550 // Open the tombstone file if we need it.
551 std::string tombstone_path;
552 int tombstone_fd = -1;
553 switch (request.action) {
554 case DEBUGGER_ACTION_DUMP_TOMBSTONE:
555 case DEBUGGER_ACTION_CRASH:
556 tombstone_fd = open_tombstone(&tombstone_path);
557 if (tombstone_fd == -1) {
558 ALOGE("debuggerd: failed to open tombstone file: %s\n", strerror(errno));
559 exit(1);
560 }
561 break;
562
563 case DEBUGGER_ACTION_DUMP_BACKTRACE:
564 break;
565
566 default:
567 ALOGE("debuggerd: unexpected request action: %d", request.action);
568 exit(1);
569 }
570
Josh Gao8ab7fd42015-11-16 17:26:33 -0800571 // At this point, the thread that made the request is blocked in
572 // a read() call. If the thread has crashed, then this gives us
573 // time to PTRACE_ATTACH to it before it has a chance to really fault.
574 //
575 // The PTRACE_ATTACH sends a SIGSTOP to the target process, but it
576 // won't necessarily have stopped by the time ptrace() returns. (We
577 // currently assume it does.) We write to the file descriptor to
578 // ensure that it can run as soon as we call PTRACE_CONT below.
579 // See details in bionic/libc/linker/debugger.c, in function
580 // debugger_signal_handler().
Josh Gao7c89f9e2016-01-13 17:57:14 -0800581
582 // Attach to the target process.
583 if (ptrace(PTRACE_ATTACH, request.tid, 0, 0) != 0) {
584 ALOGE("debuggerd: ptrace attach failed: %s", strerror(errno));
Josh Gaoe7a9e522015-11-17 13:57:03 -0800585 exit(1);
586 }
587
Josh Gao7c89f9e2016-01-13 17:57:14 -0800588 // Don't attach to the sibling threads if we want to attach gdb.
589 // Supposedly, it makes the process less reliable.
590 bool attach_gdb = should_attach_gdb(&request);
Josh Gaoc362c452016-01-14 15:51:06 -0800591 int signal_in_fd = -1;
592 int signal_out_fd = -1;
593 pid_t signal_pid = 0;
594 if (attach_gdb) {
595 // Open all of the input devices we need to listen for VOLUMEDOWN before dropping privileges.
596 if (init_getevent() != 0) {
597 ALOGE("debuggerd: failed to initialize input device, not waiting for gdb");
598 attach_gdb = false;
599 }
600
601 // Fork a process that stays root, and listens on a pipe to pause and resume the target.
602 if (!fork_signal_sender(&signal_in_fd, &signal_out_fd, &signal_pid, request.pid)) {
603 attach_gdb = false;
604 }
605 }
606
607 auto notify_signal_sender = [=]() {
608 char buf[1];
609 if (TEMP_FAILURE_RETRY(write(signal_in_fd, "", 1)) != 1) {
610 ALOGE("debuggerd: failed to notify signal process: %s", strerror(errno));
611 } else if (TEMP_FAILURE_RETRY(read(signal_out_fd, buf, 1)) != 1) {
612 ALOGE("debuggerd: failed to read response from signal process: %s", strerror(errno));
613 }
614 };
615
Josh Gao7c89f9e2016-01-13 17:57:14 -0800616 std::set<pid_t> siblings;
617 if (!attach_gdb) {
618 ptrace_siblings(request.pid, request.tid, siblings);
619 }
620
Josh Gaoe7a9e522015-11-17 13:57:03 -0800621 // Generate the backtrace map before dropping privileges.
622 std::unique_ptr<BacktraceMap> backtrace_map(BacktraceMap::Create(request.pid));
623
Josh Gao7c89f9e2016-01-13 17:57:14 -0800624 bool succeeded = false;
625
Josh Gaoe7a9e522015-11-17 13:57:03 -0800626 // Now that we've done everything that requires privileges, we can drop them.
Josh Gao7c89f9e2016-01-13 17:57:14 -0800627 if (drop_privileges()) {
628 succeeded = perform_dump(request, fd, tombstone_fd, backtrace_map.get(), siblings);
629 if (succeeded) {
630 if (request.action == DEBUGGER_ACTION_DUMP_TOMBSTONE) {
631 if (!tombstone_path.empty()) {
632 write(fd, tombstone_path.c_str(), tombstone_path.length());
Josh Gao8ab7fd42015-11-16 17:26:33 -0800633 }
Josh Gao7c89f9e2016-01-13 17:57:14 -0800634 }
Josh Gao8ab7fd42015-11-16 17:26:33 -0800635 }
Josh Gao8ab7fd42015-11-16 17:26:33 -0800636
Josh Gao8ab7fd42015-11-16 17:26:33 -0800637 if (attach_gdb) {
Josh Gaoc362c452016-01-14 15:51:06 -0800638 // Tell the signal process to send SIGSTOP to the target.
639 notify_signal_sender();
Josh Gao8ab7fd42015-11-16 17:26:33 -0800640 }
641 }
642
Josh Gao7c89f9e2016-01-13 17:57:14 -0800643 if (ptrace(PTRACE_DETACH, request.tid, 0, 0) != 0) {
644 ALOGE("debuggerd: ptrace detach from %d failed: %s", request.tid, strerror(errno));
645 }
646
647 for (pid_t sibling : siblings) {
648 ptrace(PTRACE_DETACH, sibling, 0, 0);
649 }
650
Josh Gaoc362c452016-01-14 15:51:06 -0800651 // Wait for gdb, if requested.
652 if (attach_gdb && succeeded) {
Josh Gao7c89f9e2016-01-13 17:57:14 -0800653 wait_for_user_action(request);
Josh Gao7c89f9e2016-01-13 17:57:14 -0800654
Josh Gaoc362c452016-01-14 15:51:06 -0800655 // Tell the signal process to send SIGCONT to the target.
656 notify_signal_sender();
657
658 uninit_getevent();
659 waitpid(signal_pid, nullptr, 0);
660 }
Josh Gao7c89f9e2016-01-13 17:57:14 -0800661
662 exit(!succeeded);
Jeff Brown9524e412011-10-24 11:10:16 -0700663}
664
665static int do_server() {
Elliott Hughesa323b502014-05-16 21:12:17 -0700666 // debuggerd crashes can't be reported to debuggerd.
667 // Reset all of the crash handlers.
Christopher Ferris20303f82014-01-10 16:33:16 -0800668 signal(SIGABRT, SIG_DFL);
669 signal(SIGBUS, SIG_DFL);
670 signal(SIGFPE, SIG_DFL);
Elliott Hughesa323b502014-05-16 21:12:17 -0700671 signal(SIGILL, SIG_DFL);
Christopher Ferris20303f82014-01-10 16:33:16 -0800672 signal(SIGSEGV, SIG_DFL);
Chris Dearman231e3c82012-08-10 17:06:20 -0700673#ifdef SIGSTKFLT
Christopher Ferris20303f82014-01-10 16:33:16 -0800674 signal(SIGSTKFLT, SIG_DFL);
Chris Dearman231e3c82012-08-10 17:06:20 -0700675#endif
Elliott Hughesa323b502014-05-16 21:12:17 -0700676 signal(SIGTRAP, SIG_DFL);
Andy McFadden44e12ec2011-07-29 12:36:47 -0700677
Christopher Ferris20303f82014-01-10 16:33:16 -0800678 // Ignore failed writes to closed sockets
679 signal(SIGPIPE, SIG_IGN);
Nick Kralevich96bcd482013-06-18 17:57:08 -0700680
Elliott Hughesa323b502014-05-16 21:12:17 -0700681 int logsocket = socket_local_client("logd", ANDROID_SOCKET_NAMESPACE_ABSTRACT, SOCK_DGRAM);
Christopher Ferris20303f82014-01-10 16:33:16 -0800682 if (logsocket < 0) {
683 logsocket = -1;
684 } else {
685 fcntl(logsocket, F_SETFD, FD_CLOEXEC);
686 }
687
Elliott Hughesa323b502014-05-16 21:12:17 -0700688 struct sigaction act;
Christopher Ferris20303f82014-01-10 16:33:16 -0800689 act.sa_handler = SIG_DFL;
690 sigemptyset(&act.sa_mask);
691 sigaddset(&act.sa_mask,SIGCHLD);
692 act.sa_flags = SA_NOCLDWAIT;
693 sigaction(SIGCHLD, &act, 0);
694
Christopher Ferris9774df62015-01-15 14:47:36 -0800695 int s = socket_local_server(SOCKET_NAME, ANDROID_SOCKET_NAMESPACE_ABSTRACT, SOCK_STREAM);
Christopher Ferris20303f82014-01-10 16:33:16 -0800696 if (s < 0)
697 return 1;
698 fcntl(s, F_SETFD, FD_CLOEXEC);
699
Dan Willemsen30622bb2015-10-22 13:04:22 -0700700 ALOGI("debuggerd: starting\n");
Christopher Ferris20303f82014-01-10 16:33:16 -0800701
702 for (;;) {
Erik Kline7e16cc12015-12-01 17:27:59 +0900703 sockaddr_storage ss;
704 sockaddr* addrp = reinterpret_cast<sockaddr*>(&ss);
705 socklen_t alen = sizeof(ss);
Christopher Ferris20303f82014-01-10 16:33:16 -0800706
Brigid Smith50eb5462014-06-18 14:17:57 -0700707 ALOGV("waiting for connection\n");
Erik Kline7e16cc12015-12-01 17:27:59 +0900708 int fd = accept(s, addrp, &alen);
Christopher Ferris20303f82014-01-10 16:33:16 -0800709 if (fd < 0) {
Brigid Smith50eb5462014-06-18 14:17:57 -0700710 ALOGV("accept failed: %s\n", strerror(errno));
Christopher Ferris20303f82014-01-10 16:33:16 -0800711 continue;
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800712 }
713
Christopher Ferris20303f82014-01-10 16:33:16 -0800714 fcntl(fd, F_SETFD, FD_CLOEXEC);
Ben Cheng09e71372009-09-28 11:06:09 -0700715
Christopher Ferris20303f82014-01-10 16:33:16 -0800716 handle_request(fd);
717 }
718 return 0;
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800719}
Jeff Brown9524e412011-10-24 11:10:16 -0700720
Jeff Brown053b8652012-06-06 16:25:03 -0700721static int do_explicit_dump(pid_t tid, bool dump_backtrace) {
Christopher Ferris20303f82014-01-10 16:33:16 -0800722 fprintf(stdout, "Sending request to dump task %d.\n", tid);
Jeff Brown9524e412011-10-24 11:10:16 -0700723
Christopher Ferris20303f82014-01-10 16:33:16 -0800724 if (dump_backtrace) {
725 fflush(stdout);
726 if (dump_backtrace_to_file(tid, fileno(stdout)) < 0) {
727 fputs("Error dumping backtrace.\n", stderr);
728 return 1;
Jeff Brown9524e412011-10-24 11:10:16 -0700729 }
Christopher Ferris20303f82014-01-10 16:33:16 -0800730 } else {
731 char tombstone_path[PATH_MAX];
732 if (dump_tombstone(tid, tombstone_path, sizeof(tombstone_path)) < 0) {
733 fputs("Error dumping tombstone.\n", stderr);
734 return 1;
735 }
736 fprintf(stderr, "Tombstone written to: %s\n", tombstone_path);
737 }
738 return 0;
Jeff Brown9524e412011-10-24 11:10:16 -0700739}
740
Jeff Brown053b8652012-06-06 16:25:03 -0700741static void usage() {
Christopher Ferris20303f82014-01-10 16:33:16 -0800742 fputs("Usage: -b [<tid>]\n"
743 " -b dump backtrace to console, otherwise dump full tombstone file\n"
744 "\n"
745 "If tid specified, sends a request to debuggerd to dump that task.\n"
746 "Otherwise, starts the debuggerd server.\n", stderr);
Jeff Brown053b8652012-06-06 16:25:03 -0700747}
748
Jeff Brown9524e412011-10-24 11:10:16 -0700749int main(int argc, char** argv) {
Stephen Smalley69b80032014-07-24 15:23:05 -0400750 union selinux_callback cb;
Christopher Ferris20303f82014-01-10 16:33:16 -0800751 if (argc == 1) {
William Roberts46857392015-10-06 12:03:01 -0700752 cb.func_audit = audit_callback;
753 selinux_set_callback(SELINUX_CB_AUDIT, cb);
Stephen Smalley69b80032014-07-24 15:23:05 -0400754 cb.func_log = selinux_log_callback;
755 selinux_set_callback(SELINUX_CB_LOG, cb);
Christopher Ferris20303f82014-01-10 16:33:16 -0800756 return do_server();
757 }
Jeff Brown053b8652012-06-06 16:25:03 -0700758
Christopher Ferris20303f82014-01-10 16:33:16 -0800759 bool dump_backtrace = false;
760 bool have_tid = false;
761 pid_t tid = 0;
762 for (int i = 1; i < argc; i++) {
763 if (!strcmp(argv[i], "-b")) {
764 dump_backtrace = true;
765 } else if (!have_tid) {
766 tid = atoi(argv[i]);
767 have_tid = true;
768 } else {
769 usage();
770 return 1;
Jeff Brown9524e412011-10-24 11:10:16 -0700771 }
Christopher Ferris20303f82014-01-10 16:33:16 -0800772 }
773 if (!have_tid) {
774 usage();
775 return 1;
776 }
777 return do_explicit_dump(tid, dump_backtrace);
Jeff Brown9524e412011-10-24 11:10:16 -0700778}