Steven Moreland | fe66b73 | 2019-02-01 14:29:45 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2017 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
Martijn Coenen | 3924742 | 2017-09-25 15:29:06 +0200 | [diff] [blame] | 17 | #define LOG_TAG "hwservicemanager" |
| 18 | |
Martijn Coenen | 7ce83be | 2017-04-07 16:19:32 -0700 | [diff] [blame] | 19 | #include <android-base/logging.h> |
| 20 | #include <hidl-util/FQName.h> |
| 21 | #include <log/log.h> |
| 22 | |
| 23 | #include "AccessControl.h" |
| 24 | |
| 25 | namespace android { |
| 26 | |
| 27 | static const char *kPermissionAdd = "add"; |
| 28 | static const char *kPermissionGet = "find"; |
| 29 | static const char *kPermissionList = "list"; |
| 30 | |
| 31 | struct audit_data { |
| 32 | const char* interfaceName; |
Steven Moreland | 7185a89 | 2019-01-09 18:00:05 -0800 | [diff] [blame] | 33 | const char* sid; |
Martijn Coenen | 7ce83be | 2017-04-07 16:19:32 -0700 | [diff] [blame] | 34 | pid_t pid; |
| 35 | }; |
| 36 | |
| 37 | using android::FQName; |
| 38 | |
| 39 | AccessControl::AccessControl() { |
| 40 | mSeHandle = selinux_android_hw_service_context_handle(); |
Yi Kong | 00892ee | 2018-07-31 16:50:28 -0700 | [diff] [blame] | 41 | LOG_ALWAYS_FATAL_IF(mSeHandle == nullptr, "Failed to acquire SELinux handle."); |
Martijn Coenen | 7ce83be | 2017-04-07 16:19:32 -0700 | [diff] [blame] | 42 | |
| 43 | if (getcon(&mSeContext) != 0) { |
| 44 | LOG_ALWAYS_FATAL("Failed to acquire hwservicemanager context."); |
| 45 | } |
| 46 | |
| 47 | selinux_status_open(true); |
| 48 | |
| 49 | mSeCallbacks.func_audit = AccessControl::auditCallback; |
| 50 | selinux_set_callback(SELINUX_CB_AUDIT, mSeCallbacks); |
| 51 | |
| 52 | mSeCallbacks.func_log = selinux_log_callback; /* defined in libselinux */ |
| 53 | selinux_set_callback(SELINUX_CB_LOG, mSeCallbacks); |
| 54 | } |
| 55 | |
Steven Moreland | 7185a89 | 2019-01-09 18:00:05 -0800 | [diff] [blame] | 56 | bool AccessControl::canAdd(const std::string& fqName, const CallingContext& callingContext) { |
Steven Moreland | 0cd38f0 | 2018-03-06 15:09:22 -0800 | [diff] [blame] | 57 | FQName fqIface; |
Martijn Coenen | 7ce83be | 2017-04-07 16:19:32 -0700 | [diff] [blame] | 58 | |
Steven Moreland | 0cd38f0 | 2018-03-06 15:09:22 -0800 | [diff] [blame] | 59 | if (!FQName::parse(fqName, &fqIface)) { |
Martijn Coenen | 7ce83be | 2017-04-07 16:19:32 -0700 | [diff] [blame] | 60 | return false; |
| 61 | } |
| 62 | const std::string checkName = fqIface.package() + "::" + fqIface.name(); |
| 63 | |
Steven Moreland | 7185a89 | 2019-01-09 18:00:05 -0800 | [diff] [blame] | 64 | return checkPermission(callingContext, kPermissionAdd, checkName.c_str()); |
Martijn Coenen | 7ce83be | 2017-04-07 16:19:32 -0700 | [diff] [blame] | 65 | } |
| 66 | |
Steven Moreland | 7185a89 | 2019-01-09 18:00:05 -0800 | [diff] [blame] | 67 | bool AccessControl::canGet(const std::string& fqName, const CallingContext& callingContext) { |
Steven Moreland | 0cd38f0 | 2018-03-06 15:09:22 -0800 | [diff] [blame] | 68 | FQName fqIface; |
Martijn Coenen | 7ce83be | 2017-04-07 16:19:32 -0700 | [diff] [blame] | 69 | |
Steven Moreland | 0cd38f0 | 2018-03-06 15:09:22 -0800 | [diff] [blame] | 70 | if (!FQName::parse(fqName, &fqIface)) { |
Martijn Coenen | 7ce83be | 2017-04-07 16:19:32 -0700 | [diff] [blame] | 71 | return false; |
| 72 | } |
| 73 | const std::string checkName = fqIface.package() + "::" + fqIface.name(); |
| 74 | |
Steven Moreland | 7185a89 | 2019-01-09 18:00:05 -0800 | [diff] [blame] | 75 | return checkPermission(callingContext, kPermissionGet, checkName.c_str()); |
Martijn Coenen | 7ce83be | 2017-04-07 16:19:32 -0700 | [diff] [blame] | 76 | } |
| 77 | |
Steven Moreland | 7185a89 | 2019-01-09 18:00:05 -0800 | [diff] [blame] | 78 | bool AccessControl::canList(const CallingContext& callingContext) { |
| 79 | return checkPermission(callingContext, mSeContext, kPermissionList, nullptr); |
Martijn Coenen | 7ce83be | 2017-04-07 16:19:32 -0700 | [diff] [blame] | 80 | } |
| 81 | |
Steven Moreland | 7185a89 | 2019-01-09 18:00:05 -0800 | [diff] [blame] | 82 | AccessControl::CallingContext AccessControl::getCallingContext(pid_t sourcePid) { |
Yi Kong | 00892ee | 2018-07-31 16:50:28 -0700 | [diff] [blame] | 83 | char *sourceContext = nullptr; |
Martijn Coenen | 7ce83be | 2017-04-07 16:19:32 -0700 | [diff] [blame] | 84 | |
| 85 | if (getpidcon(sourcePid, &sourceContext) < 0) { |
Martijn Coenen | 3924742 | 2017-09-25 15:29:06 +0200 | [diff] [blame] | 86 | ALOGE("SELinux: failed to retrieve process context for pid %d", sourcePid); |
Steven Moreland | 7185a89 | 2019-01-09 18:00:05 -0800 | [diff] [blame] | 87 | return { false, "", sourcePid }; |
Steven Moreland | 4034c1c | 2017-11-03 17:42:27 -0700 | [diff] [blame] | 88 | } |
| 89 | |
Steven Moreland | 7185a89 | 2019-01-09 18:00:05 -0800 | [diff] [blame] | 90 | std::string context = sourceContext; |
| 91 | freecon(sourceContext); |
| 92 | return { true, context, sourcePid }; |
Steven Moreland | 4034c1c | 2017-11-03 17:42:27 -0700 | [diff] [blame] | 93 | } |
| 94 | |
Steven Moreland | 7185a89 | 2019-01-09 18:00:05 -0800 | [diff] [blame] | 95 | bool AccessControl::checkPermission(const CallingContext& source, const char *targetContext, const char *perm, const char *interface) { |
| 96 | if (!source.sidPresent) { |
Martijn Coenen | 7ce83be | 2017-04-07 16:19:32 -0700 | [diff] [blame] | 97 | return false; |
| 98 | } |
| 99 | |
Steven Moreland | 4034c1c | 2017-11-03 17:42:27 -0700 | [diff] [blame] | 100 | bool allowed = false; |
Steven Moreland | 4034c1c | 2017-11-03 17:42:27 -0700 | [diff] [blame] | 101 | |
Steven Moreland | 7185a89 | 2019-01-09 18:00:05 -0800 | [diff] [blame] | 102 | struct audit_data ad; |
| 103 | ad.pid = source.pid; |
| 104 | ad.sid = source.sid.c_str(); |
Martijn Coenen | 7ce83be | 2017-04-07 16:19:32 -0700 | [diff] [blame] | 105 | ad.interfaceName = interface; |
| 106 | |
Steven Moreland | 7185a89 | 2019-01-09 18:00:05 -0800 | [diff] [blame] | 107 | allowed = (selinux_check_access(source.sid.c_str(), targetContext, "hwservice_manager", |
Martijn Coenen | 7ce83be | 2017-04-07 16:19:32 -0700 | [diff] [blame] | 108 | perm, (void *) &ad) == 0); |
| 109 | |
Martijn Coenen | 7ce83be | 2017-04-07 16:19:32 -0700 | [diff] [blame] | 110 | return allowed; |
| 111 | } |
| 112 | |
Steven Moreland | 7185a89 | 2019-01-09 18:00:05 -0800 | [diff] [blame] | 113 | bool AccessControl::checkPermission(const CallingContext& source, const char *perm, const char *interface) { |
Yi Kong | 00892ee | 2018-07-31 16:50:28 -0700 | [diff] [blame] | 114 | char *targetContext = nullptr; |
Martijn Coenen | 7ce83be | 2017-04-07 16:19:32 -0700 | [diff] [blame] | 115 | bool allowed = false; |
| 116 | |
| 117 | // Lookup service in hwservice_contexts |
| 118 | if (selabel_lookup(mSeHandle, &targetContext, interface, 0) != 0) { |
| 119 | ALOGE("No match for interface %s in hwservice_contexts", interface); |
| 120 | return false; |
| 121 | } |
| 122 | |
Steven Moreland | 7185a89 | 2019-01-09 18:00:05 -0800 | [diff] [blame] | 123 | allowed = checkPermission(source, targetContext, perm, interface); |
Martijn Coenen | 7ce83be | 2017-04-07 16:19:32 -0700 | [diff] [blame] | 124 | |
| 125 | freecon(targetContext); |
| 126 | |
| 127 | return allowed; |
| 128 | } |
| 129 | |
| 130 | int AccessControl::auditCallback(void *data, security_class_t /*cls*/, char *buf, size_t len) { |
| 131 | struct audit_data *ad = (struct audit_data *)data; |
| 132 | |
| 133 | if (!ad || !ad->interfaceName) { |
| 134 | ALOGE("No valid hwservicemanager audit data"); |
| 135 | return 0; |
| 136 | } |
| 137 | |
Steven Moreland | 7185a89 | 2019-01-09 18:00:05 -0800 | [diff] [blame] | 138 | const char* sid = ad->sid ? ad->sid : "N/A"; |
| 139 | |
| 140 | snprintf(buf, len, "interface=%s sid=%s pid=%d", ad->interfaceName, sid, ad->pid); |
Martijn Coenen | 7ce83be | 2017-04-07 16:19:32 -0700 | [diff] [blame] | 141 | return 0; |
| 142 | } |
| 143 | |
| 144 | } // namespace android |