0e5ad5a093
Currently there is no socket for daemon instances launched during the selinux phase of init. We don't create any sockets due to the complexity of the required sepolicy. This workaround will allow us to create the socket with very minimal sepolicy changes. init will launch a one-off instance of snapuserd in "proxy" mode, and then the following steps will occur: 1. The proxy daemon will be given two sockets, the "normal" socket that snapuserd clients would connect to, and a "proxy" socket. 2. The proxy daemon will listen on the proxy socket. 3. The first-stage daemon will wake up and connect to the proxy daemon as a client. 4. The proxy will send the normal socket via SCM_RIGHTS, then exit. 5. The first-stage daemon can now listen and accept on the normal socket. Ordering of these events is achieved through a snapuserd.proxy_ready property. Some special-casing was needed in init to make this work. The snapuserd socket owned by snapuserd_proxy is placed into a "persist" mode so it doesn't get deleted when snapuserd_proxy exits. There's also a special case method to create a Service object around a previously existing pid. Finally, first-stage init is technically on a different updateable partition than snapuserd. Thus, we add a way to query snapuserd to see if it supports socket handoff. If it does, we communicate this information through an environment variable to second-stage init. Bug: 193833730 Test: manual test Change-Id: I1950b31028980f0138bc03578cd455eb60ea4a58
96 lines
2.7 KiB
C++
96 lines
2.7 KiB
C++
/*
|
|
* Copyright (C) 2019 The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
#pragma once
|
|
|
|
#include <sys/resource.h>
|
|
#include <sys/types.h>
|
|
|
|
#include <optional>
|
|
#include <string>
|
|
#include <vector>
|
|
|
|
#include <android-base/unique_fd.h>
|
|
#include <cutils/iosched_policy.h>
|
|
|
|
#include "mount_namespace.h"
|
|
#include "result.h"
|
|
|
|
namespace android {
|
|
namespace init {
|
|
|
|
class Descriptor {
|
|
public:
|
|
Descriptor(const std::string& name, android::base::unique_fd fd)
|
|
: name_(name), fd_(std::move(fd)){};
|
|
|
|
// Publish() unsets FD_CLOEXEC from the FD and publishes its name via setenv(). It should be
|
|
// called when starting a service after fork() and before exec().
|
|
void Publish() const;
|
|
|
|
private:
|
|
std::string name_;
|
|
android::base::unique_fd fd_;
|
|
};
|
|
|
|
struct SocketDescriptor {
|
|
std::string name;
|
|
int type = 0;
|
|
uid_t uid = 0;
|
|
gid_t gid = 0;
|
|
int perm = 0;
|
|
std::string context;
|
|
bool passcred = false;
|
|
bool persist = false;
|
|
|
|
// Create() creates the named unix domain socket in /dev/socket and returns a Descriptor object.
|
|
// It should be called when starting a service, before calling fork(), such that the socket is
|
|
// synchronously created before starting any other services, which may depend on it.
|
|
Result<Descriptor> Create(const std::string& global_context) const;
|
|
};
|
|
|
|
struct FileDescriptor {
|
|
std::string name;
|
|
std::string type;
|
|
|
|
Result<Descriptor> Create() const;
|
|
};
|
|
|
|
struct NamespaceInfo {
|
|
int flags;
|
|
// Pair of namespace type, path to name.
|
|
std::vector<std::pair<int, std::string>> namespaces_to_enter;
|
|
};
|
|
Result<void> EnterNamespaces(const NamespaceInfo& info, const std::string& name,
|
|
std::optional<MountNamespace> override_mount_namespace);
|
|
|
|
struct ProcessAttributes {
|
|
std::string console;
|
|
IoSchedClass ioprio_class;
|
|
int ioprio_pri;
|
|
std::vector<std::pair<int, rlimit>> rlimits;
|
|
uid_t uid;
|
|
gid_t gid;
|
|
std::vector<gid_t> supp_gids;
|
|
int priority;
|
|
bool stdio_to_kmsg;
|
|
};
|
|
Result<void> SetProcessAttributes(const ProcessAttributes& attr);
|
|
|
|
Result<void> WritePidToFiles(std::vector<std::string>* files);
|
|
|
|
} // namespace init
|
|
} // namespace android
|