491e4da372
With compressed VAB updates, it is not possible to mount /system without first running snapuserd, which is the userspace component to the dm-user kernel module. This poses a problem because as soon as selinux enforcement is enabled, snapuserd (running in a kernel context) does not have access to read and decompress the underlying system partition. To account for this, we split SelinuxInitialize into multiple steps: First, sepolicy is read into an in-memory string. Second, the device-mapper tables for all snapshots are rebuilt. This flushes any pending reads and creates new dm-user devices. The original kernel-privileged snapuserd is then killed. Third, sepolicy is loaded from the in-memory string. Fourth, we re-launch snapuserd and connect it to the newly created dm-user devices. As part of this step we restorecon device-mapper devices and /dev/block/by-name/super, since the new snapuserd is in a limited context. Finally, we set enforcing mode. This sequence ensures that snapuserd has appropriate privileges with a minimal number of permissive audits. Bug: 173476209 Test: full OTA with VABC applies and boots Change-Id: Ie4e0f5166b01c31a6f337afc26fc58b96217604e
87 lines
2.7 KiB
C++
87 lines
2.7 KiB
C++
/*
|
|
* Copyright (C) 2020 The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
#pragma once
|
|
|
|
#include <sys/types.h>
|
|
|
|
#include <optional>
|
|
#include <string>
|
|
#include <vector>
|
|
|
|
#include <libsnapshot/snapshot.h>
|
|
|
|
#include "block_dev_initializer.h"
|
|
|
|
namespace android {
|
|
namespace init {
|
|
|
|
// Fork and exec a new copy of snapuserd.
|
|
void LaunchFirstStageSnapuserd();
|
|
|
|
class SnapuserdSelinuxHelper final {
|
|
using SnapshotManager = android::snapshot::SnapshotManager;
|
|
|
|
public:
|
|
SnapuserdSelinuxHelper(std::unique_ptr<SnapshotManager>&& sm, pid_t old_pid);
|
|
|
|
void StartTransition();
|
|
void FinishTransition();
|
|
|
|
// Return a helper for facilitating the selinux transition of snapuserd.
|
|
// If snapuserd is not in use, null is returned. StartTransition() should
|
|
// be called after reading policy. FinishTransition() should be called
|
|
// after loading policy. In between, no reads of /system or other dynamic
|
|
// partitions are possible.
|
|
static std::unique_ptr<SnapuserdSelinuxHelper> CreateIfNeeded();
|
|
|
|
private:
|
|
void RelaunchFirstStageSnapuserd();
|
|
void ExecSnapuserd();
|
|
|
|
std::unique_ptr<SnapshotManager> sm_;
|
|
BlockDevInitializer block_dev_init_;
|
|
pid_t old_pid_;
|
|
std::vector<std::string> argv_;
|
|
};
|
|
|
|
// Remove /dev/socket/snapuserd. This ensures that (1) the existing snapuserd
|
|
// will receive no new requests, and (2) the next copy we transition to can
|
|
// own the socket.
|
|
void CleanupSnapuserdSocket();
|
|
|
|
// Kill an instance of snapuserd given a pid.
|
|
void KillFirstStageSnapuserd(pid_t pid);
|
|
|
|
// Save an open fd to /system/bin (in the ramdisk) into an environment. This is
|
|
// used to later execveat() snapuserd.
|
|
void SaveRamdiskPathToSnapuserd();
|
|
|
|
// Returns true if first-stage snapuserd is running.
|
|
bool IsFirstStageSnapuserdRunning();
|
|
|
|
// Return the pid of the first-stage instances of snapuserd, if it was started.
|
|
std::optional<pid_t> GetSnapuserdFirstStagePid();
|
|
|
|
// Save an open fd to /system/bin (in the ramdisk) into an environment. This is
|
|
// used to later execveat() snapuserd.
|
|
void SaveRamdiskPathToSnapuserd();
|
|
|
|
// Returns true if first-stage snapuserd is running.
|
|
bool IsFirstStageSnapuserdRunning();
|
|
|
|
} // namespace init
|
|
} // namespace android
|