1 /* 2 * Copyright (C) 2007 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #include <stdio.h> 18 #include <stdlib.h> 19 #include <unistd.h> 20 #include <string.h> 21 #include <ctype.h> 22 #include <fcntl.h> 23 #include <stdarg.h> 24 #include <dirent.h> 25 #include <limits.h> 26 #include <errno.h> 27 #include <sys/poll.h> 28 29 #include <memory> 30 31 #include <cutils/misc.h> 32 #include <cutils/sockets.h> 33 #include <cutils/multiuser.h> 34 35 #define _REALLY_INCLUDE_SYS__SYSTEM_PROPERTIES_H_ 36 #include <sys/_system_properties.h> 37 38 #include <sys/socket.h> 39 #include <sys/un.h> 40 #include <sys/select.h> 41 #include <sys/types.h> 42 #include <netinet/in.h> 43 #include <sys/mman.h> 44 #include <private/android_filesystem_config.h> 45 46 #include <selinux/selinux.h> 47 #include <selinux/label.h> 48 49 #include <fs_mgr.h> 50 #include <base/file.h> 51 #include "bootimg.h" 52 53 #include "property_service.h" 54 #include "init.h" 55 #include "util.h" 56 #include "log.h" 57 58 #define PERSISTENT_PROPERTY_DIR "/data/property" 59 #define FSTAB_PREFIX "/fstab." 60 #define RECOVERY_MOUNT_POINT "/recovery" 61 62 static int persistent_properties_loaded = 0; 63 static bool property_area_initialized = false; 64 65 static int property_set_fd = -1; 66 67 struct workspace { 68 size_t size; 69 int fd; 70 }; 71 72 static workspace pa_workspace; 73 74 void property_init() { 75 if (property_area_initialized) { 76 return; 77 } 78 79 property_area_initialized = true; 80 81 if (__system_property_area_init()) { 82 return; 83 } 84 85 pa_workspace.size = 0; 86 pa_workspace.fd = open(PROP_FILENAME, O_RDONLY | O_NOFOLLOW | O_CLOEXEC); 87 if (pa_workspace.fd == -1) { 88 ERROR("Failed to open %s: %s\n", PROP_FILENAME, strerror(errno)); 89 return; 90 } 91 } 92 93 static int check_mac_perms(const char *name, char *sctx) 94 { 95 if (is_selinux_enabled() <= 0) 96 return 1; 97 98 char *tctx = NULL; 99 int result = 0; 100 101 if (!sctx) 102 goto err; 103 104 if (!sehandle_prop) 105 goto err; 106 107 if (selabel_lookup(sehandle_prop, &tctx, name, 1) != 0) 108 goto err; 109 110 if (selinux_check_access(sctx, tctx, "property_service", "set", (void*) name) == 0) 111 result = 1; 112 113 freecon(tctx); 114 err: 115 return result; 116 } 117 118 static int check_control_mac_perms(const char *name, char *sctx) 119 { 120 /* 121 * Create a name prefix out of ctl.<service name> 122 * The new prefix allows the use of the existing 123 * property service backend labeling while avoiding 124 * mislabels based on true property prefixes. 125 */ 126 char ctl_name[PROP_VALUE_MAX+4]; 127 int ret = snprintf(ctl_name, sizeof(ctl_name), "ctl.%s", name); 128 129 if (ret < 0 || (size_t) ret >= sizeof(ctl_name)) 130 return 0; 131 132 return check_mac_perms(ctl_name, sctx); 133 } 134 135 /* 136 * Checks permissions for setting system properties. 137 * Returns 1 if uid allowed, 0 otherwise. 138 */ 139 static int check_perms(const char *name, char *sctx) 140 { 141 if(!strncmp(name, "ro.", 3)) 142 name +=3; 143 144 return check_mac_perms(name, sctx); 145 } 146 147 int __property_get(const char *name, char *value) 148 { 149 return __system_property_get(name, value); 150 } 151 152 static void write_persistent_property(const char *name, const char *value) 153 { 154 char tempPath[PATH_MAX]; 155 char path[PATH_MAX]; 156 int fd; 157 158 snprintf(tempPath, sizeof(tempPath), "%s/.temp.XXXXXX", PERSISTENT_PROPERTY_DIR); 159 fd = mkstemp(tempPath); 160 if (fd < 0) { 161 ERROR("Unable to write persistent property to temp file %s: %s\n", tempPath, strerror(errno)); 162 return; 163 } 164 write(fd, value, strlen(value)); 165 fsync(fd); 166 close(fd); 167 168 snprintf(path, sizeof(path), "%s/%s", PERSISTENT_PROPERTY_DIR, name); 169 if (rename(tempPath, path)) { 170 unlink(tempPath); 171 ERROR("Unable to rename persistent property file %s to %s\n", tempPath, path); 172 } 173 } 174 175 static bool is_legal_property_name(const char* name, size_t namelen) 176 { 177 size_t i; 178 if (namelen >= PROP_NAME_MAX) return false; 179 if (namelen < 1) return false; 180 if (name[0] == '.') return false; 181 if (name[namelen - 1] == '.') return false; 182 183 /* Only allow alphanumeric, plus '.', '-', or '_' */ 184 /* Don't allow ".." to appear in a property name */ 185 for (i = 0; i < namelen; i++) { 186 if (name[i] == '.') { 187 // i=0 is guaranteed to never have a dot. See above. 188 if (name[i-1] == '.') return false; 189 continue; 190 } 191 if (name[i] == '_' || name[i] == '-') continue; 192 if (name[i] >= 'a' && name[i] <= 'z') continue; 193 if (name[i] >= 'A' && name[i] <= 'Z') continue; 194 if (name[i] >= '0' && name[i] <= '9') continue; 195 return false; 196 } 197 198 return true; 199 } 200 201 static int property_set_impl(const char* name, const char* value) { 202 size_t namelen = strlen(name); 203 size_t valuelen = strlen(value); 204 205 if (!is_legal_property_name(name, namelen)) return -1; 206 if (valuelen >= PROP_VALUE_MAX) return -1; 207 208 if (strcmp("selinux.reload_policy", name) == 0 && strcmp("1", value) == 0) { 209 if (selinux_reload_policy() != 0) { 210 ERROR("Failed to reload policy\n"); 211 } 212 } else if (strcmp("selinux.restorecon_recursive", name) == 0 && valuelen > 0) { 213 if (restorecon_recursive(value) != 0) { 214 ERROR("Failed to restorecon_recursive %s\n", value); 215 } 216 } 217 218 prop_info* pi = (prop_info*) __system_property_find(name); 219 220 if(pi != 0) { 221 /* ro.* properties may NEVER be modified once set */ 222 if(!strncmp(name, "ro.", 3)) return -1; 223 224 __system_property_update(pi, value, valuelen); 225 } else { 226 int rc = __system_property_add(name, namelen, value, valuelen); 227 if (rc < 0) { 228 return rc; 229 } 230 } 231 /* If name starts with "net." treat as a DNS property. */ 232 if (strncmp("net.", name, strlen("net.")) == 0) { 233 if (strcmp("net.change", name) == 0) { 234 return 0; 235 } 236 /* 237 * The 'net.change' property is a special property used track when any 238 * 'net.*' property name is updated. It is _ONLY_ updated here. Its value 239 * contains the last updated 'net.*' property. 240 */ 241 property_set("net.change", name); 242 } else if (persistent_properties_loaded && 243 strncmp("persist.", name, strlen("persist.")) == 0) { 244 /* 245 * Don't write properties to disk until after we have read all default properties 246 * to prevent them from being overwritten by default values. 247 */ 248 write_persistent_property(name, value); 249 } 250 property_changed(name, value); 251 return 0; 252 } 253 254 int property_set(const char* name, const char* value) { 255 int rc = property_set_impl(name, value); 256 if (rc == -1) { 257 ERROR("property_set(\"%s\", \"%s\") failed\n", name, value); 258 } 259 return rc; 260 } 261 262 static void handle_property_set_fd() 263 { 264 prop_msg msg; 265 int s; 266 int r; 267 struct ucred cr; 268 struct sockaddr_un addr; 269 socklen_t addr_size = sizeof(addr); 270 socklen_t cr_size = sizeof(cr); 271 char * source_ctx = NULL; 272 struct pollfd ufds[1]; 273 const int timeout_ms = 2 * 1000; /* Default 2 sec timeout for caller to send property. */ 274 int nr; 275 276 if ((s = accept(property_set_fd, (struct sockaddr *) &addr, &addr_size)) < 0) { 277 return; 278 } 279 280 /* Check socket options here */ 281 if (getsockopt(s, SOL_SOCKET, SO_PEERCRED, &cr, &cr_size) < 0) { 282 close(s); 283 ERROR("Unable to receive socket options\n"); 284 return; 285 } 286 287 ufds[0].fd = s; 288 ufds[0].events = POLLIN; 289 ufds[0].revents = 0; 290 nr = TEMP_FAILURE_RETRY(poll(ufds, 1, timeout_ms)); 291 if (nr == 0) { 292 ERROR("sys_prop: timeout waiting for uid=%d to send property message.\n", cr.uid); 293 close(s); 294 return; 295 } else if (nr < 0) { 296 ERROR("sys_prop: error waiting for uid=%d to send property message: %s\n", cr.uid, strerror(errno)); 297 close(s); 298 return; 299 } 300 301 r = TEMP_FAILURE_RETRY(recv(s, &msg, sizeof(msg), MSG_DONTWAIT)); 302 if(r != sizeof(prop_msg)) { 303 ERROR("sys_prop: mis-match msg size received: %d expected: %zu: %s\n", 304 r, sizeof(prop_msg), strerror(errno)); 305 close(s); 306 return; 307 } 308 309 switch(msg.cmd) { 310 case PROP_MSG_SETPROP: 311 msg.name[PROP_NAME_MAX-1] = 0; 312 msg.value[PROP_VALUE_MAX-1] = 0; 313 314 if (!is_legal_property_name(msg.name, strlen(msg.name))) { 315 ERROR("sys_prop: illegal property name. Got: \"%s\"\n", msg.name); 316 close(s); 317 return; 318 } 319 320 getpeercon(s, &source_ctx); 321 322 if(memcmp(msg.name,"ctl.",4) == 0) { 323 // Keep the old close-socket-early behavior when handling 324 // ctl.* properties. 325 close(s); 326 if (check_control_mac_perms(msg.value, source_ctx)) { 327 handle_control_message((char*) msg.name + 4, (char*) msg.value); 328 } else { 329 ERROR("sys_prop: Unable to %s service ctl [%s] uid:%d gid:%d pid:%d\n", 330 msg.name + 4, msg.value, cr.uid, cr.gid, cr.pid); 331 } 332 } else { 333 if (check_perms(msg.name, source_ctx)) { 334 property_set((char*) msg.name, (char*) msg.value); 335 } else { 336 ERROR("sys_prop: permission denied uid:%d name:%s\n", 337 cr.uid, msg.name); 338 } 339 340 // Note: bionic's property client code assumes that the 341 // property server will not close the socket until *AFTER* 342 // the property is written to memory. 343 close(s); 344 } 345 freecon(source_ctx); 346 break; 347 348 default: 349 close(s); 350 break; 351 } 352 } 353 354 void get_property_workspace(int *fd, int *sz) 355 { 356 *fd = pa_workspace.fd; 357 *sz = pa_workspace.size; 358 } 359 360 static void load_properties_from_file(const char *, const char *); 361 362 /* 363 * Filter is used to decide which properties to load: NULL loads all keys, 364 * "ro.foo.*" is a prefix match, and "ro.foo.bar" is an exact match. 365 */ 366 static void load_properties(char *data, const char *filter) 367 { 368 char *key, *value, *eol, *sol, *tmp, *fn; 369 size_t flen = 0; 370 371 if (filter) { 372 flen = strlen(filter); 373 } 374 375 sol = data; 376 while ((eol = strchr(sol, '\n'))) { 377 key = sol; 378 *eol++ = 0; 379 sol = eol; 380 381 while (isspace(*key)) key++; 382 if (*key == '#') continue; 383 384 tmp = eol - 2; 385 while ((tmp > key) && isspace(*tmp)) *tmp-- = 0; 386 387 if (!strncmp(key, "import ", 7) && flen == 0) { 388 fn = key + 7; 389 while (isspace(*fn)) fn++; 390 391 key = strchr(fn, ' '); 392 if (key) { 393 *key++ = 0; 394 while (isspace(*key)) key++; 395 } 396 397 load_properties_from_file(fn, key); 398 399 } else { 400 value = strchr(key, '='); 401 if (!value) continue; 402 *value++ = 0; 403 404 tmp = value - 2; 405 while ((tmp > key) && isspace(*tmp)) *tmp-- = 0; 406 407 while (isspace(*value)) value++; 408 409 if (flen > 0) { 410 if (filter[flen - 1] == '*') { 411 if (strncmp(key, filter, flen - 1)) continue; 412 } else { 413 if (strcmp(key, filter)) continue; 414 } 415 } 416 417 property_set(key, value); 418 } 419 } 420 } 421 422 /* 423 * Filter is used to decide which properties to load: NULL loads all keys, 424 * "ro.foo.*" is a prefix match, and "ro.foo.bar" is an exact match. 425 */ 426 static void load_properties_from_file(const char* filename, const char* filter) { 427 Timer t; 428 std::string data; 429 if (read_file(filename, &data)) { 430 data.push_back('\n'); 431 load_properties(&data[0], filter); 432 } 433 NOTICE("(Loading properties from %s took %.2fs.)\n", filename, t.duration()); 434 } 435 436 static void load_persistent_properties() { 437 persistent_properties_loaded = 1; 438 439 std::unique_ptr<DIR, int(*)(DIR*)> dir(opendir(PERSISTENT_PROPERTY_DIR), closedir); 440 if (!dir) { 441 ERROR("Unable to open persistent property directory \"%s\": %s\n", 442 PERSISTENT_PROPERTY_DIR, strerror(errno)); 443 return; 444 } 445 446 struct dirent* entry; 447 while ((entry = readdir(dir.get())) != NULL) { 448 if (strncmp("persist.", entry->d_name, strlen("persist."))) { 449 continue; 450 } 451 if (entry->d_type != DT_REG) { 452 continue; 453 } 454 455 // Open the file and read the property value. 456 int fd = openat(dirfd(dir.get()), entry->d_name, O_RDONLY | O_NOFOLLOW); 457 if (fd == -1) { 458 ERROR("Unable to open persistent property file \"%s\": %s\n", 459 entry->d_name, strerror(errno)); 460 continue; 461 } 462 463 struct stat sb; 464 if (fstat(fd, &sb) == -1) { 465 ERROR("fstat on property file \"%s\" failed: %s\n", entry->d_name, strerror(errno)); 466 close(fd); 467 continue; 468 } 469 470 // File must not be accessible to others, be owned by root/root, and 471 // not be a hard link to any other file. 472 if (((sb.st_mode & (S_IRWXG | S_IRWXO)) != 0) || (sb.st_uid != 0) || (sb.st_gid != 0) || 473 (sb.st_nlink != 1)) { 474 ERROR("skipping insecure property file %s (uid=%u gid=%u nlink=%u mode=%o)\n", 475 entry->d_name, (unsigned int)sb.st_uid, (unsigned int)sb.st_gid, 476 (unsigned int)sb.st_nlink, sb.st_mode); 477 close(fd); 478 continue; 479 } 480 481 char value[PROP_VALUE_MAX]; 482 int length = read(fd, value, sizeof(value) - 1); 483 if (length >= 0) { 484 value[length] = 0; 485 property_set(entry->d_name, value); 486 } else { 487 ERROR("Unable to read persistent property file %s: %s\n", 488 entry->d_name, strerror(errno)); 489 } 490 close(fd); 491 } 492 } 493 494 void property_load_boot_defaults() { 495 load_properties_from_file(PROP_PATH_RAMDISK_DEFAULT, NULL); 496 } 497 498 bool properties_initialized() { 499 return property_area_initialized; 500 } 501 502 static void load_override_properties() { 503 if (ALLOW_LOCAL_PROP_OVERRIDE) { 504 char debuggable[PROP_VALUE_MAX]; 505 int ret = property_get("ro.debuggable", debuggable); 506 if (ret && (strcmp(debuggable, "1") == 0)) { 507 load_properties_from_file(PROP_PATH_LOCAL_OVERRIDE, NULL); 508 } 509 } 510 } 511 512 /* When booting an encrypted system, /data is not mounted when the 513 * property service is started, so any properties stored there are 514 * not loaded. Vold triggers init to load these properties once it 515 * has mounted /data. 516 */ 517 void load_persist_props(void) { 518 load_override_properties(); 519 /* Read persistent properties after all default values have been loaded. */ 520 load_persistent_properties(); 521 } 522 523 void load_recovery_id_prop() { 524 char fstab_filename[PROP_VALUE_MAX + sizeof(FSTAB_PREFIX)]; 525 char propbuf[PROP_VALUE_MAX]; 526 int ret = property_get("ro.hardware", propbuf); 527 if (!ret) { 528 ERROR("ro.hardware not set - unable to load recovery id\n"); 529 return; 530 } 531 snprintf(fstab_filename, sizeof(fstab_filename), FSTAB_PREFIX "%s", propbuf); 532 533 std::unique_ptr<fstab, void(*)(fstab*)> tab(fs_mgr_read_fstab(fstab_filename), 534 fs_mgr_free_fstab); 535 if (!tab) { 536 ERROR("unable to read fstab %s: %s\n", fstab_filename, strerror(errno)); 537 return; 538 } 539 540 fstab_rec* rec = fs_mgr_get_entry_for_mount_point(tab.get(), RECOVERY_MOUNT_POINT); 541 if (rec == NULL) { 542 ERROR("/recovery not specified in fstab\n"); 543 return; 544 } 545 546 int fd = open(rec->blk_device, O_RDONLY); 547 if (fd == -1) { 548 ERROR("error opening block device %s: %s\n", rec->blk_device, strerror(errno)); 549 return; 550 } 551 552 boot_img_hdr hdr; 553 if (android::base::ReadFully(fd, &hdr, sizeof(hdr))) { 554 std::string hex = bytes_to_hex(reinterpret_cast<uint8_t*>(hdr.id), sizeof(hdr.id)); 555 property_set("ro.recovery_id", hex.c_str()); 556 } else { 557 ERROR("error reading /recovery: %s\n", strerror(errno)); 558 } 559 560 close(fd); 561 } 562 563 void load_all_props() { 564 load_properties_from_file(PROP_PATH_SYSTEM_BUILD, NULL); 565 load_properties_from_file(PROP_PATH_VENDOR_BUILD, NULL); 566 load_properties_from_file(PROP_PATH_FACTORY, "ro.*"); 567 568 load_override_properties(); 569 570 /* Read persistent properties after all default values have been loaded. */ 571 load_persistent_properties(); 572 573 load_recovery_id_prop(); 574 } 575 576 void start_property_service() { 577 property_set_fd = create_socket(PROP_SERVICE_NAME, SOCK_STREAM | SOCK_CLOEXEC | SOCK_NONBLOCK, 578 0666, 0, 0, NULL); 579 if (property_set_fd == -1) { 580 ERROR("start_property_service socket creation failed: %s\n", strerror(errno)); 581 exit(1); 582 } 583 584 listen(property_set_fd, 8); 585 586 register_epoll_handler(property_set_fd, handle_property_set_fd); 587 } 588