1 /* 2 * Copyright (C) 2014 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 // This module creates a special filesystem containing two files. 18 // 19 // "/sideload/package.zip" appears to be a normal file, but reading 20 // from it causes data to be fetched from the adb host. We can use 21 // this to sideload packages over an adb connection without having to 22 // store the entire package in RAM on the device. 23 // 24 // Because we may not trust the adb host, this filesystem maintains 25 // the following invariant: each read of a given position returns the 26 // same data as the first read at that position. That is, once a 27 // section of the file is read, future reads of that section return 28 // the same data. (Otherwise, a malicious adb host process could 29 // return one set of bits when the package is read for signature 30 // verification, and then different bits for when the package is 31 // accessed by the installer.) If the adb host returns something 32 // different than it did on the first read, the reader of the file 33 // will see their read fail with EINVAL. 34 // 35 // The other file, "/sideload/exit", is used to control the subprocess 36 // that creates this filesystem. Calling stat() on the exit file 37 // causes the filesystem to be unmounted and the adb process on the 38 // device shut down. 39 // 40 // Note that only the minimal set of file operations needed for these 41 // two files is implemented. In particular, you can't opendir() or 42 // readdir() on the "/sideload" directory; ls on it won't work. 43 44 #include <ctype.h> 45 #include <dirent.h> 46 #include <errno.h> 47 #include <fcntl.h> 48 #include <limits.h> 49 #include <linux/fuse.h> 50 #include <pthread.h> 51 #include <stdio.h> 52 #include <stdlib.h> 53 #include <string.h> 54 #include <sys/inotify.h> 55 #include <sys/mount.h> 56 #include <sys/param.h> 57 #include <sys/resource.h> 58 #include <sys/stat.h> 59 #include <sys/statfs.h> 60 #include <sys/time.h> 61 #include <sys/uio.h> 62 #include <unistd.h> 63 64 #include "mincrypt/sha256.h" 65 #include "fuse_sideload.h" 66 67 #define PACKAGE_FILE_ID (FUSE_ROOT_ID+1) 68 #define EXIT_FLAG_ID (FUSE_ROOT_ID+2) 69 70 #define NO_STATUS 1 71 #define NO_STATUS_EXIT 2 72 73 struct fuse_data { 74 int ffd; // file descriptor for the fuse socket 75 76 struct provider_vtab* vtab; 77 void* cookie; 78 79 uint64_t file_size; // bytes 80 81 uint32_t block_size; // block size that the adb host is using to send the file to us 82 uint32_t file_blocks; // file size in block_size blocks 83 84 uid_t uid; 85 gid_t gid; 86 87 uint32_t curr_block; // cache the block most recently read from the host 88 uint8_t* block_data; 89 90 uint8_t* extra_block; // another block of storage for reads that 91 // span two blocks 92 93 uint8_t* hashes; // SHA-256 hash of each block (all zeros 94 // if block hasn't been read yet) 95 }; 96 97 static void fuse_reply(struct fuse_data* fd, __u64 unique, const void *data, size_t len) 98 { 99 struct fuse_out_header hdr; 100 struct iovec vec[2]; 101 int res; 102 103 hdr.len = len + sizeof(hdr); 104 hdr.error = 0; 105 hdr.unique = unique; 106 107 vec[0].iov_base = &hdr; 108 vec[0].iov_len = sizeof(hdr); 109 vec[1].iov_base = /* const_cast */(void*)(data); 110 vec[1].iov_len = len; 111 112 res = writev(fd->ffd, vec, 2); 113 if (res < 0) { 114 printf("*** REPLY FAILED *** %s\n", strerror(errno)); 115 } 116 } 117 118 static int handle_init(void* data, struct fuse_data* fd, const struct fuse_in_header* hdr) { 119 const struct fuse_init_in* req = data; 120 struct fuse_init_out out; 121 size_t fuse_struct_size; 122 123 124 /* Kernel 2.6.16 is the first stable kernel with struct fuse_init_out 125 * defined (fuse version 7.6). The structure is the same from 7.6 through 126 * 7.22. Beginning with 7.23, the structure increased in size and added 127 * new parameters. 128 */ 129 if (req->major != FUSE_KERNEL_VERSION || req->minor < 6) { 130 printf("Fuse kernel version mismatch: Kernel version %d.%d, Expected at least %d.6", 131 req->major, req->minor, FUSE_KERNEL_VERSION); 132 return -1; 133 } 134 135 out.minor = MIN(req->minor, FUSE_KERNEL_MINOR_VERSION); 136 fuse_struct_size = sizeof(out); 137 #if defined(FUSE_COMPAT_22_INIT_OUT_SIZE) 138 /* FUSE_KERNEL_VERSION >= 23. */ 139 140 /* If the kernel only works on minor revs older than or equal to 22, 141 * then use the older structure size since this code only uses the 7.22 142 * version of the structure. */ 143 if (req->minor <= 22) { 144 fuse_struct_size = FUSE_COMPAT_22_INIT_OUT_SIZE; 145 } 146 #endif 147 148 out.major = FUSE_KERNEL_VERSION; 149 out.max_readahead = req->max_readahead; 150 out.flags = 0; 151 out.max_background = 32; 152 out.congestion_threshold = 32; 153 out.max_write = 4096; 154 fuse_reply(fd, hdr->unique, &out, fuse_struct_size); 155 156 return NO_STATUS; 157 } 158 159 static void fill_attr(struct fuse_attr* attr, struct fuse_data* fd, 160 uint64_t nodeid, uint64_t size, uint32_t mode) { 161 memset(attr, 0, sizeof(*attr)); 162 attr->nlink = 1; 163 attr->uid = fd->uid; 164 attr->gid = fd->gid; 165 attr->blksize = 4096; 166 167 attr->ino = nodeid; 168 attr->size = size; 169 attr->blocks = (size == 0) ? 0 : (((size-1) / attr->blksize) + 1); 170 attr->mode = mode; 171 } 172 173 static int handle_getattr(void* data, struct fuse_data* fd, const struct fuse_in_header* hdr) { 174 const struct fuse_getattr_in* req = data; 175 struct fuse_attr_out out; 176 memset(&out, 0, sizeof(out)); 177 out.attr_valid = 10; 178 179 if (hdr->nodeid == FUSE_ROOT_ID) { 180 fill_attr(&(out.attr), fd, hdr->nodeid, 4096, S_IFDIR | 0555); 181 } else if (hdr->nodeid == PACKAGE_FILE_ID) { 182 fill_attr(&(out.attr), fd, PACKAGE_FILE_ID, fd->file_size, S_IFREG | 0444); 183 } else if (hdr->nodeid == EXIT_FLAG_ID) { 184 fill_attr(&(out.attr), fd, EXIT_FLAG_ID, 0, S_IFREG | 0); 185 } else { 186 return -ENOENT; 187 } 188 189 fuse_reply(fd, hdr->unique, &out, sizeof(out)); 190 return (hdr->nodeid == EXIT_FLAG_ID) ? NO_STATUS_EXIT : NO_STATUS; 191 } 192 193 static int handle_lookup(void* data, struct fuse_data* fd, 194 const struct fuse_in_header* hdr) { 195 struct fuse_entry_out out; 196 memset(&out, 0, sizeof(out)); 197 out.entry_valid = 10; 198 out.attr_valid = 10; 199 200 if (strncmp(FUSE_SIDELOAD_HOST_FILENAME, data, 201 sizeof(FUSE_SIDELOAD_HOST_FILENAME)) == 0) { 202 out.nodeid = PACKAGE_FILE_ID; 203 out.generation = PACKAGE_FILE_ID; 204 fill_attr(&(out.attr), fd, PACKAGE_FILE_ID, fd->file_size, S_IFREG | 0444); 205 } else if (strncmp(FUSE_SIDELOAD_HOST_EXIT_FLAG, data, 206 sizeof(FUSE_SIDELOAD_HOST_EXIT_FLAG)) == 0) { 207 out.nodeid = EXIT_FLAG_ID; 208 out.generation = EXIT_FLAG_ID; 209 fill_attr(&(out.attr), fd, EXIT_FLAG_ID, 0, S_IFREG | 0); 210 } else { 211 return -ENOENT; 212 } 213 214 fuse_reply(fd, hdr->unique, &out, sizeof(out)); 215 return (out.nodeid == EXIT_FLAG_ID) ? NO_STATUS_EXIT : NO_STATUS; 216 } 217 218 static int handle_open(void* data, struct fuse_data* fd, const struct fuse_in_header* hdr) { 219 const struct fuse_open_in* req = data; 220 221 if (hdr->nodeid == EXIT_FLAG_ID) return -EPERM; 222 if (hdr->nodeid != PACKAGE_FILE_ID) return -ENOENT; 223 224 struct fuse_open_out out; 225 memset(&out, 0, sizeof(out)); 226 out.fh = 10; // an arbitrary number; we always use the same handle 227 fuse_reply(fd, hdr->unique, &out, sizeof(out)); 228 return NO_STATUS; 229 } 230 231 static int handle_flush(void* data, struct fuse_data* fd, const struct fuse_in_header* hdr) { 232 return 0; 233 } 234 235 static int handle_release(void* data, struct fuse_data* fd, const struct fuse_in_header* hdr) { 236 return 0; 237 } 238 239 // Fetch a block from the host into fd->curr_block and fd->block_data. 240 // Returns 0 on successful fetch, negative otherwise. 241 static int fetch_block(struct fuse_data* fd, uint32_t block) { 242 if (block == fd->curr_block) { 243 return 0; 244 } 245 246 if (block >= fd->file_blocks) { 247 memset(fd->block_data, 0, fd->block_size); 248 fd->curr_block = block; 249 return 0; 250 } 251 252 size_t fetch_size = fd->block_size; 253 if (block * fd->block_size + fetch_size > fd->file_size) { 254 // If we're reading the last (partial) block of the file, 255 // expect a shorter response from the host, and pad the rest 256 // of the block with zeroes. 257 fetch_size = fd->file_size - (block * fd->block_size); 258 memset(fd->block_data + fetch_size, 0, fd->block_size - fetch_size); 259 } 260 261 int result = fd->vtab->read_block(fd->cookie, block, fd->block_data, fetch_size); 262 if (result < 0) return result; 263 264 fd->curr_block = block; 265 266 // Verify the hash of the block we just got from the host. 267 // 268 // - If the hash of the just-received data matches the stored hash 269 // for the block, accept it. 270 // - If the stored hash is all zeroes, store the new hash and 271 // accept the block (this is the first time we've read this 272 // block). 273 // - Otherwise, return -EINVAL for the read. 274 275 uint8_t hash[SHA256_DIGEST_SIZE]; 276 SHA256_hash(fd->block_data, fd->block_size, hash); 277 uint8_t* blockhash = fd->hashes + block * SHA256_DIGEST_SIZE; 278 if (memcmp(hash, blockhash, SHA256_DIGEST_SIZE) == 0) { 279 return 0; 280 } 281 282 int i; 283 for (i = 0; i < SHA256_DIGEST_SIZE; ++i) { 284 if (blockhash[i] != 0) { 285 fd->curr_block = -1; 286 return -EIO; 287 } 288 } 289 290 memcpy(blockhash, hash, SHA256_DIGEST_SIZE); 291 return 0; 292 } 293 294 static int handle_read(void* data, struct fuse_data* fd, const struct fuse_in_header* hdr) { 295 const struct fuse_read_in* req = data; 296 struct fuse_out_header outhdr; 297 struct iovec vec[3]; 298 int vec_used; 299 int result; 300 301 if (hdr->nodeid != PACKAGE_FILE_ID) return -ENOENT; 302 303 uint64_t offset = req->offset; 304 uint32_t size = req->size; 305 306 // The docs on the fuse kernel interface are vague about what to 307 // do when a read request extends past the end of the file. We 308 // can return a short read -- the return structure does include a 309 // length field -- but in testing that caused the program using 310 // the file to segfault. (I speculate that this is due to the 311 // reading program accessing it via mmap; maybe mmap dislikes when 312 // you return something short of a whole page?) To fix this we 313 // zero-pad reads that extend past the end of the file so we're 314 // always returning exactly as many bytes as were requested. 315 // (Users of the mapped file have to know its real length anyway.) 316 317 outhdr.len = sizeof(outhdr) + size; 318 outhdr.error = 0; 319 outhdr.unique = hdr->unique; 320 vec[0].iov_base = &outhdr; 321 vec[0].iov_len = sizeof(outhdr); 322 323 uint32_t block = offset / fd->block_size; 324 result = fetch_block(fd, block); 325 if (result != 0) return result; 326 327 // Two cases: 328 // 329 // - the read request is entirely within this block. In this 330 // case we can reply immediately. 331 // 332 // - the read request goes over into the next block. Note that 333 // since we mount the filesystem with max_read=block_size, a 334 // read can never span more than two blocks. In this case we 335 // copy the block to extra_block and issue a fetch for the 336 // following block. 337 338 uint32_t block_offset = offset - (block * fd->block_size); 339 340 if (size + block_offset <= fd->block_size) { 341 // First case: the read fits entirely in the first block. 342 343 vec[1].iov_base = fd->block_data + block_offset; 344 vec[1].iov_len = size; 345 vec_used = 2; 346 } else { 347 // Second case: the read spills over into the next block. 348 349 memcpy(fd->extra_block, fd->block_data + block_offset, 350 fd->block_size - block_offset); 351 vec[1].iov_base = fd->extra_block; 352 vec[1].iov_len = fd->block_size - block_offset; 353 354 result = fetch_block(fd, block+1); 355 if (result != 0) return result; 356 vec[2].iov_base = fd->block_data; 357 vec[2].iov_len = size - vec[1].iov_len; 358 vec_used = 3; 359 } 360 361 if (writev(fd->ffd, vec, vec_used) < 0) { 362 printf("*** READ REPLY FAILED: %s ***\n", strerror(errno)); 363 } 364 return NO_STATUS; 365 } 366 367 int run_fuse_sideload(struct provider_vtab* vtab, void* cookie, 368 uint64_t file_size, uint32_t block_size) 369 { 370 int result; 371 372 // If something's already mounted on our mountpoint, try to remove 373 // it. (Mostly in case of a previous abnormal exit.) 374 umount2(FUSE_SIDELOAD_HOST_MOUNTPOINT, MNT_FORCE); 375 376 if (block_size < 1024) { 377 fprintf(stderr, "block size (%u) is too small\n", block_size); 378 return -1; 379 } 380 if (block_size > (1<<22)) { // 4 MiB 381 fprintf(stderr, "block size (%u) is too large\n", block_size); 382 return -1; 383 } 384 385 struct fuse_data fd; 386 memset(&fd, 0, sizeof(fd)); 387 fd.vtab = vtab; 388 fd.cookie = cookie; 389 fd.file_size = file_size; 390 fd.block_size = block_size; 391 fd.file_blocks = (file_size == 0) ? 0 : (((file_size-1) / block_size) + 1); 392 393 if (fd.file_blocks > (1<<18)) { 394 fprintf(stderr, "file has too many blocks (%u)\n", fd.file_blocks); 395 result = -1; 396 goto done; 397 } 398 399 fd.hashes = (uint8_t*)calloc(fd.file_blocks, SHA256_DIGEST_SIZE); 400 if (fd.hashes == NULL) { 401 fprintf(stderr, "failed to allocate %d bites for hashes\n", 402 fd.file_blocks * SHA256_DIGEST_SIZE); 403 result = -1; 404 goto done; 405 } 406 407 fd.uid = getuid(); 408 fd.gid = getgid(); 409 410 fd.curr_block = -1; 411 fd.block_data = (uint8_t*)malloc(block_size); 412 if (fd.block_data == NULL) { 413 fprintf(stderr, "failed to allocate %d bites for block_data\n", block_size); 414 result = -1; 415 goto done; 416 } 417 fd.extra_block = (uint8_t*)malloc(block_size); 418 if (fd.extra_block == NULL) { 419 fprintf(stderr, "failed to allocate %d bites for extra_block\n", block_size); 420 result = -1; 421 goto done; 422 } 423 424 fd.ffd = open("/dev/fuse", O_RDWR); 425 if (fd.ffd < 0) { 426 perror("open /dev/fuse"); 427 result = -1; 428 goto done; 429 } 430 431 char opts[256]; 432 snprintf(opts, sizeof(opts), 433 ("fd=%d,user_id=%d,group_id=%d,max_read=%u," 434 "allow_other,rootmode=040000"), 435 fd.ffd, fd.uid, fd.gid, block_size); 436 437 result = mount("/dev/fuse", FUSE_SIDELOAD_HOST_MOUNTPOINT, 438 "fuse", MS_NOSUID | MS_NODEV | MS_RDONLY | MS_NOEXEC, opts); 439 if (result < 0) { 440 perror("mount"); 441 goto done; 442 } 443 uint8_t request_buffer[sizeof(struct fuse_in_header) + PATH_MAX*8]; 444 for (;;) { 445 ssize_t len = TEMP_FAILURE_RETRY(read(fd.ffd, request_buffer, sizeof(request_buffer))); 446 if (len == -1) { 447 perror("read request"); 448 if (errno == ENODEV) { 449 result = -1; 450 break; 451 } 452 continue; 453 } 454 455 if ((size_t)len < sizeof(struct fuse_in_header)) { 456 fprintf(stderr, "request too short: len=%zu\n", (size_t)len); 457 continue; 458 } 459 460 struct fuse_in_header* hdr = (struct fuse_in_header*) request_buffer; 461 void* data = request_buffer + sizeof(struct fuse_in_header); 462 463 result = -ENOSYS; 464 465 switch (hdr->opcode) { 466 case FUSE_INIT: 467 result = handle_init(data, &fd, hdr); 468 break; 469 470 case FUSE_LOOKUP: 471 result = handle_lookup(data, &fd, hdr); 472 break; 473 474 case FUSE_GETATTR: 475 result = handle_getattr(data, &fd, hdr); 476 break; 477 478 case FUSE_OPEN: 479 result = handle_open(data, &fd, hdr); 480 break; 481 482 case FUSE_READ: 483 result = handle_read(data, &fd, hdr); 484 break; 485 486 case FUSE_FLUSH: 487 result = handle_flush(data, &fd, hdr); 488 break; 489 490 case FUSE_RELEASE: 491 result = handle_release(data, &fd, hdr); 492 break; 493 494 default: 495 fprintf(stderr, "unknown fuse request opcode %d\n", hdr->opcode); 496 break; 497 } 498 499 if (result == NO_STATUS_EXIT) { 500 result = 0; 501 break; 502 } 503 504 if (result != NO_STATUS) { 505 struct fuse_out_header outhdr; 506 outhdr.len = sizeof(outhdr); 507 outhdr.error = result; 508 outhdr.unique = hdr->unique; 509 TEMP_FAILURE_RETRY(write(fd.ffd, &outhdr, sizeof(outhdr))); 510 } 511 } 512 513 done: 514 fd.vtab->close(fd.cookie); 515 516 result = umount2(FUSE_SIDELOAD_HOST_MOUNTPOINT, MNT_DETACH); 517 if (result < 0) { 518 printf("fuse_sideload umount failed: %s\n", strerror(errno)); 519 } 520 521 if (fd.ffd) close(fd.ffd); 522 free(fd.hashes); 523 free(fd.block_data); 524 free(fd.extra_block); 525 526 return result; 527 } 528