1 /* 2 * Copyright (C) 2017 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 /* 18 * Tool to create a directory with the right SELinux context applied, or 19 * apply the context if it's absent. Also fixes mode, uid, gid. 20 */ 21 22 #include <iostream> 23 #include <string> 24 #include <vector> 25 26 #include <dirent.h> 27 #include <stdio.h> 28 #include <stdlib.h> 29 #include <sys/stat.h> 30 #include <sys/types.h> 31 32 #include <android-base/logging.h> 33 #include <android-base/scopeguard.h> 34 35 #include <cutils/fs.h> 36 #include <selinux/android.h> 37 38 #include "Utils.h" 39 #include "android/os/IVold.h" 40 41 #include <private/android_filesystem_config.h> 42 43 static void usage(const char* progname) { 44 std::cerr << "Usage: " << progname << " [ prepare | destroy ] <volume_uuid> <user_id> <flags>" 45 << std::endl; 46 exit(-1); 47 } 48 49 static bool small_int(const std::string& s) { 50 return !s.empty() && s.size() < 7 && s.find_first_not_of("0123456789") == std::string::npos; 51 } 52 53 static bool valid_uuid(const std::string& s) { 54 return s.size() < 40 && s.find_first_not_of("0123456789abcdefABCDEF-_") == std::string::npos; 55 } 56 57 static bool prepare_dir(struct selabel_handle* sehandle, mode_t mode, uid_t uid, gid_t gid, 58 const std::string& path) { 59 auto clearfscreatecon = android::base::make_scope_guard([] { setfscreatecon(nullptr); }); 60 auto secontext = std::unique_ptr<char, void (*)(char*)>(nullptr, freecon); 61 char* tmp_secontext; 62 if (sehandle && selabel_lookup(sehandle, &tmp_secontext, path.c_str(), S_IFDIR) == 0) { 63 secontext.reset(tmp_secontext); 64 } 65 LOG(DEBUG) << "Setting up mode " << std::oct << mode << std::dec << " uid " << uid << " gid " 66 << gid << " context " << secontext.get() << " on path: " << path; 67 if (secontext) { 68 if (setfscreatecon(secontext.get()) != 0) { 69 PLOG(ERROR) << "Unable to read setfscreatecon for: " << path; 70 return false; 71 } 72 } 73 if (fs_prepare_dir(path.c_str(), mode, uid, gid) != 0) { 74 return false; 75 } 76 if (secontext) { 77 char* tmp_oldsecontext = nullptr; 78 if (lgetfilecon(path.c_str(), &tmp_oldsecontext) < 0) { 79 PLOG(ERROR) << "Unable to read secontext for: " << path; 80 return false; 81 } 82 auto oldsecontext = std::unique_ptr<char, void (*)(char*)>(tmp_oldsecontext, freecon); 83 if (strcmp(secontext.get(), oldsecontext.get()) != 0) { 84 LOG(INFO) << "Relabelling from " << ((char*)oldsecontext.get()) << " to " 85 << ((char*)secontext.get()) << ": " << path; 86 if (lsetfilecon(path.c_str(), secontext.get()) != 0) { 87 PLOG(ERROR) << "Relabelling failed for: " << path; 88 return false; 89 } 90 } 91 } 92 return true; 93 } 94 95 static bool rmrf_contents(const std::string& path) { 96 auto dirp = std::unique_ptr<DIR, int (*)(DIR*)>(opendir(path.c_str()), closedir); 97 if (!dirp) { 98 PLOG(ERROR) << "Unable to open directory: " << path; 99 return false; 100 } 101 bool res = true; 102 for (;;) { 103 errno = 0; 104 auto const entry = readdir(dirp.get()); 105 if (!entry) { 106 if (errno) { 107 PLOG(ERROR) << "readdir failed on: " << path; 108 return false; 109 } 110 return res; 111 } 112 if (entry->d_name[0] == '.') continue; 113 auto subdir = path + "/" + entry->d_name; 114 if (0 != 115 android::vold::ForkExecvp(std::vector<std::string>{"/system/bin/rm", "-rf", subdir})) { 116 LOG(ERROR) << "rm -rf failed on " << subdir; 117 res = false; 118 } 119 } 120 } 121 122 static bool prepare_subdirs(const std::string& volume_uuid, int user_id, int flags) { 123 struct selabel_handle* sehandle = selinux_android_file_context_handle(); 124 125 if (volume_uuid.empty()) { 126 if (flags & android::os::IVold::STORAGE_FLAG_DE) { 127 auto misc_de_path = android::vold::BuildDataMiscDePath(user_id); 128 if (!prepare_dir(sehandle, 0700, 0, 0, misc_de_path + "/vold")) return false; 129 if (!prepare_dir(sehandle, 0700, 0, 0, misc_de_path + "/storaged")) return false; 130 131 auto vendor_de_path = android::vold::BuildDataVendorDePath(user_id); 132 if (!prepare_dir(sehandle, 0700, AID_SYSTEM, AID_SYSTEM, vendor_de_path + "/fpdata")) { 133 return false; 134 } 135 } 136 if (flags & android::os::IVold::STORAGE_FLAG_CE) { 137 auto misc_ce_path = android::vold::BuildDataMiscCePath(user_id); 138 if (!prepare_dir(sehandle, 0700, 0, 0, misc_ce_path + "/vold")) return false; 139 if (!prepare_dir(sehandle, 0700, 0, 0, misc_ce_path + "/storaged")) return false; 140 } 141 } 142 return true; 143 } 144 145 static bool destroy_subdirs(const std::string& volume_uuid, int user_id, int flags) { 146 bool res = true; 147 if (volume_uuid.empty()) { 148 if (flags & android::os::IVold::STORAGE_FLAG_CE) { 149 auto misc_ce_path = android::vold::BuildDataMiscCePath(user_id); 150 res &= rmrf_contents(misc_ce_path); 151 152 auto vendor_ce_path = android::vold::BuildDataVendorCePath(user_id); 153 res &= rmrf_contents(vendor_ce_path); 154 } 155 if (flags & android::os::IVold::STORAGE_FLAG_DE) { 156 auto misc_de_path = android::vold::BuildDataMiscDePath(user_id); 157 res &= rmrf_contents(misc_de_path); 158 159 auto vendor_de_path = android::vold::BuildDataVendorDePath(user_id); 160 res &= rmrf_contents(vendor_de_path); 161 } 162 } 163 return res; 164 } 165 166 int main(int argc, const char* const argv[]) { 167 android::base::InitLogging(const_cast<char**>(argv)); 168 std::vector<std::string> args(argv + 1, argv + argc); 169 170 if (args.size() != 4 || !valid_uuid(args[1]) || !small_int(args[2]) || !small_int(args[3])) { 171 usage(argv[0]); 172 return -1; 173 } 174 175 auto volume_uuid = args[1]; 176 int user_id = stoi(args[2]); 177 int flags = stoi(args[3]); 178 if (args[0] == "prepare") { 179 if (!prepare_subdirs(volume_uuid, user_id, flags)) return -1; 180 } else if (args[0] == "destroy") { 181 if (!destroy_subdirs(volume_uuid, user_id, flags)) return -1; 182 } else { 183 usage(argv[0]); 184 return -1; 185 } 186 return 0; 187 } 188
