xref: /aosp_15_r20/system/logging/logd/LogPermissions.cpp (revision 598139dc91b21518d67c408eaea2644226490971)
1*598139dcSAndroid Build Coastguard Worker /*
2*598139dcSAndroid Build Coastguard Worker  * Copyright (C) 2012-2014 The Android Open Source Project
3*598139dcSAndroid Build Coastguard Worker  *
4*598139dcSAndroid Build Coastguard Worker  * Licensed under the Apache License, Version 2.0 (the "License");
5*598139dcSAndroid Build Coastguard Worker  * you may not use this file except in compliance with the License.
6*598139dcSAndroid Build Coastguard Worker  * You may obtain a copy of the License at
7*598139dcSAndroid Build Coastguard Worker  *
8*598139dcSAndroid Build Coastguard Worker  *      http://www.apache.org/licenses/LICENSE-2.0
9*598139dcSAndroid Build Coastguard Worker  *
10*598139dcSAndroid Build Coastguard Worker  * Unless required by applicable law or agreed to in writing, software
11*598139dcSAndroid Build Coastguard Worker  * distributed under the License is distributed on an "AS IS" BASIS,
12*598139dcSAndroid Build Coastguard Worker  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13*598139dcSAndroid Build Coastguard Worker  * See the License for the specific language governing permissions and
14*598139dcSAndroid Build Coastguard Worker  * limitations under the License.
15*598139dcSAndroid Build Coastguard Worker  */
16*598139dcSAndroid Build Coastguard Worker 
17*598139dcSAndroid Build Coastguard Worker #include "LogPermissions.h"
18*598139dcSAndroid Build Coastguard Worker 
19*598139dcSAndroid Build Coastguard Worker #include <errno.h>
20*598139dcSAndroid Build Coastguard Worker #include <stdio.h>
21*598139dcSAndroid Build Coastguard Worker #include <stdlib.h>
22*598139dcSAndroid Build Coastguard Worker #include <string.h>
23*598139dcSAndroid Build Coastguard Worker #include <sys/socket.h>
24*598139dcSAndroid Build Coastguard Worker 
25*598139dcSAndroid Build Coastguard Worker #include <vector>
26*598139dcSAndroid Build Coastguard Worker 
27*598139dcSAndroid Build Coastguard Worker #include <private/android_filesystem_config.h>
28*598139dcSAndroid Build Coastguard Worker 
checkGroup(char * buf,gid_t gidToCheck)29*598139dcSAndroid Build Coastguard Worker static bool checkGroup(char* buf, gid_t gidToCheck) {
30*598139dcSAndroid Build Coastguard Worker     char* ptr;
31*598139dcSAndroid Build Coastguard Worker     static const char ws[] = " \n";
32*598139dcSAndroid Build Coastguard Worker 
33*598139dcSAndroid Build Coastguard Worker     for (buf = strtok_r(buf, ws, &ptr); buf; buf = strtok_r(nullptr, ws, &ptr)) {
34*598139dcSAndroid Build Coastguard Worker         errno = 0;
35*598139dcSAndroid Build Coastguard Worker         gid_t Gid = strtol(buf, nullptr, 10);
36*598139dcSAndroid Build Coastguard Worker         if (errno != 0) {
37*598139dcSAndroid Build Coastguard Worker             return false;
38*598139dcSAndroid Build Coastguard Worker         }
39*598139dcSAndroid Build Coastguard Worker         if (Gid == gidToCheck) {
40*598139dcSAndroid Build Coastguard Worker             return true;
41*598139dcSAndroid Build Coastguard Worker         }
42*598139dcSAndroid Build Coastguard Worker     }
43*598139dcSAndroid Build Coastguard Worker     return false;
44*598139dcSAndroid Build Coastguard Worker }
45*598139dcSAndroid Build Coastguard Worker 
UserIsPrivileged(int id)46*598139dcSAndroid Build Coastguard Worker static bool UserIsPrivileged(int id) {
47*598139dcSAndroid Build Coastguard Worker     return id == AID_ROOT || id == AID_SYSTEM || id == AID_LOG;
48*598139dcSAndroid Build Coastguard Worker }
49*598139dcSAndroid Build Coastguard Worker 
50*598139dcSAndroid Build Coastguard Worker // gets a list of supplementary group IDs associated with
51*598139dcSAndroid Build Coastguard Worker // the socket peer.  This is implemented by opening
52*598139dcSAndroid Build Coastguard Worker // /proc/PID/status and look for the "Group:" line.
53*598139dcSAndroid Build Coastguard Worker //
54*598139dcSAndroid Build Coastguard Worker // This function introduces races especially since status
55*598139dcSAndroid Build Coastguard Worker // can change 'shape' while reading, the net result is err
56*598139dcSAndroid Build Coastguard Worker // on lack of permission.
checkSupplementaryGroup(uid_t uid,gid_t gid,pid_t pid,gid_t gidToCheck)57*598139dcSAndroid Build Coastguard Worker static bool checkSupplementaryGroup(uid_t uid, gid_t gid, pid_t pid, gid_t gidToCheck) {
58*598139dcSAndroid Build Coastguard Worker     char filename[256];
59*598139dcSAndroid Build Coastguard Worker     snprintf(filename, sizeof(filename), "/proc/%u/status", pid);
60*598139dcSAndroid Build Coastguard Worker 
61*598139dcSAndroid Build Coastguard Worker     bool ret;
62*598139dcSAndroid Build Coastguard Worker     bool foundGroup = false;
63*598139dcSAndroid Build Coastguard Worker     bool foundGid = false;
64*598139dcSAndroid Build Coastguard Worker     bool foundUid = false;
65*598139dcSAndroid Build Coastguard Worker 
66*598139dcSAndroid Build Coastguard Worker     //
67*598139dcSAndroid Build Coastguard Worker     // Reading /proc/<pid>/status is rife with race conditions. All of /proc
68*598139dcSAndroid Build Coastguard Worker     // suffers from this and its use should be minimized.
69*598139dcSAndroid Build Coastguard Worker     //
70*598139dcSAndroid Build Coastguard Worker     // Notably the content from one 4KB page to the next 4KB page can be from a
71*598139dcSAndroid Build Coastguard Worker     // change in shape even if we are gracious enough to attempt to read
72*598139dcSAndroid Build Coastguard Worker     // atomically. getline can not even guarantee a page read is not split up
73*598139dcSAndroid Build Coastguard Worker     // and in effect can read from different vintages of the content.
74*598139dcSAndroid Build Coastguard Worker     //
75*598139dcSAndroid Build Coastguard Worker     // We are finding out in the field that a 'logcat -c' via adb occasionally
76*598139dcSAndroid Build Coastguard Worker     // is returned with permission denied when we did only one pass and thus
77*598139dcSAndroid Build Coastguard Worker     // breaking scripts. For security we still err on denying access if in
78*598139dcSAndroid Build Coastguard Worker     // doubt, but we expect the falses  should be reduced significantly as
79*598139dcSAndroid Build Coastguard Worker     // three times is a charm.
80*598139dcSAndroid Build Coastguard Worker     //
81*598139dcSAndroid Build Coastguard Worker     for (int retry = 3; !(ret = foundGid && foundUid && foundGroup) && retry; --retry) {
82*598139dcSAndroid Build Coastguard Worker         FILE* file = fopen(filename, "re");
83*598139dcSAndroid Build Coastguard Worker         if (!file) {
84*598139dcSAndroid Build Coastguard Worker             continue;
85*598139dcSAndroid Build Coastguard Worker         }
86*598139dcSAndroid Build Coastguard Worker 
87*598139dcSAndroid Build Coastguard Worker         char* line = nullptr;
88*598139dcSAndroid Build Coastguard Worker         size_t len = 0;
89*598139dcSAndroid Build Coastguard Worker         while (getline(&line, &len, file) > 0) {
90*598139dcSAndroid Build Coastguard Worker             static const char groups_string[] = "Groups:\t";
91*598139dcSAndroid Build Coastguard Worker             static const char uid_string[] = "Uid:\t";
92*598139dcSAndroid Build Coastguard Worker             static const char gid_string[] = "Gid:\t";
93*598139dcSAndroid Build Coastguard Worker 
94*598139dcSAndroid Build Coastguard Worker             if (strncmp(groups_string, line, sizeof(groups_string) - 1) == 0) {
95*598139dcSAndroid Build Coastguard Worker                 if (checkGroup(line + sizeof(groups_string) - 1, gidToCheck)) {
96*598139dcSAndroid Build Coastguard Worker                     foundGroup = true;
97*598139dcSAndroid Build Coastguard Worker                 }
98*598139dcSAndroid Build Coastguard Worker             } else if (strncmp(uid_string, line, sizeof(uid_string) - 1) == 0) {
99*598139dcSAndroid Build Coastguard Worker                 uid_t u[4] = { (uid_t)-1, (uid_t)-1, (uid_t)-1, (uid_t)-1 };
100*598139dcSAndroid Build Coastguard Worker 
101*598139dcSAndroid Build Coastguard Worker                 sscanf(line + sizeof(uid_string) - 1, "%u\t%u\t%u\t%u", &u[0],
102*598139dcSAndroid Build Coastguard Worker                        &u[1], &u[2], &u[3]);
103*598139dcSAndroid Build Coastguard Worker 
104*598139dcSAndroid Build Coastguard Worker                 // Protect against PID reuse by checking that UID is the same
105*598139dcSAndroid Build Coastguard Worker                 if ((uid == u[0]) && (uid == u[1]) && (uid == u[2]) &&
106*598139dcSAndroid Build Coastguard Worker                     (uid == u[3])) {
107*598139dcSAndroid Build Coastguard Worker                     foundUid = true;
108*598139dcSAndroid Build Coastguard Worker                 }
109*598139dcSAndroid Build Coastguard Worker             } else if (strncmp(gid_string, line, sizeof(gid_string) - 1) == 0) {
110*598139dcSAndroid Build Coastguard Worker                 gid_t g[4] = { (gid_t)-1, (gid_t)-1, (gid_t)-1, (gid_t)-1 };
111*598139dcSAndroid Build Coastguard Worker 
112*598139dcSAndroid Build Coastguard Worker                 sscanf(line + sizeof(gid_string) - 1, "%u\t%u\t%u\t%u", &g[0],
113*598139dcSAndroid Build Coastguard Worker                        &g[1], &g[2], &g[3]);
114*598139dcSAndroid Build Coastguard Worker 
115*598139dcSAndroid Build Coastguard Worker                 // Protect against PID reuse by checking that GID is the same
116*598139dcSAndroid Build Coastguard Worker                 if ((gid == g[0]) && (gid == g[1]) && (gid == g[2]) &&
117*598139dcSAndroid Build Coastguard Worker                     (gid == g[3])) {
118*598139dcSAndroid Build Coastguard Worker                     foundGid = true;
119*598139dcSAndroid Build Coastguard Worker                 }
120*598139dcSAndroid Build Coastguard Worker             }
121*598139dcSAndroid Build Coastguard Worker         }
122*598139dcSAndroid Build Coastguard Worker         free(line);
123*598139dcSAndroid Build Coastguard Worker         fclose(file);
124*598139dcSAndroid Build Coastguard Worker     }
125*598139dcSAndroid Build Coastguard Worker 
126*598139dcSAndroid Build Coastguard Worker     return ret;
127*598139dcSAndroid Build Coastguard Worker }
128*598139dcSAndroid Build Coastguard Worker 
clientCanWriteSecurityLog(uid_t uid,gid_t gid,pid_t pid)129*598139dcSAndroid Build Coastguard Worker bool clientCanWriteSecurityLog(uid_t uid, gid_t gid, pid_t pid) {
130*598139dcSAndroid Build Coastguard Worker     if (UserIsPrivileged(uid) || UserIsPrivileged(gid)) {
131*598139dcSAndroid Build Coastguard Worker         return true;
132*598139dcSAndroid Build Coastguard Worker     }
133*598139dcSAndroid Build Coastguard Worker     return checkSupplementaryGroup(uid, gid, pid, AID_SECURITY_LOG_WRITER) ||
134*598139dcSAndroid Build Coastguard Worker            checkSupplementaryGroup(uid, gid, pid, AID_LOG);
135*598139dcSAndroid Build Coastguard Worker }
136*598139dcSAndroid Build Coastguard Worker 
clientHasLogCredentials(uid_t uid,gid_t gid,pid_t pid)137*598139dcSAndroid Build Coastguard Worker bool clientHasLogCredentials(uid_t uid, gid_t gid, pid_t pid) {
138*598139dcSAndroid Build Coastguard Worker     if (UserIsPrivileged(uid) || UserIsPrivileged(gid)) {
139*598139dcSAndroid Build Coastguard Worker         return true;
140*598139dcSAndroid Build Coastguard Worker     }
141*598139dcSAndroid Build Coastguard Worker     // FYI We will typically be here for 'adb logcat'
142*598139dcSAndroid Build Coastguard Worker     return checkSupplementaryGroup(uid, gid, pid, AID_LOG);
143*598139dcSAndroid Build Coastguard Worker }
144*598139dcSAndroid Build Coastguard Worker 
clientHasLogCredentials(SocketClient * cli)145*598139dcSAndroid Build Coastguard Worker bool clientHasLogCredentials(SocketClient* cli) {
146*598139dcSAndroid Build Coastguard Worker     if (UserIsPrivileged(cli->getUid()) || UserIsPrivileged(cli->getGid())) {
147*598139dcSAndroid Build Coastguard Worker         return true;
148*598139dcSAndroid Build Coastguard Worker     }
149*598139dcSAndroid Build Coastguard Worker 
150*598139dcSAndroid Build Coastguard Worker     // Kernel version 4.13 added SO_PEERGROUPS to return the supplemental groups of a peer socket,
151*598139dcSAndroid Build Coastguard Worker     // so try that first then fallback to the above racy checking of /proc/<pid>/status if the
152*598139dcSAndroid Build Coastguard Worker     // kernel is too old.  Per
153*598139dcSAndroid Build Coastguard Worker     // https://source.android.com/devices/architecture/kernel/android-common, the fallback can be
154*598139dcSAndroid Build Coastguard Worker     // removed no earlier than 2024.
155*598139dcSAndroid Build Coastguard Worker     auto supplemental_groups = std::vector<gid_t>(16, -1);
156*598139dcSAndroid Build Coastguard Worker     socklen_t groups_size = supplemental_groups.size() * sizeof(gid_t);
157*598139dcSAndroid Build Coastguard Worker 
158*598139dcSAndroid Build Coastguard Worker     int result = getsockopt(cli->getSocket(), SOL_SOCKET, SO_PEERGROUPS, supplemental_groups.data(),
159*598139dcSAndroid Build Coastguard Worker                             &groups_size);
160*598139dcSAndroid Build Coastguard Worker 
161*598139dcSAndroid Build Coastguard Worker     if (result != 0) {
162*598139dcSAndroid Build Coastguard Worker         if (errno != ERANGE) {
163*598139dcSAndroid Build Coastguard Worker             return clientHasLogCredentials(cli->getUid(), cli->getGid(), cli->getPid());
164*598139dcSAndroid Build Coastguard Worker         }
165*598139dcSAndroid Build Coastguard Worker 
166*598139dcSAndroid Build Coastguard Worker         supplemental_groups.resize(groups_size / sizeof(gid_t), -1);
167*598139dcSAndroid Build Coastguard Worker         result = getsockopt(cli->getSocket(), SOL_SOCKET, SO_PEERGROUPS, supplemental_groups.data(),
168*598139dcSAndroid Build Coastguard Worker                             &groups_size);
169*598139dcSAndroid Build Coastguard Worker 
170*598139dcSAndroid Build Coastguard Worker         // There is still some error after resizing supplemental_groups, fallback.
171*598139dcSAndroid Build Coastguard Worker         if (result != 0) {
172*598139dcSAndroid Build Coastguard Worker             return clientHasLogCredentials(cli->getUid(), cli->getGid(), cli->getPid());
173*598139dcSAndroid Build Coastguard Worker         }
174*598139dcSAndroid Build Coastguard Worker     }
175*598139dcSAndroid Build Coastguard Worker 
176*598139dcSAndroid Build Coastguard Worker     supplemental_groups.resize(groups_size / sizeof(gid_t), -1);
177*598139dcSAndroid Build Coastguard Worker     for (const auto& gid : supplemental_groups) {
178*598139dcSAndroid Build Coastguard Worker         if (UserIsPrivileged(gid)) {
179*598139dcSAndroid Build Coastguard Worker             return true;
180*598139dcSAndroid Build Coastguard Worker         }
181*598139dcSAndroid Build Coastguard Worker     }
182*598139dcSAndroid Build Coastguard Worker 
183*598139dcSAndroid Build Coastguard Worker     return false;
184*598139dcSAndroid Build Coastguard Worker }
185*598139dcSAndroid Build Coastguard Worker 
clientIsExemptedFromUserConsent(SocketClient * cli)186*598139dcSAndroid Build Coastguard Worker bool clientIsExemptedFromUserConsent(SocketClient* cli) {
187*598139dcSAndroid Build Coastguard Worker     return cli->getUid() < AID_APP_START;
188*598139dcSAndroid Build Coastguard Worker }
189