1*598139dcSAndroid Build Coastguard Worker /*
2*598139dcSAndroid Build Coastguard Worker * Copyright (C) 2012-2014 The Android Open Source Project
3*598139dcSAndroid Build Coastguard Worker *
4*598139dcSAndroid Build Coastguard Worker * Licensed under the Apache License, Version 2.0 (the "License");
5*598139dcSAndroid Build Coastguard Worker * you may not use this file except in compliance with the License.
6*598139dcSAndroid Build Coastguard Worker * You may obtain a copy of the License at
7*598139dcSAndroid Build Coastguard Worker *
8*598139dcSAndroid Build Coastguard Worker * http://www.apache.org/licenses/LICENSE-2.0
9*598139dcSAndroid Build Coastguard Worker *
10*598139dcSAndroid Build Coastguard Worker * Unless required by applicable law or agreed to in writing, software
11*598139dcSAndroid Build Coastguard Worker * distributed under the License is distributed on an "AS IS" BASIS,
12*598139dcSAndroid Build Coastguard Worker * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13*598139dcSAndroid Build Coastguard Worker * See the License for the specific language governing permissions and
14*598139dcSAndroid Build Coastguard Worker * limitations under the License.
15*598139dcSAndroid Build Coastguard Worker */
16*598139dcSAndroid Build Coastguard Worker
17*598139dcSAndroid Build Coastguard Worker #include "LogPermissions.h"
18*598139dcSAndroid Build Coastguard Worker
19*598139dcSAndroid Build Coastguard Worker #include <errno.h>
20*598139dcSAndroid Build Coastguard Worker #include <stdio.h>
21*598139dcSAndroid Build Coastguard Worker #include <stdlib.h>
22*598139dcSAndroid Build Coastguard Worker #include <string.h>
23*598139dcSAndroid Build Coastguard Worker #include <sys/socket.h>
24*598139dcSAndroid Build Coastguard Worker
25*598139dcSAndroid Build Coastguard Worker #include <vector>
26*598139dcSAndroid Build Coastguard Worker
27*598139dcSAndroid Build Coastguard Worker #include <private/android_filesystem_config.h>
28*598139dcSAndroid Build Coastguard Worker
checkGroup(char * buf,gid_t gidToCheck)29*598139dcSAndroid Build Coastguard Worker static bool checkGroup(char* buf, gid_t gidToCheck) {
30*598139dcSAndroid Build Coastguard Worker char* ptr;
31*598139dcSAndroid Build Coastguard Worker static const char ws[] = " \n";
32*598139dcSAndroid Build Coastguard Worker
33*598139dcSAndroid Build Coastguard Worker for (buf = strtok_r(buf, ws, &ptr); buf; buf = strtok_r(nullptr, ws, &ptr)) {
34*598139dcSAndroid Build Coastguard Worker errno = 0;
35*598139dcSAndroid Build Coastguard Worker gid_t Gid = strtol(buf, nullptr, 10);
36*598139dcSAndroid Build Coastguard Worker if (errno != 0) {
37*598139dcSAndroid Build Coastguard Worker return false;
38*598139dcSAndroid Build Coastguard Worker }
39*598139dcSAndroid Build Coastguard Worker if (Gid == gidToCheck) {
40*598139dcSAndroid Build Coastguard Worker return true;
41*598139dcSAndroid Build Coastguard Worker }
42*598139dcSAndroid Build Coastguard Worker }
43*598139dcSAndroid Build Coastguard Worker return false;
44*598139dcSAndroid Build Coastguard Worker }
45*598139dcSAndroid Build Coastguard Worker
UserIsPrivileged(int id)46*598139dcSAndroid Build Coastguard Worker static bool UserIsPrivileged(int id) {
47*598139dcSAndroid Build Coastguard Worker return id == AID_ROOT || id == AID_SYSTEM || id == AID_LOG;
48*598139dcSAndroid Build Coastguard Worker }
49*598139dcSAndroid Build Coastguard Worker
50*598139dcSAndroid Build Coastguard Worker // gets a list of supplementary group IDs associated with
51*598139dcSAndroid Build Coastguard Worker // the socket peer. This is implemented by opening
52*598139dcSAndroid Build Coastguard Worker // /proc/PID/status and look for the "Group:" line.
53*598139dcSAndroid Build Coastguard Worker //
54*598139dcSAndroid Build Coastguard Worker // This function introduces races especially since status
55*598139dcSAndroid Build Coastguard Worker // can change 'shape' while reading, the net result is err
56*598139dcSAndroid Build Coastguard Worker // on lack of permission.
checkSupplementaryGroup(uid_t uid,gid_t gid,pid_t pid,gid_t gidToCheck)57*598139dcSAndroid Build Coastguard Worker static bool checkSupplementaryGroup(uid_t uid, gid_t gid, pid_t pid, gid_t gidToCheck) {
58*598139dcSAndroid Build Coastguard Worker char filename[256];
59*598139dcSAndroid Build Coastguard Worker snprintf(filename, sizeof(filename), "/proc/%u/status", pid);
60*598139dcSAndroid Build Coastguard Worker
61*598139dcSAndroid Build Coastguard Worker bool ret;
62*598139dcSAndroid Build Coastguard Worker bool foundGroup = false;
63*598139dcSAndroid Build Coastguard Worker bool foundGid = false;
64*598139dcSAndroid Build Coastguard Worker bool foundUid = false;
65*598139dcSAndroid Build Coastguard Worker
66*598139dcSAndroid Build Coastguard Worker //
67*598139dcSAndroid Build Coastguard Worker // Reading /proc/<pid>/status is rife with race conditions. All of /proc
68*598139dcSAndroid Build Coastguard Worker // suffers from this and its use should be minimized.
69*598139dcSAndroid Build Coastguard Worker //
70*598139dcSAndroid Build Coastguard Worker // Notably the content from one 4KB page to the next 4KB page can be from a
71*598139dcSAndroid Build Coastguard Worker // change in shape even if we are gracious enough to attempt to read
72*598139dcSAndroid Build Coastguard Worker // atomically. getline can not even guarantee a page read is not split up
73*598139dcSAndroid Build Coastguard Worker // and in effect can read from different vintages of the content.
74*598139dcSAndroid Build Coastguard Worker //
75*598139dcSAndroid Build Coastguard Worker // We are finding out in the field that a 'logcat -c' via adb occasionally
76*598139dcSAndroid Build Coastguard Worker // is returned with permission denied when we did only one pass and thus
77*598139dcSAndroid Build Coastguard Worker // breaking scripts. For security we still err on denying access if in
78*598139dcSAndroid Build Coastguard Worker // doubt, but we expect the falses should be reduced significantly as
79*598139dcSAndroid Build Coastguard Worker // three times is a charm.
80*598139dcSAndroid Build Coastguard Worker //
81*598139dcSAndroid Build Coastguard Worker for (int retry = 3; !(ret = foundGid && foundUid && foundGroup) && retry; --retry) {
82*598139dcSAndroid Build Coastguard Worker FILE* file = fopen(filename, "re");
83*598139dcSAndroid Build Coastguard Worker if (!file) {
84*598139dcSAndroid Build Coastguard Worker continue;
85*598139dcSAndroid Build Coastguard Worker }
86*598139dcSAndroid Build Coastguard Worker
87*598139dcSAndroid Build Coastguard Worker char* line = nullptr;
88*598139dcSAndroid Build Coastguard Worker size_t len = 0;
89*598139dcSAndroid Build Coastguard Worker while (getline(&line, &len, file) > 0) {
90*598139dcSAndroid Build Coastguard Worker static const char groups_string[] = "Groups:\t";
91*598139dcSAndroid Build Coastguard Worker static const char uid_string[] = "Uid:\t";
92*598139dcSAndroid Build Coastguard Worker static const char gid_string[] = "Gid:\t";
93*598139dcSAndroid Build Coastguard Worker
94*598139dcSAndroid Build Coastguard Worker if (strncmp(groups_string, line, sizeof(groups_string) - 1) == 0) {
95*598139dcSAndroid Build Coastguard Worker if (checkGroup(line + sizeof(groups_string) - 1, gidToCheck)) {
96*598139dcSAndroid Build Coastguard Worker foundGroup = true;
97*598139dcSAndroid Build Coastguard Worker }
98*598139dcSAndroid Build Coastguard Worker } else if (strncmp(uid_string, line, sizeof(uid_string) - 1) == 0) {
99*598139dcSAndroid Build Coastguard Worker uid_t u[4] = { (uid_t)-1, (uid_t)-1, (uid_t)-1, (uid_t)-1 };
100*598139dcSAndroid Build Coastguard Worker
101*598139dcSAndroid Build Coastguard Worker sscanf(line + sizeof(uid_string) - 1, "%u\t%u\t%u\t%u", &u[0],
102*598139dcSAndroid Build Coastguard Worker &u[1], &u[2], &u[3]);
103*598139dcSAndroid Build Coastguard Worker
104*598139dcSAndroid Build Coastguard Worker // Protect against PID reuse by checking that UID is the same
105*598139dcSAndroid Build Coastguard Worker if ((uid == u[0]) && (uid == u[1]) && (uid == u[2]) &&
106*598139dcSAndroid Build Coastguard Worker (uid == u[3])) {
107*598139dcSAndroid Build Coastguard Worker foundUid = true;
108*598139dcSAndroid Build Coastguard Worker }
109*598139dcSAndroid Build Coastguard Worker } else if (strncmp(gid_string, line, sizeof(gid_string) - 1) == 0) {
110*598139dcSAndroid Build Coastguard Worker gid_t g[4] = { (gid_t)-1, (gid_t)-1, (gid_t)-1, (gid_t)-1 };
111*598139dcSAndroid Build Coastguard Worker
112*598139dcSAndroid Build Coastguard Worker sscanf(line + sizeof(gid_string) - 1, "%u\t%u\t%u\t%u", &g[0],
113*598139dcSAndroid Build Coastguard Worker &g[1], &g[2], &g[3]);
114*598139dcSAndroid Build Coastguard Worker
115*598139dcSAndroid Build Coastguard Worker // Protect against PID reuse by checking that GID is the same
116*598139dcSAndroid Build Coastguard Worker if ((gid == g[0]) && (gid == g[1]) && (gid == g[2]) &&
117*598139dcSAndroid Build Coastguard Worker (gid == g[3])) {
118*598139dcSAndroid Build Coastguard Worker foundGid = true;
119*598139dcSAndroid Build Coastguard Worker }
120*598139dcSAndroid Build Coastguard Worker }
121*598139dcSAndroid Build Coastguard Worker }
122*598139dcSAndroid Build Coastguard Worker free(line);
123*598139dcSAndroid Build Coastguard Worker fclose(file);
124*598139dcSAndroid Build Coastguard Worker }
125*598139dcSAndroid Build Coastguard Worker
126*598139dcSAndroid Build Coastguard Worker return ret;
127*598139dcSAndroid Build Coastguard Worker }
128*598139dcSAndroid Build Coastguard Worker
clientCanWriteSecurityLog(uid_t uid,gid_t gid,pid_t pid)129*598139dcSAndroid Build Coastguard Worker bool clientCanWriteSecurityLog(uid_t uid, gid_t gid, pid_t pid) {
130*598139dcSAndroid Build Coastguard Worker if (UserIsPrivileged(uid) || UserIsPrivileged(gid)) {
131*598139dcSAndroid Build Coastguard Worker return true;
132*598139dcSAndroid Build Coastguard Worker }
133*598139dcSAndroid Build Coastguard Worker return checkSupplementaryGroup(uid, gid, pid, AID_SECURITY_LOG_WRITER) ||
134*598139dcSAndroid Build Coastguard Worker checkSupplementaryGroup(uid, gid, pid, AID_LOG);
135*598139dcSAndroid Build Coastguard Worker }
136*598139dcSAndroid Build Coastguard Worker
clientHasLogCredentials(uid_t uid,gid_t gid,pid_t pid)137*598139dcSAndroid Build Coastguard Worker bool clientHasLogCredentials(uid_t uid, gid_t gid, pid_t pid) {
138*598139dcSAndroid Build Coastguard Worker if (UserIsPrivileged(uid) || UserIsPrivileged(gid)) {
139*598139dcSAndroid Build Coastguard Worker return true;
140*598139dcSAndroid Build Coastguard Worker }
141*598139dcSAndroid Build Coastguard Worker // FYI We will typically be here for 'adb logcat'
142*598139dcSAndroid Build Coastguard Worker return checkSupplementaryGroup(uid, gid, pid, AID_LOG);
143*598139dcSAndroid Build Coastguard Worker }
144*598139dcSAndroid Build Coastguard Worker
clientHasLogCredentials(SocketClient * cli)145*598139dcSAndroid Build Coastguard Worker bool clientHasLogCredentials(SocketClient* cli) {
146*598139dcSAndroid Build Coastguard Worker if (UserIsPrivileged(cli->getUid()) || UserIsPrivileged(cli->getGid())) {
147*598139dcSAndroid Build Coastguard Worker return true;
148*598139dcSAndroid Build Coastguard Worker }
149*598139dcSAndroid Build Coastguard Worker
150*598139dcSAndroid Build Coastguard Worker // Kernel version 4.13 added SO_PEERGROUPS to return the supplemental groups of a peer socket,
151*598139dcSAndroid Build Coastguard Worker // so try that first then fallback to the above racy checking of /proc/<pid>/status if the
152*598139dcSAndroid Build Coastguard Worker // kernel is too old. Per
153*598139dcSAndroid Build Coastguard Worker // https://source.android.com/devices/architecture/kernel/android-common, the fallback can be
154*598139dcSAndroid Build Coastguard Worker // removed no earlier than 2024.
155*598139dcSAndroid Build Coastguard Worker auto supplemental_groups = std::vector<gid_t>(16, -1);
156*598139dcSAndroid Build Coastguard Worker socklen_t groups_size = supplemental_groups.size() * sizeof(gid_t);
157*598139dcSAndroid Build Coastguard Worker
158*598139dcSAndroid Build Coastguard Worker int result = getsockopt(cli->getSocket(), SOL_SOCKET, SO_PEERGROUPS, supplemental_groups.data(),
159*598139dcSAndroid Build Coastguard Worker &groups_size);
160*598139dcSAndroid Build Coastguard Worker
161*598139dcSAndroid Build Coastguard Worker if (result != 0) {
162*598139dcSAndroid Build Coastguard Worker if (errno != ERANGE) {
163*598139dcSAndroid Build Coastguard Worker return clientHasLogCredentials(cli->getUid(), cli->getGid(), cli->getPid());
164*598139dcSAndroid Build Coastguard Worker }
165*598139dcSAndroid Build Coastguard Worker
166*598139dcSAndroid Build Coastguard Worker supplemental_groups.resize(groups_size / sizeof(gid_t), -1);
167*598139dcSAndroid Build Coastguard Worker result = getsockopt(cli->getSocket(), SOL_SOCKET, SO_PEERGROUPS, supplemental_groups.data(),
168*598139dcSAndroid Build Coastguard Worker &groups_size);
169*598139dcSAndroid Build Coastguard Worker
170*598139dcSAndroid Build Coastguard Worker // There is still some error after resizing supplemental_groups, fallback.
171*598139dcSAndroid Build Coastguard Worker if (result != 0) {
172*598139dcSAndroid Build Coastguard Worker return clientHasLogCredentials(cli->getUid(), cli->getGid(), cli->getPid());
173*598139dcSAndroid Build Coastguard Worker }
174*598139dcSAndroid Build Coastguard Worker }
175*598139dcSAndroid Build Coastguard Worker
176*598139dcSAndroid Build Coastguard Worker supplemental_groups.resize(groups_size / sizeof(gid_t), -1);
177*598139dcSAndroid Build Coastguard Worker for (const auto& gid : supplemental_groups) {
178*598139dcSAndroid Build Coastguard Worker if (UserIsPrivileged(gid)) {
179*598139dcSAndroid Build Coastguard Worker return true;
180*598139dcSAndroid Build Coastguard Worker }
181*598139dcSAndroid Build Coastguard Worker }
182*598139dcSAndroid Build Coastguard Worker
183*598139dcSAndroid Build Coastguard Worker return false;
184*598139dcSAndroid Build Coastguard Worker }
185*598139dcSAndroid Build Coastguard Worker
clientIsExemptedFromUserConsent(SocketClient * cli)186*598139dcSAndroid Build Coastguard Worker bool clientIsExemptedFromUserConsent(SocketClient* cli) {
187*598139dcSAndroid Build Coastguard Worker return cli->getUid() < AID_APP_START;
188*598139dcSAndroid Build Coastguard Worker }
189