Merge cherrypicks of [6072697, 6072075, 6072758, 6072124, 6072885, 6072886, 6072887, 6072580, 6072581, 6072582, 6072583, 6072584, 6072132, 6072195, 6072133, 6072077, 6072134, 6072078, 6072211, 6072762, 6072763, 6072908, 6072909, 6072910, 6072911, 6072912, 6072913, 6072914, 6072930, 6072212, 6072743] into pi-qpr2-release
Change-Id: I923830443facf2a4478c609aab4ae82ce41ffaac
diff --git a/AccessControl.cpp b/AccessControl.cpp
index 985feb7..f47705d 100644
--- a/AccessControl.cpp
+++ b/AccessControl.cpp
@@ -14,11 +14,11 @@
struct audit_data {
const char* interfaceName;
+ const char* sid;
pid_t pid;
};
using android::FQName;
-using Context = AccessControl::Context;
AccessControl::AccessControl() {
mSeHandle = selinux_android_hw_service_context_handle();
@@ -37,7 +37,7 @@
selinux_set_callback(SELINUX_CB_LOG, mSeCallbacks);
}
-bool AccessControl::canAdd(const std::string& fqName, const Context &context, pid_t pid) {
+bool AccessControl::canAdd(const std::string& fqName, const CallingContext& callingContext) {
FQName fqIface(fqName);
if (!fqIface.isValid()) {
@@ -45,10 +45,10 @@
}
const std::string checkName = fqIface.package() + "::" + fqIface.name();
- return checkPermission(context, pid, kPermissionAdd, checkName.c_str());
+ return checkPermission(callingContext, kPermissionAdd, checkName.c_str());
}
-bool AccessControl::canGet(const std::string& fqName, pid_t pid) {
+bool AccessControl::canGet(const std::string& fqName, const CallingContext& callingContext) {
FQName fqIface(fqName);
if (!fqIface.isValid()) {
@@ -56,43 +56,46 @@
}
const std::string checkName = fqIface.package() + "::" + fqIface.name();
- return checkPermission(getContext(pid), pid, kPermissionGet, checkName.c_str());
+ return checkPermission(callingContext, kPermissionGet, checkName.c_str());
}
-bool AccessControl::canList(pid_t pid) {
- return checkPermission(getContext(pid), pid, mSeContext, kPermissionList, nullptr);
+bool AccessControl::canList(const CallingContext& callingContext) {
+ return checkPermission(callingContext, mSeContext, kPermissionList, nullptr);
}
-Context AccessControl::getContext(pid_t sourcePid) {
- char *sourceContext = NULL;
+AccessControl::CallingContext AccessControl::getCallingContext(pid_t sourcePid) {
+ char *sourceContext = nullptr;
if (getpidcon(sourcePid, &sourceContext) < 0) {
ALOGE("SELinux: failed to retrieve process context for pid %d", sourcePid);
- return Context(nullptr, freecon);
+ return { false, "", sourcePid };
}
- return Context(sourceContext, freecon);
+ std::string context = sourceContext;
+ freecon(sourceContext);
+ return { true, context, sourcePid };
}
-bool AccessControl::checkPermission(const Context &context, pid_t sourceAuditPid, const char *targetContext, const char *perm, const char *interface) {
- if (context == nullptr) {
+bool AccessControl::checkPermission(const CallingContext& source, const char *targetContext, const char *perm, const char *interface) {
+ if (!source.sidPresent) {
return false;
}
bool allowed = false;
- struct audit_data ad;
- ad.pid = sourceAuditPid;
+ struct audit_data ad;
+ ad.pid = source.pid;
+ ad.sid = source.sid.c_str();
ad.interfaceName = interface;
- allowed = (selinux_check_access(context.get(), targetContext, "hwservice_manager",
+ allowed = (selinux_check_access(source.sid.c_str(), targetContext, "hwservice_manager",
perm, (void *) &ad) == 0);
return allowed;
}
-bool AccessControl::checkPermission(const Context &context, pid_t sourceAuditPid, const char *perm, const char *interface) {
- char *targetContext = NULL;
+bool AccessControl::checkPermission(const CallingContext& source, const char *perm, const char *interface) {
+ char *targetContext = nullptr;
bool allowed = false;
// Lookup service in hwservice_contexts
@@ -101,7 +104,7 @@
return false;
}
- allowed = checkPermission(context, sourceAuditPid, targetContext, perm, interface);
+ allowed = checkPermission(source, targetContext, perm, interface);
freecon(targetContext);
@@ -116,7 +119,9 @@
return 0;
}
- snprintf(buf, len, "interface=%s pid=%d", ad->interfaceName, ad->pid);
+ const char* sid = ad->sid ? ad->sid : "N/A";
+
+ snprintf(buf, len, "interface=%s sid=%s pid=%d", ad->interfaceName, sid, ad->pid);
return 0;
}
diff --git a/AccessControl.h b/AccessControl.h
index 63a2098..877df99 100644
--- a/AccessControl.h
+++ b/AccessControl.h
@@ -9,17 +9,21 @@
public:
AccessControl();
- using Context = std::unique_ptr<char, decltype(&freecon)>;
- Context getContext(pid_t sourcePid);
+ struct CallingContext {
+ bool sidPresent;
+ std::string sid;
+ pid_t pid;
+ };
+ static CallingContext getCallingContext(pid_t sourcePid);
- bool canAdd(const std::string& fqName, const Context &context, pid_t pid);
- bool canGet(const std::string& fqName, pid_t pid);
- bool canList(pid_t pid);
+ bool canAdd(const std::string& fqName, const CallingContext& callingContext);
+ bool canGet(const std::string& fqName, const CallingContext& callingContext);
+ bool canList(const CallingContext& callingContext);
private:
- bool checkPermission(const Context &context, pid_t sourceAuditPid, const char *targetContext, const char *perm, const char *interface);
- bool checkPermission(const Context &context, pid_t sourcePid, const char *perm, const char *interface);
+ bool checkPermission(const CallingContext& source, const char *targetContext, const char *perm, const char *interface);
+ bool checkPermission(const CallingContext& source, const char *perm, const char *interface);
static int auditCallback(void *data, security_class_t cls, char *buf, size_t len);
diff --git a/HidlService.cpp b/HidlService.cpp
index a0f2cab..dad7bac 100644
--- a/HidlService.cpp
+++ b/HidlService.cpp
@@ -31,7 +31,7 @@
sendRegistrationNotifications();
}
-pid_t HidlService::getPid() const {
+pid_t HidlService::getDebugPid() const {
return mPid;
}
const std::string &HidlService::getInterfaceName() const {
diff --git a/HidlService.h b/HidlService.h
index 2fcb0d6..64fdabb 100644
--- a/HidlService.h
+++ b/HidlService.h
@@ -41,7 +41,7 @@
*/
sp<IBase> getService() const;
void setService(sp<IBase> service, pid_t pid);
- pid_t getPid() const;
+ pid_t getDebugPid() const;
const std::string &getInterfaceName() const;
const std::string &getInstanceName() const;
diff --git a/ServiceManager.cpp b/ServiceManager.cpp
index 3e2353e..01ccd88 100644
--- a/ServiceManager.cpp
+++ b/ServiceManager.cpp
@@ -19,6 +19,23 @@
namespace manager {
namespace implementation {
+AccessControl::CallingContext getBinderCallingContext() {
+ const auto& self = IPCThreadState::self();
+
+ pid_t pid = self->getCallingPid();
+ const char* sid = self->getCallingSid();
+
+ if (sid == nullptr) {
+ if (pid != getpid()) {
+ android_errorWriteLog(0x534e4554, "121035042");
+ }
+
+ return AccessControl::getCallingContext(pid);
+ } else {
+ return { true, sid, pid };
+ }
+}
+
static constexpr uint64_t kServiceDiedCookie = 0;
static constexpr uint64_t kPackageListenerDiedCookie = 1;
static constexpr uint64_t kServiceListenerDiedCookie = 2;
@@ -181,8 +198,7 @@
const std::string fqName = hidlFqName;
const std::string name = hidlName;
- pid_t pid = IPCThreadState::self()->getCallingPid();
- if (!mAcl.canGet(fqName, pid)) {
+ if (!mAcl.canGet(fqName, getBinderCallingContext())) {
return nullptr;
}
@@ -216,10 +232,7 @@
return false;
}
- // TODO(b/34235311): use HIDL way to determine this
- // also, this assumes that the PID that is registering is the pid that is the service
- pid_t pid = IPCThreadState::self()->getCallingPid();
- auto context = mAcl.getContext(pid);
+ auto callingContext = getBinderCallingContext();
auto ret = service->interfaceChain([&](const auto &interfaceChain) {
if (interfaceChain.size() == 0) {
@@ -230,7 +243,7 @@
for(size_t i = 0; i < interfaceChain.size(); i++) {
const std::string fqName = interfaceChain[i];
- if (!mAcl.canAdd(fqName, context, pid)) {
+ if (!mAcl.canAdd(fqName, callingContext)) {
return;
}
}
@@ -263,9 +276,9 @@
if (hidlService == nullptr) {
ifaceMap.insertService(
- std::make_unique<HidlService>(fqName, name, service, pid));
+ std::make_unique<HidlService>(fqName, name, service, callingContext.pid));
} else {
- hidlService->setService(service, pid);
+ hidlService->setService(service, callingContext.pid);
}
ifaceMap.sendPackageRegistrationNotification(fqName, name);
@@ -291,8 +304,7 @@
const hidl_string& name) {
using ::android::hardware::getTransport;
- pid_t pid = IPCThreadState::self()->getCallingPid();
- if (!mAcl.canGet(fqName, pid)) {
+ if (!mAcl.canGet(fqName, getBinderCallingContext())) {
return Transport::EMPTY;
}
@@ -308,8 +320,7 @@
}
Return<void> ServiceManager::list(list_cb _hidl_cb) {
- pid_t pid = IPCThreadState::self()->getCallingPid();
- if (!mAcl.canList(pid)) {
+ if (!mAcl.canList(getBinderCallingContext())) {
_hidl_cb({});
return Void();
}
@@ -329,8 +340,7 @@
Return<void> ServiceManager::listByInterface(const hidl_string& fqName,
listByInterface_cb _hidl_cb) {
- pid_t pid = IPCThreadState::self()->getCallingPid();
- if (!mAcl.canGet(fqName, pid)) {
+ if (!mAcl.canGet(fqName, getBinderCallingContext())) {
_hidl_cb({});
return Void();
}
@@ -373,8 +383,7 @@
return false;
}
- pid_t pid = IPCThreadState::self()->getCallingPid();
- if (!mAcl.canGet(fqName, pid)) {
+ if (!mAcl.canGet(fqName, getBinderCallingContext())) {
return false;
}
@@ -446,8 +455,7 @@
}
Return<void> ServiceManager::debugDump(debugDump_cb _cb) {
- pid_t pid = IPCThreadState::self()->getCallingPid();
- if (!mAcl.canList(pid)) {
+ if (!mAcl.canList(getBinderCallingContext())) {
_cb({});
return Void();
}
@@ -463,7 +471,7 @@
}
list.push_back({
- .pid = service->getPid(),
+ .pid = service->getDebugPid(),
.interfaceName = service->getInterfaceName(),
.instanceName = service->getInstanceName(),
.clientPids = clientPids,
@@ -478,8 +486,9 @@
Return<void> ServiceManager::registerPassthroughClient(const hidl_string &fqName,
const hidl_string &name) {
- pid_t pid = IPCThreadState::self()->getCallingPid();
- if (!mAcl.canGet(fqName, pid)) {
+ auto callingContext = getBinderCallingContext();
+
+ if (!mAcl.canGet(fqName, callingContext)) {
/* We guard this function with "get", because it's typically used in
* the getService() path, albeit for a passthrough service in this
* case
@@ -499,10 +508,10 @@
if (service == nullptr) {
auto adding = std::make_unique<HidlService>(fqName, name);
- adding->registerPassthroughClient(pid);
+ adding->registerPassthroughClient(callingContext.pid);
ifaceMap.insertService(std::move(adding));
} else {
- service->registerPassthroughClient(pid);
+ service->registerPassthroughClient(callingContext.pid);
}
return Void();
}
diff --git a/service.cpp b/service.cpp
index 17db6bc..a3d8c2c 100644
--- a/service.cpp
+++ b/service.cpp
@@ -31,6 +31,7 @@
using android::hardware::hidl_string;
using android::hardware::hidl_vec;
using android::hardware::joinRpcThreadpool;
+using android::hardware::setRequestingSid;
// hidl types
using android::hidl::manager::V1_1::BnHwServiceManager;
@@ -45,7 +46,8 @@
int main() {
configureRpcThreadpool(1, true /* callerWillJoin */);
- ServiceManager *manager = new ServiceManager();
+ sp<ServiceManager> manager = new ServiceManager();
+ setRequestingSid(manager, true);
if (!manager->add(serviceName, manager)) {
ALOGE("Failed to register hwservicemanager with itself.");
