blob: ab91defbf30426a582bc8f0136d08085c74a7218 [file] [log] [blame]
Doug Zongker075ad802014-06-26 15:35:51 -07001/*
2 * Copyright (C) 2014 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17// This module creates a special filesystem containing two files.
18//
19// "/sideload/package.zip" appears to be a normal file, but reading
20// from it causes data to be fetched from the adb host. We can use
21// this to sideload packages over an adb connection without having to
22// store the entire package in RAM on the device.
23//
24// Because we may not trust the adb host, this filesystem maintains
25// the following invariant: each read of a given position returns the
26// same data as the first read at that position. That is, once a
27// section of the file is read, future reads of that section return
28// the same data. (Otherwise, a malicious adb host process could
29// return one set of bits when the package is read for signature
30// verification, and then different bits for when the package is
31// accessed by the installer.) If the adb host returns something
32// different than it did on the first read, the reader of the file
33// will see their read fail with EINVAL.
34//
35// The other file, "/sideload/exit", is used to control the subprocess
36// that creates this filesystem. Calling stat() on the exit file
37// causes the filesystem to be unmounted and the adb process on the
38// device shut down.
39//
40// Note that only the minimal set of file operations needed for these
41// two files is implemented. In particular, you can't opendir() or
42// readdir() on the "/sideload" directory; ls on it won't work.
43
44#include <ctype.h>
45#include <dirent.h>
46#include <errno.h>
47#include <fcntl.h>
48#include <limits.h>
49#include <linux/fuse.h>
50#include <pthread.h>
51#include <stdio.h>
52#include <stdlib.h>
53#include <string.h>
54#include <sys/inotify.h>
55#include <sys/mount.h>
56#include <sys/resource.h>
57#include <sys/stat.h>
58#include <sys/statfs.h>
59#include <sys/time.h>
60#include <sys/uio.h>
61#include <unistd.h>
62
Doug Zongker075ad802014-06-26 15:35:51 -070063#include "mincrypt/sha256.h"
Doug Zongker18a78e02014-07-10 07:31:46 -070064#include "fuse_sideload.h"
Doug Zongker075ad802014-06-26 15:35:51 -070065
66#define PACKAGE_FILE_ID (FUSE_ROOT_ID+1)
67#define EXIT_FLAG_ID (FUSE_ROOT_ID+2)
68
69#define NO_STATUS 1
70#define NO_STATUS_EXIT 2
71
72struct fuse_data {
73 int ffd; // file descriptor for the fuse socket
Doug Zongker18a78e02014-07-10 07:31:46 -070074
75 struct provider_vtab* vtab;
76 void* cookie;
Doug Zongker075ad802014-06-26 15:35:51 -070077
78 uint64_t file_size; // bytes
79
80 uint32_t block_size; // block size that the adb host is using to send the file to us
81 uint32_t file_blocks; // file size in block_size blocks
82
83 uid_t uid;
84 gid_t gid;
85
86 uint32_t curr_block; // cache the block most recently read from the host
87 uint8_t* block_data;
88
89 uint8_t* extra_block; // another block of storage for reads that
90 // span two blocks
91
92 uint8_t* hashes; // SHA-256 hash of each block (all zeros
93 // if block hasn't been read yet)
94};
95
96static void fuse_reply(struct fuse_data* fd, __u64 unique, const void *data, size_t len)
97{
98 struct fuse_out_header hdr;
99 struct iovec vec[2];
100 int res;
101
102 hdr.len = len + sizeof(hdr);
103 hdr.error = 0;
104 hdr.unique = unique;
105
106 vec[0].iov_base = &hdr;
107 vec[0].iov_len = sizeof(hdr);
108 vec[1].iov_base = data;
109 vec[1].iov_len = len;
110
111 res = writev(fd->ffd, vec, 2);
112 if (res < 0) {
113 printf("*** REPLY FAILED *** %d\n", errno);
114 }
115}
116
117static int handle_init(void* data, struct fuse_data* fd, const struct fuse_in_header* hdr) {
118 const struct fuse_init_in* req = data;
119 struct fuse_init_out out;
120
121 out.major = FUSE_KERNEL_VERSION;
122 out.minor = FUSE_KERNEL_MINOR_VERSION;
123 out.max_readahead = req->max_readahead;
124 out.flags = 0;
125 out.max_background = 32;
126 out.congestion_threshold = 32;
127 out.max_write = 4096;
128 fuse_reply(fd, hdr->unique, &out, sizeof(out));
129
130 return NO_STATUS;
131}
132
133static void fill_attr(struct fuse_attr* attr, struct fuse_data* fd,
134 uint64_t nodeid, uint64_t size, uint32_t mode) {
135 memset(attr, 0, sizeof(*attr));
136 attr->nlink = 1;
137 attr->uid = fd->uid;
138 attr->gid = fd->gid;
139 attr->blksize = 4096;
140
141 attr->ino = nodeid;
142 attr->size = size;
143 attr->blocks = (size == 0) ? 0 : (((size-1) / attr->blksize) + 1);
144 attr->mode = mode;
145}
146
147static int handle_getattr(void* data, struct fuse_data* fd, const struct fuse_in_header* hdr) {
148 const struct fuse_getattr_in* req = data;
149 struct fuse_attr_out out;
150 memset(&out, 0, sizeof(out));
151 out.attr_valid = 10;
152
153 if (hdr->nodeid == FUSE_ROOT_ID) {
154 fill_attr(&(out.attr), fd, hdr->nodeid, 4096, S_IFDIR | 0555);
155 } else if (hdr->nodeid == PACKAGE_FILE_ID) {
156 fill_attr(&(out.attr), fd, PACKAGE_FILE_ID, fd->file_size, S_IFREG | 0444);
157 } else if (hdr->nodeid == EXIT_FLAG_ID) {
158 fill_attr(&(out.attr), fd, EXIT_FLAG_ID, 0, S_IFREG | 0);
159 } else {
160 return -ENOENT;
161 }
162
163 fuse_reply(fd, hdr->unique, &out, sizeof(out));
164 return (hdr->nodeid == EXIT_FLAG_ID) ? NO_STATUS_EXIT : NO_STATUS;
165}
166
167static int handle_lookup(void* data, struct fuse_data* fd,
168 const struct fuse_in_header* hdr) {
169 struct fuse_entry_out out;
170 memset(&out, 0, sizeof(out));
171 out.entry_valid = 10;
172 out.attr_valid = 10;
173
Doug Zongker18a78e02014-07-10 07:31:46 -0700174 if (strncmp(FUSE_SIDELOAD_HOST_FILENAME, data,
175 sizeof(FUSE_SIDELOAD_HOST_FILENAME)) == 0) {
Doug Zongker075ad802014-06-26 15:35:51 -0700176 out.nodeid = PACKAGE_FILE_ID;
177 out.generation = PACKAGE_FILE_ID;
178 fill_attr(&(out.attr), fd, PACKAGE_FILE_ID, fd->file_size, S_IFREG | 0444);
Doug Zongker18a78e02014-07-10 07:31:46 -0700179 } else if (strncmp(FUSE_SIDELOAD_HOST_EXIT_FLAG, data,
180 sizeof(FUSE_SIDELOAD_HOST_EXIT_FLAG)) == 0) {
Doug Zongker075ad802014-06-26 15:35:51 -0700181 out.nodeid = EXIT_FLAG_ID;
182 out.generation = EXIT_FLAG_ID;
183 fill_attr(&(out.attr), fd, EXIT_FLAG_ID, 0, S_IFREG | 0);
184 } else {
185 return -ENOENT;
186 }
187
188 fuse_reply(fd, hdr->unique, &out, sizeof(out));
189 return (out.nodeid == EXIT_FLAG_ID) ? NO_STATUS_EXIT : NO_STATUS;
190}
191
192static int handle_open(void* data, struct fuse_data* fd, const struct fuse_in_header* hdr) {
193 const struct fuse_open_in* req = data;
194
195 if (hdr->nodeid == EXIT_FLAG_ID) return -EPERM;
196 if (hdr->nodeid != PACKAGE_FILE_ID) return -ENOENT;
197
198 struct fuse_open_out out;
199 memset(&out, 0, sizeof(out));
200 out.fh = 10; // an arbitrary number; we always use the same handle
201 fuse_reply(fd, hdr->unique, &out, sizeof(out));
202 return NO_STATUS;
203}
204
205static int handle_flush(void* data, struct fuse_data* fd, const struct fuse_in_header* hdr) {
206 return 0;
207}
208
209static int handle_release(void* data, struct fuse_data* fd, const struct fuse_in_header* hdr) {
210 return 0;
211}
212
213// Fetch a block from the host into fd->curr_block and fd->block_data.
214// Returns 0 on successful fetch, negative otherwise.
215static int fetch_block(struct fuse_data* fd, uint32_t block) {
216 if (block == fd->curr_block) {
217 return 0;
218 }
219
220 if (block >= fd->file_blocks) {
221 memset(fd->block_data, 0, fd->block_size);
222 fd->curr_block = block;
223 return 0;
224 }
225
226 size_t fetch_size = fd->block_size;
227 if (block * fd->block_size + fetch_size > fd->file_size) {
228 // If we're reading the last (partial) block of the file,
229 // expect a shorter response from the host, and pad the rest
230 // of the block with zeroes.
231 fetch_size = fd->file_size - (block * fd->block_size);
232 memset(fd->block_data + fetch_size, 0, fd->block_size - fetch_size);
233 }
234
Doug Zongker18a78e02014-07-10 07:31:46 -0700235 int result = fd->vtab->read_block(fd->cookie, block, fd->block_data, fetch_size);
236 if (result < 0) return result;
Doug Zongker075ad802014-06-26 15:35:51 -0700237
238 fd->curr_block = block;
239
240 // Verify the hash of the block we just got from the host.
241 //
242 // - If the hash of the just-received data matches the stored hash
243 // for the block, accept it.
244 // - If the stored hash is all zeroes, store the new hash and
245 // accept the block (this is the first time we've read this
246 // block).
247 // - Otherwise, return -EINVAL for the read.
248
249 uint8_t hash[SHA256_DIGEST_SIZE];
250 SHA256_hash(fd->block_data, fd->block_size, hash);
251 uint8_t* blockhash = fd->hashes + block * SHA256_DIGEST_SIZE;
252 if (memcmp(hash, blockhash, SHA256_DIGEST_SIZE) == 0) {
253 return 0;
254 }
255
256 int i;
257 for (i = 0; i < SHA256_DIGEST_SIZE; ++i) {
258 if (blockhash[i] != 0) {
259 fd->curr_block = -1;
260 return -EIO;
261 }
262 }
263
264 memcpy(blockhash, hash, SHA256_DIGEST_SIZE);
265 return 0;
266}
267
268static int handle_read(void* data, struct fuse_data* fd, const struct fuse_in_header* hdr) {
269 const struct fuse_read_in* req = data;
270 struct fuse_out_header outhdr;
271 struct iovec vec[3];
272 int vec_used;
273 int result;
274
275 if (hdr->nodeid != PACKAGE_FILE_ID) return -ENOENT;
276
277 uint64_t offset = req->offset;
278 uint32_t size = req->size;
279
280 // The docs on the fuse kernel interface are vague about what to
281 // do when a read request extends past the end of the file. We
282 // can return a short read -- the return structure does include a
283 // length field -- but in testing that caused the program using
284 // the file to segfault. (I speculate that this is due to the
285 // reading program accessing it via mmap; maybe mmap dislikes when
286 // you return something short of a whole page?) To fix this we
287 // zero-pad reads that extend past the end of the file so we're
288 // always returning exactly as many bytes as were requested.
289 // (Users of the mapped file have to know its real length anyway.)
290
291 outhdr.len = sizeof(outhdr) + size;
292 outhdr.error = 0;
293 outhdr.unique = hdr->unique;
294 vec[0].iov_base = &outhdr;
295 vec[0].iov_len = sizeof(outhdr);
296
297 uint32_t block = offset / fd->block_size;
298 result = fetch_block(fd, block);
299 if (result != 0) return result;
300
301 // Two cases:
302 //
303 // - the read request is entirely within this block. In this
304 // case we can reply immediately.
305 //
306 // - the read request goes over into the next block. Note that
307 // since we mount the filesystem with max_read=block_size, a
308 // read can never span more than two blocks. In this case we
309 // copy the block to extra_block and issue a fetch for the
310 // following block.
311
312 uint32_t block_offset = offset - (block * fd->block_size);
313
314 if (size + block_offset <= fd->block_size) {
315 // First case: the read fits entirely in the first block.
316
317 vec[1].iov_base = fd->block_data + block_offset;
318 vec[1].iov_len = size;
319 vec_used = 2;
320 } else {
321 // Second case: the read spills over into the next block.
322
323 memcpy(fd->extra_block, fd->block_data + block_offset,
324 fd->block_size - block_offset);
325 vec[1].iov_base = fd->extra_block;
326 vec[1].iov_len = fd->block_size - block_offset;
327
328 result = fetch_block(fd, block+1);
329 if (result != 0) return result;
330 vec[2].iov_base = fd->block_data;
331 vec[2].iov_len = size - vec[1].iov_len;
332 vec_used = 3;
333 }
334
335 if (writev(fd->ffd, vec, vec_used) < 0) {
336 printf("*** READ REPLY FAILED: %s ***\n", strerror(errno));
337 }
338 return NO_STATUS;
339}
340
Doug Zongker18a78e02014-07-10 07:31:46 -0700341int run_fuse_sideload(struct provider_vtab* vtab, void* cookie,
342 uint64_t file_size, uint32_t block_size)
Doug Zongker075ad802014-06-26 15:35:51 -0700343{
344 int result;
345
346 // If something's already mounted on our mountpoint, try to remove
347 // it. (Mostly in case of a previous abnormal exit.)
Doug Zongker18a78e02014-07-10 07:31:46 -0700348 umount2(FUSE_SIDELOAD_HOST_MOUNTPOINT, MNT_FORCE);
Doug Zongker075ad802014-06-26 15:35:51 -0700349
350 if (block_size < 1024) {
351 fprintf(stderr, "block size (%u) is too small\n", block_size);
352 return -1;
353 }
354 if (block_size > (1<<22)) { // 4 MiB
355 fprintf(stderr, "block size (%u) is too large\n", block_size);
356 return -1;
357 }
358
359 struct fuse_data fd;
360 memset(&fd, 0, sizeof(fd));
Doug Zongker18a78e02014-07-10 07:31:46 -0700361 fd.vtab = vtab;
362 fd.cookie = cookie;
Doug Zongker075ad802014-06-26 15:35:51 -0700363 fd.file_size = file_size;
364 fd.block_size = block_size;
365 fd.file_blocks = (file_size == 0) ? 0 : (((file_size-1) / block_size) + 1);
366
367 if (fd.file_blocks > (1<<18)) {
368 fprintf(stderr, "file has too many blocks (%u)\n", fd.file_blocks);
369 result = -1;
370 goto done;
371 }
372
373 fd.hashes = (uint8_t*)calloc(fd.file_blocks, SHA256_DIGEST_SIZE);
374 if (fd.hashes == NULL) {
375 fprintf(stderr, "failed to allocate %d bites for hashes\n",
376 fd.file_blocks * SHA256_DIGEST_SIZE);
377 result = -1;
378 goto done;
379 }
380
381 fd.uid = getuid();
382 fd.gid = getgid();
383
384 fd.curr_block = -1;
385 fd.block_data = (uint8_t*)malloc(block_size);
386 if (fd.block_data == NULL) {
387 fprintf(stderr, "failed to allocate %d bites for block_data\n", block_size);
388 result = -1;
389 goto done;
390 }
391 fd.extra_block = (uint8_t*)malloc(block_size);
392 if (fd.extra_block == NULL) {
393 fprintf(stderr, "failed to allocate %d bites for extra_block\n", block_size);
394 result = -1;
395 goto done;
396 }
397
398 fd.ffd = open("/dev/fuse", O_RDWR);
399 if (fd.ffd < 0) {
400 perror("open /dev/fuse");
401 result = -1;
402 goto done;
403 }
404
405 char opts[256];
406 snprintf(opts, sizeof(opts),
407 ("fd=%d,user_id=%d,group_id=%d,max_read=%zu,"
408 "allow_other,rootmode=040000"),
409 fd.ffd, fd.uid, fd.gid, block_size);
410
Doug Zongker18a78e02014-07-10 07:31:46 -0700411 result = mount("/dev/fuse", FUSE_SIDELOAD_HOST_MOUNTPOINT,
Doug Zongker075ad802014-06-26 15:35:51 -0700412 "fuse", MS_NOSUID | MS_NODEV | MS_RDONLY | MS_NOEXEC, opts);
413 if (result < 0) {
414 perror("mount");
415 goto done;
416 }
417 uint8_t request_buffer[sizeof(struct fuse_in_header) + PATH_MAX*8];
418 for (;;) {
419 ssize_t len = read(fd.ffd, request_buffer, sizeof(request_buffer));
420 if (len < 0) {
421 if (errno != EINTR) {
422 perror("read request");
423 if (errno == ENODEV) {
424 result = -1;
425 break;
426 }
427 }
428 continue;
429 }
430
431 if ((size_t)len < sizeof(struct fuse_in_header)) {
432 fprintf(stderr, "request too short: len=%zu\n", (size_t)len);
433 continue;
434 }
435
436 struct fuse_in_header* hdr = (struct fuse_in_header*) request_buffer;
437 void* data = request_buffer + sizeof(struct fuse_in_header);
438
439 result = -ENOSYS;
440
441 switch (hdr->opcode) {
442 case FUSE_INIT:
443 result = handle_init(data, &fd, hdr);
444 break;
445
446 case FUSE_LOOKUP:
447 result = handle_lookup(data, &fd, hdr);
448 break;
449
450 case FUSE_GETATTR:
451 result = handle_getattr(data, &fd, hdr);
452 break;
453
454 case FUSE_OPEN:
455 result = handle_open(data, &fd, hdr);
456 break;
457
458 case FUSE_READ:
459 result = handle_read(data, &fd, hdr);
460 break;
461
462 case FUSE_FLUSH:
463 result = handle_flush(data, &fd, hdr);
464 break;
465
466 case FUSE_RELEASE:
467 result = handle_release(data, &fd, hdr);
468 break;
469
470 default:
471 fprintf(stderr, "unknown fuse request opcode %d\n", hdr->opcode);
472 break;
473 }
474
475 if (result == NO_STATUS_EXIT) {
476 result = 0;
477 break;
478 }
479
480 if (result != NO_STATUS) {
481 struct fuse_out_header outhdr;
482 outhdr.len = sizeof(outhdr);
483 outhdr.error = result;
484 outhdr.unique = hdr->unique;
485 write(fd.ffd, &outhdr, sizeof(outhdr));
486 }
487 }
488
489 done:
Doug Zongker18a78e02014-07-10 07:31:46 -0700490 fd.vtab->close(fd.cookie);
491
492 result = umount2(FUSE_SIDELOAD_HOST_MOUNTPOINT, MNT_DETACH);
Doug Zongker075ad802014-06-26 15:35:51 -0700493 if (result < 0) {
494 printf("fuse_sideload umount failed: %s\n", strerror(errno));
495 }
496
497 if (fd.ffd) close(fd.ffd);
498 free(fd.hashes);
499 free(fd.block_data);
500 free(fd.extra_block);
501
502 return result;
503}