blob: 9c3e75f89bf6abe27d576e194f684af25967b631 [file] [log] [blame]
Doug Zongker075ad802014-06-26 15:35:51 -07001/*
2 * Copyright (C) 2014 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17// This module creates a special filesystem containing two files.
18//
19// "/sideload/package.zip" appears to be a normal file, but reading
20// from it causes data to be fetched from the adb host. We can use
21// this to sideload packages over an adb connection without having to
22// store the entire package in RAM on the device.
23//
24// Because we may not trust the adb host, this filesystem maintains
25// the following invariant: each read of a given position returns the
26// same data as the first read at that position. That is, once a
27// section of the file is read, future reads of that section return
28// the same data. (Otherwise, a malicious adb host process could
29// return one set of bits when the package is read for signature
30// verification, and then different bits for when the package is
31// accessed by the installer.) If the adb host returns something
32// different than it did on the first read, the reader of the file
33// will see their read fail with EINVAL.
34//
35// The other file, "/sideload/exit", is used to control the subprocess
36// that creates this filesystem. Calling stat() on the exit file
37// causes the filesystem to be unmounted and the adb process on the
38// device shut down.
39//
40// Note that only the minimal set of file operations needed for these
41// two files is implemented. In particular, you can't opendir() or
42// readdir() on the "/sideload" directory; ls on it won't work.
43
44#include <ctype.h>
45#include <dirent.h>
46#include <errno.h>
47#include <fcntl.h>
48#include <limits.h>
49#include <linux/fuse.h>
50#include <pthread.h>
51#include <stdio.h>
52#include <stdlib.h>
53#include <string.h>
54#include <sys/inotify.h>
55#include <sys/mount.h>
Christopher Ferris1d30c2f2014-09-16 14:53:39 -070056#include <sys/param.h>
Doug Zongker075ad802014-06-26 15:35:51 -070057#include <sys/resource.h>
58#include <sys/stat.h>
59#include <sys/statfs.h>
60#include <sys/time.h>
61#include <sys/uio.h>
62#include <unistd.h>
63
Doug Zongker075ad802014-06-26 15:35:51 -070064#include "mincrypt/sha256.h"
Doug Zongker18a78e02014-07-10 07:31:46 -070065#include "fuse_sideload.h"
Doug Zongker075ad802014-06-26 15:35:51 -070066
67#define PACKAGE_FILE_ID (FUSE_ROOT_ID+1)
68#define EXIT_FLAG_ID (FUSE_ROOT_ID+2)
69
70#define NO_STATUS 1
71#define NO_STATUS_EXIT 2
72
73struct fuse_data {
74 int ffd; // file descriptor for the fuse socket
Doug Zongker18a78e02014-07-10 07:31:46 -070075
76 struct provider_vtab* vtab;
77 void* cookie;
Doug Zongker075ad802014-06-26 15:35:51 -070078
79 uint64_t file_size; // bytes
80
81 uint32_t block_size; // block size that the adb host is using to send the file to us
82 uint32_t file_blocks; // file size in block_size blocks
83
84 uid_t uid;
85 gid_t gid;
86
87 uint32_t curr_block; // cache the block most recently read from the host
88 uint8_t* block_data;
89
90 uint8_t* extra_block; // another block of storage for reads that
91 // span two blocks
92
93 uint8_t* hashes; // SHA-256 hash of each block (all zeros
94 // if block hasn't been read yet)
95};
96
97static void fuse_reply(struct fuse_data* fd, __u64 unique, const void *data, size_t len)
98{
99 struct fuse_out_header hdr;
100 struct iovec vec[2];
101 int res;
102
103 hdr.len = len + sizeof(hdr);
104 hdr.error = 0;
105 hdr.unique = unique;
106
107 vec[0].iov_base = &hdr;
108 vec[0].iov_len = sizeof(hdr);
Elliott Hughes1fdd4522015-03-23 13:33:57 -0700109 vec[1].iov_base = /* const_cast */(void*)(data);
Doug Zongker075ad802014-06-26 15:35:51 -0700110 vec[1].iov_len = len;
111
112 res = writev(fd->ffd, vec, 2);
113 if (res < 0) {
Elliott Hughes1fdd4522015-03-23 13:33:57 -0700114 printf("*** REPLY FAILED *** %s\n", strerror(errno));
Doug Zongker075ad802014-06-26 15:35:51 -0700115 }
116}
117
118static int handle_init(void* data, struct fuse_data* fd, const struct fuse_in_header* hdr) {
Tao Bao71dc3652015-07-19 08:40:37 -0700119 const struct fuse_init_in* req = reinterpret_cast<const struct fuse_init_in*>(data);
Doug Zongker075ad802014-06-26 15:35:51 -0700120 struct fuse_init_out out;
Christopher Ferris1d30c2f2014-09-16 14:53:39 -0700121 size_t fuse_struct_size;
122
123
124 /* Kernel 2.6.16 is the first stable kernel with struct fuse_init_out
125 * defined (fuse version 7.6). The structure is the same from 7.6 through
126 * 7.22. Beginning with 7.23, the structure increased in size and added
127 * new parameters.
128 */
129 if (req->major != FUSE_KERNEL_VERSION || req->minor < 6) {
130 printf("Fuse kernel version mismatch: Kernel version %d.%d, Expected at least %d.6",
131 req->major, req->minor, FUSE_KERNEL_VERSION);
132 return -1;
133 }
134
135 out.minor = MIN(req->minor, FUSE_KERNEL_MINOR_VERSION);
136 fuse_struct_size = sizeof(out);
137#if defined(FUSE_COMPAT_22_INIT_OUT_SIZE)
138 /* FUSE_KERNEL_VERSION >= 23. */
139
140 /* If the kernel only works on minor revs older than or equal to 22,
141 * then use the older structure size since this code only uses the 7.22
142 * version of the structure. */
143 if (req->minor <= 22) {
144 fuse_struct_size = FUSE_COMPAT_22_INIT_OUT_SIZE;
145 }
146#endif
Doug Zongker075ad802014-06-26 15:35:51 -0700147
148 out.major = FUSE_KERNEL_VERSION;
Doug Zongker075ad802014-06-26 15:35:51 -0700149 out.max_readahead = req->max_readahead;
150 out.flags = 0;
151 out.max_background = 32;
152 out.congestion_threshold = 32;
153 out.max_write = 4096;
Christopher Ferris1d30c2f2014-09-16 14:53:39 -0700154 fuse_reply(fd, hdr->unique, &out, fuse_struct_size);
Doug Zongker075ad802014-06-26 15:35:51 -0700155
156 return NO_STATUS;
157}
158
159static void fill_attr(struct fuse_attr* attr, struct fuse_data* fd,
160 uint64_t nodeid, uint64_t size, uint32_t mode) {
161 memset(attr, 0, sizeof(*attr));
162 attr->nlink = 1;
163 attr->uid = fd->uid;
164 attr->gid = fd->gid;
165 attr->blksize = 4096;
166
167 attr->ino = nodeid;
168 attr->size = size;
169 attr->blocks = (size == 0) ? 0 : (((size-1) / attr->blksize) + 1);
170 attr->mode = mode;
171}
172
Tao Bao71dc3652015-07-19 08:40:37 -0700173static int handle_getattr(void* /* data */, struct fuse_data* fd, const struct fuse_in_header* hdr) {
Doug Zongker075ad802014-06-26 15:35:51 -0700174 struct fuse_attr_out out;
175 memset(&out, 0, sizeof(out));
176 out.attr_valid = 10;
177
178 if (hdr->nodeid == FUSE_ROOT_ID) {
179 fill_attr(&(out.attr), fd, hdr->nodeid, 4096, S_IFDIR | 0555);
180 } else if (hdr->nodeid == PACKAGE_FILE_ID) {
181 fill_attr(&(out.attr), fd, PACKAGE_FILE_ID, fd->file_size, S_IFREG | 0444);
182 } else if (hdr->nodeid == EXIT_FLAG_ID) {
183 fill_attr(&(out.attr), fd, EXIT_FLAG_ID, 0, S_IFREG | 0);
184 } else {
185 return -ENOENT;
186 }
187
188 fuse_reply(fd, hdr->unique, &out, sizeof(out));
189 return (hdr->nodeid == EXIT_FLAG_ID) ? NO_STATUS_EXIT : NO_STATUS;
190}
191
192static int handle_lookup(void* data, struct fuse_data* fd,
193 const struct fuse_in_header* hdr) {
194 struct fuse_entry_out out;
195 memset(&out, 0, sizeof(out));
196 out.entry_valid = 10;
197 out.attr_valid = 10;
198
Tao Bao71dc3652015-07-19 08:40:37 -0700199 if (strncmp(FUSE_SIDELOAD_HOST_FILENAME, reinterpret_cast<const char*>(data),
Doug Zongker18a78e02014-07-10 07:31:46 -0700200 sizeof(FUSE_SIDELOAD_HOST_FILENAME)) == 0) {
Doug Zongker075ad802014-06-26 15:35:51 -0700201 out.nodeid = PACKAGE_FILE_ID;
202 out.generation = PACKAGE_FILE_ID;
203 fill_attr(&(out.attr), fd, PACKAGE_FILE_ID, fd->file_size, S_IFREG | 0444);
Tao Bao71dc3652015-07-19 08:40:37 -0700204 } else if (strncmp(FUSE_SIDELOAD_HOST_EXIT_FLAG, reinterpret_cast<const char*>(data),
Doug Zongker18a78e02014-07-10 07:31:46 -0700205 sizeof(FUSE_SIDELOAD_HOST_EXIT_FLAG)) == 0) {
Doug Zongker075ad802014-06-26 15:35:51 -0700206 out.nodeid = EXIT_FLAG_ID;
207 out.generation = EXIT_FLAG_ID;
208 fill_attr(&(out.attr), fd, EXIT_FLAG_ID, 0, S_IFREG | 0);
209 } else {
210 return -ENOENT;
211 }
212
213 fuse_reply(fd, hdr->unique, &out, sizeof(out));
214 return (out.nodeid == EXIT_FLAG_ID) ? NO_STATUS_EXIT : NO_STATUS;
215}
216
Tao Bao71dc3652015-07-19 08:40:37 -0700217static int handle_open(void* /* data */, struct fuse_data* fd, const struct fuse_in_header* hdr) {
Doug Zongker075ad802014-06-26 15:35:51 -0700218 if (hdr->nodeid == EXIT_FLAG_ID) return -EPERM;
219 if (hdr->nodeid != PACKAGE_FILE_ID) return -ENOENT;
220
221 struct fuse_open_out out;
222 memset(&out, 0, sizeof(out));
223 out.fh = 10; // an arbitrary number; we always use the same handle
224 fuse_reply(fd, hdr->unique, &out, sizeof(out));
225 return NO_STATUS;
226}
227
228static int handle_flush(void* data, struct fuse_data* fd, const struct fuse_in_header* hdr) {
229 return 0;
230}
231
232static int handle_release(void* data, struct fuse_data* fd, const struct fuse_in_header* hdr) {
233 return 0;
234}
235
236// Fetch a block from the host into fd->curr_block and fd->block_data.
237// Returns 0 on successful fetch, negative otherwise.
238static int fetch_block(struct fuse_data* fd, uint32_t block) {
239 if (block == fd->curr_block) {
240 return 0;
241 }
242
243 if (block >= fd->file_blocks) {
244 memset(fd->block_data, 0, fd->block_size);
245 fd->curr_block = block;
246 return 0;
247 }
248
249 size_t fetch_size = fd->block_size;
250 if (block * fd->block_size + fetch_size > fd->file_size) {
251 // If we're reading the last (partial) block of the file,
252 // expect a shorter response from the host, and pad the rest
253 // of the block with zeroes.
254 fetch_size = fd->file_size - (block * fd->block_size);
255 memset(fd->block_data + fetch_size, 0, fd->block_size - fetch_size);
256 }
257
Doug Zongker18a78e02014-07-10 07:31:46 -0700258 int result = fd->vtab->read_block(fd->cookie, block, fd->block_data, fetch_size);
259 if (result < 0) return result;
Doug Zongker075ad802014-06-26 15:35:51 -0700260
261 fd->curr_block = block;
262
263 // Verify the hash of the block we just got from the host.
264 //
265 // - If the hash of the just-received data matches the stored hash
266 // for the block, accept it.
267 // - If the stored hash is all zeroes, store the new hash and
268 // accept the block (this is the first time we've read this
269 // block).
270 // - Otherwise, return -EINVAL for the read.
271
272 uint8_t hash[SHA256_DIGEST_SIZE];
273 SHA256_hash(fd->block_data, fd->block_size, hash);
274 uint8_t* blockhash = fd->hashes + block * SHA256_DIGEST_SIZE;
275 if (memcmp(hash, blockhash, SHA256_DIGEST_SIZE) == 0) {
276 return 0;
277 }
278
279 int i;
280 for (i = 0; i < SHA256_DIGEST_SIZE; ++i) {
281 if (blockhash[i] != 0) {
282 fd->curr_block = -1;
283 return -EIO;
284 }
285 }
286
287 memcpy(blockhash, hash, SHA256_DIGEST_SIZE);
288 return 0;
289}
290
291static int handle_read(void* data, struct fuse_data* fd, const struct fuse_in_header* hdr) {
Tao Bao71dc3652015-07-19 08:40:37 -0700292 const struct fuse_read_in* req = reinterpret_cast<const struct fuse_read_in*>(data);
Doug Zongker075ad802014-06-26 15:35:51 -0700293 struct fuse_out_header outhdr;
294 struct iovec vec[3];
295 int vec_used;
296 int result;
297
298 if (hdr->nodeid != PACKAGE_FILE_ID) return -ENOENT;
299
300 uint64_t offset = req->offset;
301 uint32_t size = req->size;
302
303 // The docs on the fuse kernel interface are vague about what to
304 // do when a read request extends past the end of the file. We
305 // can return a short read -- the return structure does include a
306 // length field -- but in testing that caused the program using
307 // the file to segfault. (I speculate that this is due to the
308 // reading program accessing it via mmap; maybe mmap dislikes when
309 // you return something short of a whole page?) To fix this we
310 // zero-pad reads that extend past the end of the file so we're
311 // always returning exactly as many bytes as were requested.
312 // (Users of the mapped file have to know its real length anyway.)
313
314 outhdr.len = sizeof(outhdr) + size;
315 outhdr.error = 0;
316 outhdr.unique = hdr->unique;
317 vec[0].iov_base = &outhdr;
318 vec[0].iov_len = sizeof(outhdr);
319
320 uint32_t block = offset / fd->block_size;
321 result = fetch_block(fd, block);
322 if (result != 0) return result;
323
324 // Two cases:
325 //
326 // - the read request is entirely within this block. In this
327 // case we can reply immediately.
328 //
329 // - the read request goes over into the next block. Note that
330 // since we mount the filesystem with max_read=block_size, a
331 // read can never span more than two blocks. In this case we
332 // copy the block to extra_block and issue a fetch for the
333 // following block.
334
335 uint32_t block_offset = offset - (block * fd->block_size);
336
337 if (size + block_offset <= fd->block_size) {
338 // First case: the read fits entirely in the first block.
339
340 vec[1].iov_base = fd->block_data + block_offset;
341 vec[1].iov_len = size;
342 vec_used = 2;
343 } else {
344 // Second case: the read spills over into the next block.
345
346 memcpy(fd->extra_block, fd->block_data + block_offset,
347 fd->block_size - block_offset);
348 vec[1].iov_base = fd->extra_block;
349 vec[1].iov_len = fd->block_size - block_offset;
350
351 result = fetch_block(fd, block+1);
352 if (result != 0) return result;
353 vec[2].iov_base = fd->block_data;
354 vec[2].iov_len = size - vec[1].iov_len;
355 vec_used = 3;
356 }
357
358 if (writev(fd->ffd, vec, vec_used) < 0) {
359 printf("*** READ REPLY FAILED: %s ***\n", strerror(errno));
360 }
361 return NO_STATUS;
362}
363
Doug Zongker18a78e02014-07-10 07:31:46 -0700364int run_fuse_sideload(struct provider_vtab* vtab, void* cookie,
365 uint64_t file_size, uint32_t block_size)
Doug Zongker075ad802014-06-26 15:35:51 -0700366{
367 int result;
368
369 // If something's already mounted on our mountpoint, try to remove
370 // it. (Mostly in case of a previous abnormal exit.)
Doug Zongker18a78e02014-07-10 07:31:46 -0700371 umount2(FUSE_SIDELOAD_HOST_MOUNTPOINT, MNT_FORCE);
Doug Zongker075ad802014-06-26 15:35:51 -0700372
373 if (block_size < 1024) {
374 fprintf(stderr, "block size (%u) is too small\n", block_size);
375 return -1;
376 }
377 if (block_size > (1<<22)) { // 4 MiB
378 fprintf(stderr, "block size (%u) is too large\n", block_size);
379 return -1;
380 }
381
382 struct fuse_data fd;
383 memset(&fd, 0, sizeof(fd));
Doug Zongker18a78e02014-07-10 07:31:46 -0700384 fd.vtab = vtab;
385 fd.cookie = cookie;
Doug Zongker075ad802014-06-26 15:35:51 -0700386 fd.file_size = file_size;
387 fd.block_size = block_size;
388 fd.file_blocks = (file_size == 0) ? 0 : (((file_size-1) / block_size) + 1);
389
390 if (fd.file_blocks > (1<<18)) {
391 fprintf(stderr, "file has too many blocks (%u)\n", fd.file_blocks);
392 result = -1;
393 goto done;
394 }
395
396 fd.hashes = (uint8_t*)calloc(fd.file_blocks, SHA256_DIGEST_SIZE);
397 if (fd.hashes == NULL) {
398 fprintf(stderr, "failed to allocate %d bites for hashes\n",
399 fd.file_blocks * SHA256_DIGEST_SIZE);
400 result = -1;
401 goto done;
402 }
403
404 fd.uid = getuid();
405 fd.gid = getgid();
406
407 fd.curr_block = -1;
408 fd.block_data = (uint8_t*)malloc(block_size);
409 if (fd.block_data == NULL) {
410 fprintf(stderr, "failed to allocate %d bites for block_data\n", block_size);
411 result = -1;
412 goto done;
413 }
414 fd.extra_block = (uint8_t*)malloc(block_size);
415 if (fd.extra_block == NULL) {
416 fprintf(stderr, "failed to allocate %d bites for extra_block\n", block_size);
417 result = -1;
418 goto done;
419 }
420
421 fd.ffd = open("/dev/fuse", O_RDWR);
422 if (fd.ffd < 0) {
423 perror("open /dev/fuse");
424 result = -1;
425 goto done;
426 }
427
428 char opts[256];
429 snprintf(opts, sizeof(opts),
Elliott Hughes1fdd4522015-03-23 13:33:57 -0700430 ("fd=%d,user_id=%d,group_id=%d,max_read=%u,"
Doug Zongker075ad802014-06-26 15:35:51 -0700431 "allow_other,rootmode=040000"),
432 fd.ffd, fd.uid, fd.gid, block_size);
433
Doug Zongker18a78e02014-07-10 07:31:46 -0700434 result = mount("/dev/fuse", FUSE_SIDELOAD_HOST_MOUNTPOINT,
Doug Zongker075ad802014-06-26 15:35:51 -0700435 "fuse", MS_NOSUID | MS_NODEV | MS_RDONLY | MS_NOEXEC, opts);
436 if (result < 0) {
437 perror("mount");
438 goto done;
439 }
440 uint8_t request_buffer[sizeof(struct fuse_in_header) + PATH_MAX*8];
441 for (;;) {
Elliott Hughes7bad7c42015-04-28 17:24:24 -0700442 ssize_t len = TEMP_FAILURE_RETRY(read(fd.ffd, request_buffer, sizeof(request_buffer)));
443 if (len == -1) {
444 perror("read request");
445 if (errno == ENODEV) {
446 result = -1;
447 break;
Doug Zongker075ad802014-06-26 15:35:51 -0700448 }
449 continue;
450 }
451
452 if ((size_t)len < sizeof(struct fuse_in_header)) {
453 fprintf(stderr, "request too short: len=%zu\n", (size_t)len);
454 continue;
455 }
456
457 struct fuse_in_header* hdr = (struct fuse_in_header*) request_buffer;
458 void* data = request_buffer + sizeof(struct fuse_in_header);
459
460 result = -ENOSYS;
461
462 switch (hdr->opcode) {
463 case FUSE_INIT:
464 result = handle_init(data, &fd, hdr);
465 break;
466
467 case FUSE_LOOKUP:
468 result = handle_lookup(data, &fd, hdr);
469 break;
470
471 case FUSE_GETATTR:
472 result = handle_getattr(data, &fd, hdr);
473 break;
474
475 case FUSE_OPEN:
476 result = handle_open(data, &fd, hdr);
477 break;
478
479 case FUSE_READ:
480 result = handle_read(data, &fd, hdr);
481 break;
482
483 case FUSE_FLUSH:
484 result = handle_flush(data, &fd, hdr);
485 break;
486
487 case FUSE_RELEASE:
488 result = handle_release(data, &fd, hdr);
489 break;
490
491 default:
492 fprintf(stderr, "unknown fuse request opcode %d\n", hdr->opcode);
493 break;
494 }
495
496 if (result == NO_STATUS_EXIT) {
497 result = 0;
498 break;
499 }
500
501 if (result != NO_STATUS) {
502 struct fuse_out_header outhdr;
503 outhdr.len = sizeof(outhdr);
504 outhdr.error = result;
505 outhdr.unique = hdr->unique;
Elliott Hughes7bad7c42015-04-28 17:24:24 -0700506 TEMP_FAILURE_RETRY(write(fd.ffd, &outhdr, sizeof(outhdr)));
Doug Zongker075ad802014-06-26 15:35:51 -0700507 }
508 }
509
510 done:
Doug Zongker18a78e02014-07-10 07:31:46 -0700511 fd.vtab->close(fd.cookie);
512
513 result = umount2(FUSE_SIDELOAD_HOST_MOUNTPOINT, MNT_DETACH);
Doug Zongker075ad802014-06-26 15:35:51 -0700514 if (result < 0) {
515 printf("fuse_sideload umount failed: %s\n", strerror(errno));
516 }
517
518 if (fd.ffd) close(fd.ffd);
519 free(fd.hashes);
520 free(fd.block_data);
521 free(fd.extra_block);
522
523 return result;
524}