1 /*
2  * Copyright (C) 2014 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include "berberis/kernel_api/open_emulation.h"
18 
19 #include <fcntl.h>
20 #include <sys/stat.h>
21 #include <unistd.h>
22 
23 #include <cstdio>
24 #include <cstring>
25 #include <mutex>
26 #include <utility>
27 
28 #include "berberis/base/arena_alloc.h"
29 #include "berberis/base/arena_map.h"
30 #include "berberis/base/arena_string.h"
31 #include "berberis/base/arena_vector.h"
32 #include "berberis/base/checks.h"
33 #include "berberis/base/fd.h"
34 #include "berberis/base/tracing.h"
35 #include "berberis/guest_os_primitives/guest_map_shadow.h"
36 #include "berberis/guest_state/guest_addr.h"
37 #include "berberis/kernel_api/main_executable_real_path_emulation.h"
38 
39 namespace berberis {
40 
41 namespace {
42 
43 class EmulatedFileDescriptors {
44  public:
EmulatedFileDescriptors()45   explicit EmulatedFileDescriptors() : fds_(&arena_) {}
46 
GetInstance()47   static EmulatedFileDescriptors* GetInstance() {
48     static EmulatedFileDescriptors g_emulated_proc_self_maps_fds;
49     return &g_emulated_proc_self_maps_fds;
50   }
51 
52   // Not copyable or movable.
53   EmulatedFileDescriptors(const EmulatedFileDescriptors&) = delete;
54   EmulatedFileDescriptors& operator=(const EmulatedFileDescriptors&) = delete;
55 
Add(int fd)56   void Add(int fd) {
57     std::lock_guard lock(mutex_);
58     auto [unused_it, inserted] = fds_.insert(std::make_pair(fd, 0));
59     if (!inserted) {
60       // We expect every fd to be added at most once. But if it breaks let's consider it non-fatal.
61       TRACE("Detected duplicated fd in EmulatedFileDescriptors");
62     }
63   }
64 
Contains(int fd)65   bool Contains(int fd) {
66     std::lock_guard lock(mutex_);
67     return fds_.find(fd) != fds_.end();
68   }
69 
Remove(int fd)70   void Remove(int fd) {
71     std::lock_guard lock(mutex_);
72     auto it = fds_.find(fd);
73     if (it != fds_.end()) {
74       fds_.erase(it);
75     }
76   }
77 
78  private:
79   std::mutex mutex_;
80   Arena arena_;
81   // We use it as a set because we don't have ArenaSet, so client data isn't really used.
82   ArenaMap<int, int> fds_;
83 };
84 
85 // It's macro since we use it as string literal below.
86 #define PROC_SELF_MAPS "/proc/self/maps"
87 
88 // Reader that works with custom allocator strings. Based on android::base::ReadFileToString.
89 template <typename String>
ReadProcSelfMapsToString(String & content)90 bool ReadProcSelfMapsToString(String& content) {
91   int fd = open(PROC_SELF_MAPS, O_RDONLY);
92   if (fd == -1) {
93     return false;
94   }
95   char buf[4096] __attribute__((__uninitialized__));
96   ssize_t n;
97   while ((n = read(fd, &buf[0], sizeof(buf))) > 0) {
98     content.append(buf, n);
99   }
100   close(fd);
101   return n == 0;
102 }
103 
104 // String split that works with custom allocator strings. Based on android::base::Split.
105 template <typename String>
SplitLines(Arena * arena,const String & content)106 ArenaVector<String> SplitLines(Arena* arena, const String& content) {
107   ArenaVector<String> lines(arena);
108   size_t base = 0;
109   size_t found;
110   while (true) {
111     found = content.find_first_of('\n', base);
112     lines.emplace_back(content, base, found - base, content.get_allocator());
113     if (found == content.npos) break;
114     base = found + 1;
115   }
116   return lines;
117 }
118 
119 // Note that dirfd, flags and mode are only used to fallback to
120 // host's openat in case of failure.
121 // Avoid mallocs since bionic tests use it under malloc_disable (b/338211718).
OpenatProcSelfMapsForGuest(int dirfd,int flags,mode_t mode)122 int OpenatProcSelfMapsForGuest(int dirfd, int flags, mode_t mode) {
123   TRACE("Openat for " PROC_SELF_MAPS);
124 
125   Arena arena;
126   ArenaString file_data(&arena);
127   bool success = ReadProcSelfMapsToString(file_data);
128   if (!success) {
129     TRACE("Cannot read " PROC_SELF_MAPS ", falling back to host's openat");
130     return openat(dirfd, PROC_SELF_MAPS, flags, mode);
131   }
132 
133   int mem_fd = CreateMemfdOrDie("[guest " PROC_SELF_MAPS "]");
134 
135   auto* maps_shadow = GuestMapShadow::GetInstance();
136 
137   auto lines = SplitLines(&arena, file_data);
138   ArenaString guest_maps(&arena);
139   for (size_t i = 0; i < lines.size(); i++) {
140     uintptr_t start;
141     uintptr_t end;
142     int prot_offset;
143     if (sscanf(lines.at(i).c_str(), "%" SCNxPTR "-%" SCNxPTR " %n", &start, &end, &prot_offset) !=
144         2) {
145       if (!lines[i].empty()) {
146         TRACE("Cannot parse " PROC_SELF_MAPS " line : %s", lines.at(i).c_str());
147       }
148       guest_maps.append(lines.at(i) + "\n");
149       continue;
150     }
151     BitValue exec_status = maps_shadow->GetExecutable(GuestAddr(start), end - start);
152     if (exec_status == kBitMixed) {
153       // When we strip guest executable bit from host mappings the kernel may merge r-- and r-x
154       // mappings, resulting in kBitMixed executability state. We are avoiding such merging by
155       // SetVmaAnonName in MmapForGuest/MprotectForGuest. This isn't strictly guaranteed to work, so
156       // issue a warning if it doesn't, or if we got kBitMixed for another reason to investigate.
157       // TODO(b/322873334): Instead split such host mapping into several guest mappings.
158       TRACE("Unexpected " PROC_SELF_MAPS " mapping with mixed guest executability");
159     }
160     // prot_offset points to "rwxp", so offset of "x" is 2 symbols away.
161     lines.at(i).at(prot_offset + 2) = (exec_status == kBitSet) ? 'x' : '-';
162 
163     guest_maps.append(lines.at(i) + "\n");
164   }
165 
166   // Normally /proc/self/maps doesn't have newline at the end.
167   // It's simpler to remove it than to not add it in the loop.
168   CHECK_EQ(guest_maps.back(), '\n');
169   guest_maps.pop_back();
170 
171   TRACE("--------\n%s\n--------", guest_maps.c_str());
172 
173   WriteFullyOrDie(mem_fd, guest_maps.c_str(), guest_maps.size());
174 
175   lseek(mem_fd, 0, 0);
176 
177   EmulatedFileDescriptors::GetInstance()->Add(mem_fd);
178 
179   return mem_fd;
180 }
181 
IsProcSelfMaps(const char * path,int flags)182 bool IsProcSelfMaps(const char* path, int flags) {
183   struct stat cur_stat;
184   struct stat proc_stat;
185   // This check works for /proc/self/maps itself as well as symlinks (unless AT_SYMLINK_NOFOLLOW is
186   // requested). As an added benefit it gracefully handles invalid pointers in path.
187   return stat(path, &cur_stat) == 0 && stat(PROC_SELF_MAPS, &proc_stat) == 0 &&
188          !(S_ISLNK(cur_stat.st_mode) && (flags & AT_SYMLINK_NOFOLLOW)) &&
189          cur_stat.st_ino == proc_stat.st_ino && cur_stat.st_dev == proc_stat.st_dev;
190 }
191 
192 // In zygote this is not needed because native bridge is mounting
193 // /proc/cpuinfo to point to the emulated version. But for executables
194 // this does not happen and they end up reading host cpuinfo.
195 //
196 // Note that current selinux policies prevent us from mounting /proc/cpuinfo
197 // (replicating what zygote process does) for executables hence we need to
198 // emulate it here.
TryTranslateProcCpuinfoPath(const char * path,int flags)199 const char* TryTranslateProcCpuinfoPath(const char* path, int flags) {
200 #if defined(__ANDROID__)
201   struct stat cur_stat;
202   struct stat cpuinfo_stat;
203 
204   if (stat(path, &cur_stat) == -1 || stat("/proc/cpuinfo", &cpuinfo_stat) == -1) {
205     return nullptr;
206   }
207 
208   if (S_ISLNK(cur_stat.st_mode) && (flags & AT_SYMLINK_NOFOLLOW)) {
209     return nullptr;
210   }
211 
212   if ((cur_stat.st_ino == cpuinfo_stat.st_ino) && (cur_stat.st_dev == cpuinfo_stat.st_dev)) {
213     TRACE("openat: Translating %s to %s", path, kGuestCpuinfoPath);
214     return kGuestCpuinfoPath;
215   }
216 #else
217   UNUSED(path, flags);
218 #endif
219   return nullptr;
220 }
221 
222 }  // namespace
223 
IsFileDescriptorEmulatedProcSelfMaps(int fd)224 bool IsFileDescriptorEmulatedProcSelfMaps(int fd) {
225   return EmulatedFileDescriptors::GetInstance()->Contains(fd);
226 }
227 
CloseEmulatedProcSelfMapsFileDescriptor(int fd)228 void CloseEmulatedProcSelfMapsFileDescriptor(int fd) {
229   EmulatedFileDescriptors::GetInstance()->Remove(fd);
230 }
231 
OpenatForGuest(int dirfd,const char * path,int guest_flags,mode_t mode)232 int OpenatForGuest(int dirfd, const char* path, int guest_flags, mode_t mode) {
233   int host_flags = ToHostOpenFlags(guest_flags);
234 
235   if (IsProcSelfMaps(path, host_flags)) {
236     return OpenatProcSelfMapsForGuest(dirfd, host_flags, mode);
237   }
238 
239   const char* real_path = nullptr;
240   if ((host_flags & AT_SYMLINK_NOFOLLOW) == 0) {
241     real_path = TryReadLinkToMainExecutableRealPath(path);
242   }
243 
244   if (real_path == nullptr) {
245     real_path = TryTranslateProcCpuinfoPath(path, host_flags);
246   }
247 
248   return openat(dirfd, real_path != nullptr ? real_path : path, host_flags, mode);
249 }
250 
OpenForGuest(const char * path,int flags,mode_t mode)251 int OpenForGuest(const char* path, int flags, mode_t mode) {
252   return OpenatForGuest(AT_FDCWD, path, flags, mode);
253 }
254 
255 }  // namespace berberis
256