1 /*
2 * Copyright (C) 2014 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 // This module creates a special filesystem containing two files.
18 //
19 // "/sideload/package.zip" appears to be a normal file, but reading
20 // from it causes data to be fetched from the adb host. We can use
21 // this to sideload packages over an adb connection without having to
22 // store the entire package in RAM on the device.
23 //
24 // Because we may not trust the adb host, this filesystem maintains
25 // the following invariant: each read of a given position returns the
26 // same data as the first read at that position. That is, once a
27 // section of the file is read, future reads of that section return
28 // the same data. (Otherwise, a malicious adb host process could
29 // return one set of bits when the package is read for signature
30 // verification, and then different bits for when the package is
31 // accessed by the installer.) If the adb host returns something
32 // different than it did on the first read, the reader of the file
33 // will see their read fail with EINVAL.
34 //
35 // The other file, "/sideload/exit", is used to control the subprocess
36 // that creates this filesystem. Calling stat() on the exit file
37 // causes the filesystem to be unmounted and the adb process on the
38 // device shut down.
39 //
40 // Note that only the minimal set of file operations needed for these
41 // two files is implemented. In particular, you can't opendir() or
42 // readdir() on the "/sideload" directory; ls on it won't work.
43
44 #include <ctype.h>
45 #include <dirent.h>
46 #include <errno.h>
47 #include <fcntl.h>
48 #include <limits.h>
49 #include <linux/fuse.h>
50 #include <pthread.h>
51 #include <stdio.h>
52 #include <stdlib.h>
53 #include <string.h>
54 #include <sys/inotify.h>
55 #include <sys/mount.h>
56 #include <sys/param.h>
57 #include <sys/resource.h>
58 #include <sys/stat.h>
59 #include <sys/statfs.h>
60 #include <sys/time.h>
61 #include <sys/uio.h>
62 #include <unistd.h>
63
64 #include "mincrypt/sha256.h"
65 #include "fuse_sideload.h"
66
67 #define PACKAGE_FILE_ID (FUSE_ROOT_ID+1)
68 #define EXIT_FLAG_ID (FUSE_ROOT_ID+2)
69
70 #define NO_STATUS 1
71 #define NO_STATUS_EXIT 2
72
73 struct fuse_data {
74 int ffd; // file descriptor for the fuse socket
75
76 struct provider_vtab* vtab;
77 void* cookie;
78
79 uint64_t file_size; // bytes
80
81 uint32_t block_size; // block size that the adb host is using to send the file to us
82 uint32_t file_blocks; // file size in block_size blocks
83
84 uid_t uid;
85 gid_t gid;
86
87 uint32_t curr_block; // cache the block most recently read from the host
88 uint8_t* block_data;
89
90 uint8_t* extra_block; // another block of storage for reads that
91 // span two blocks
92
93 uint8_t* hashes; // SHA-256 hash of each block (all zeros
94 // if block hasn't been read yet)
95 };
96
fuse_reply(struct fuse_data * fd,__u64 unique,const void * data,size_t len)97 static void fuse_reply(struct fuse_data* fd, __u64 unique, const void *data, size_t len)
98 {
99 struct fuse_out_header hdr;
100 struct iovec vec[2];
101 int res;
102
103 hdr.len = len + sizeof(hdr);
104 hdr.error = 0;
105 hdr.unique = unique;
106
107 vec[0].iov_base = &hdr;
108 vec[0].iov_len = sizeof(hdr);
109 vec[1].iov_base = /* const_cast */(void*)(data);
110 vec[1].iov_len = len;
111
112 res = writev(fd->ffd, vec, 2);
113 if (res < 0) {
114 printf("*** REPLY FAILED *** %s\n", strerror(errno));
115 }
116 }
117
handle_init(void * data,struct fuse_data * fd,const struct fuse_in_header * hdr)118 static int handle_init(void* data, struct fuse_data* fd, const struct fuse_in_header* hdr) {
119 const struct fuse_init_in* req = data;
120 struct fuse_init_out out;
121 size_t fuse_struct_size;
122
123
124 /* Kernel 2.6.16 is the first stable kernel with struct fuse_init_out
125 * defined (fuse version 7.6). The structure is the same from 7.6 through
126 * 7.22. Beginning with 7.23, the structure increased in size and added
127 * new parameters.
128 */
129 if (req->major != FUSE_KERNEL_VERSION || req->minor < 6) {
130 printf("Fuse kernel version mismatch: Kernel version %d.%d, Expected at least %d.6",
131 req->major, req->minor, FUSE_KERNEL_VERSION);
132 return -1;
133 }
134
135 out.minor = MIN(req->minor, FUSE_KERNEL_MINOR_VERSION);
136 fuse_struct_size = sizeof(out);
137 #if defined(FUSE_COMPAT_22_INIT_OUT_SIZE)
138 /* FUSE_KERNEL_VERSION >= 23. */
139
140 /* If the kernel only works on minor revs older than or equal to 22,
141 * then use the older structure size since this code only uses the 7.22
142 * version of the structure. */
143 if (req->minor <= 22) {
144 fuse_struct_size = FUSE_COMPAT_22_INIT_OUT_SIZE;
145 }
146 #endif
147
148 out.major = FUSE_KERNEL_VERSION;
149 out.max_readahead = req->max_readahead;
150 out.flags = 0;
151 out.max_background = 32;
152 out.congestion_threshold = 32;
153 out.max_write = 4096;
154 fuse_reply(fd, hdr->unique, &out, fuse_struct_size);
155
156 return NO_STATUS;
157 }
158
fill_attr(struct fuse_attr * attr,struct fuse_data * fd,uint64_t nodeid,uint64_t size,uint32_t mode)159 static void fill_attr(struct fuse_attr* attr, struct fuse_data* fd,
160 uint64_t nodeid, uint64_t size, uint32_t mode) {
161 memset(attr, 0, sizeof(*attr));
162 attr->nlink = 1;
163 attr->uid = fd->uid;
164 attr->gid = fd->gid;
165 attr->blksize = 4096;
166
167 attr->ino = nodeid;
168 attr->size = size;
169 attr->blocks = (size == 0) ? 0 : (((size-1) / attr->blksize) + 1);
170 attr->mode = mode;
171 }
172
handle_getattr(void * data,struct fuse_data * fd,const struct fuse_in_header * hdr)173 static int handle_getattr(void* data, struct fuse_data* fd, const struct fuse_in_header* hdr) {
174 const struct fuse_getattr_in* req = data;
175 struct fuse_attr_out out;
176 memset(&out, 0, sizeof(out));
177 out.attr_valid = 10;
178
179 if (hdr->nodeid == FUSE_ROOT_ID) {
180 fill_attr(&(out.attr), fd, hdr->nodeid, 4096, S_IFDIR | 0555);
181 } else if (hdr->nodeid == PACKAGE_FILE_ID) {
182 fill_attr(&(out.attr), fd, PACKAGE_FILE_ID, fd->file_size, S_IFREG | 0444);
183 } else if (hdr->nodeid == EXIT_FLAG_ID) {
184 fill_attr(&(out.attr), fd, EXIT_FLAG_ID, 0, S_IFREG | 0);
185 } else {
186 return -ENOENT;
187 }
188
189 fuse_reply(fd, hdr->unique, &out, sizeof(out));
190 return (hdr->nodeid == EXIT_FLAG_ID) ? NO_STATUS_EXIT : NO_STATUS;
191 }
192
handle_lookup(void * data,struct fuse_data * fd,const struct fuse_in_header * hdr)193 static int handle_lookup(void* data, struct fuse_data* fd,
194 const struct fuse_in_header* hdr) {
195 struct fuse_entry_out out;
196 memset(&out, 0, sizeof(out));
197 out.entry_valid = 10;
198 out.attr_valid = 10;
199
200 if (strncmp(FUSE_SIDELOAD_HOST_FILENAME, data,
201 sizeof(FUSE_SIDELOAD_HOST_FILENAME)) == 0) {
202 out.nodeid = PACKAGE_FILE_ID;
203 out.generation = PACKAGE_FILE_ID;
204 fill_attr(&(out.attr), fd, PACKAGE_FILE_ID, fd->file_size, S_IFREG | 0444);
205 } else if (strncmp(FUSE_SIDELOAD_HOST_EXIT_FLAG, data,
206 sizeof(FUSE_SIDELOAD_HOST_EXIT_FLAG)) == 0) {
207 out.nodeid = EXIT_FLAG_ID;
208 out.generation = EXIT_FLAG_ID;
209 fill_attr(&(out.attr), fd, EXIT_FLAG_ID, 0, S_IFREG | 0);
210 } else {
211 return -ENOENT;
212 }
213
214 fuse_reply(fd, hdr->unique, &out, sizeof(out));
215 return (out.nodeid == EXIT_FLAG_ID) ? NO_STATUS_EXIT : NO_STATUS;
216 }
217
handle_open(void * data,struct fuse_data * fd,const struct fuse_in_header * hdr)218 static int handle_open(void* data, struct fuse_data* fd, const struct fuse_in_header* hdr) {
219 const struct fuse_open_in* req = data;
220
221 if (hdr->nodeid == EXIT_FLAG_ID) return -EPERM;
222 if (hdr->nodeid != PACKAGE_FILE_ID) return -ENOENT;
223
224 struct fuse_open_out out;
225 memset(&out, 0, sizeof(out));
226 out.fh = 10; // an arbitrary number; we always use the same handle
227 fuse_reply(fd, hdr->unique, &out, sizeof(out));
228 return NO_STATUS;
229 }
230
handle_flush(void * data,struct fuse_data * fd,const struct fuse_in_header * hdr)231 static int handle_flush(void* data, struct fuse_data* fd, const struct fuse_in_header* hdr) {
232 return 0;
233 }
234
handle_release(void * data,struct fuse_data * fd,const struct fuse_in_header * hdr)235 static int handle_release(void* data, struct fuse_data* fd, const struct fuse_in_header* hdr) {
236 return 0;
237 }
238
239 // Fetch a block from the host into fd->curr_block and fd->block_data.
240 // Returns 0 on successful fetch, negative otherwise.
fetch_block(struct fuse_data * fd,uint32_t block)241 static int fetch_block(struct fuse_data* fd, uint32_t block) {
242 if (block == fd->curr_block) {
243 return 0;
244 }
245
246 if (block >= fd->file_blocks) {
247 memset(fd->block_data, 0, fd->block_size);
248 fd->curr_block = block;
249 return 0;
250 }
251
252 size_t fetch_size = fd->block_size;
253 if (block * fd->block_size + fetch_size > fd->file_size) {
254 // If we're reading the last (partial) block of the file,
255 // expect a shorter response from the host, and pad the rest
256 // of the block with zeroes.
257 fetch_size = fd->file_size - (block * fd->block_size);
258 memset(fd->block_data + fetch_size, 0, fd->block_size - fetch_size);
259 }
260
261 int result = fd->vtab->read_block(fd->cookie, block, fd->block_data, fetch_size);
262 if (result < 0) return result;
263
264 fd->curr_block = block;
265
266 // Verify the hash of the block we just got from the host.
267 //
268 // - If the hash of the just-received data matches the stored hash
269 // for the block, accept it.
270 // - If the stored hash is all zeroes, store the new hash and
271 // accept the block (this is the first time we've read this
272 // block).
273 // - Otherwise, return -EINVAL for the read.
274
275 uint8_t hash[SHA256_DIGEST_SIZE];
276 SHA256_hash(fd->block_data, fd->block_size, hash);
277 uint8_t* blockhash = fd->hashes + block * SHA256_DIGEST_SIZE;
278 if (memcmp(hash, blockhash, SHA256_DIGEST_SIZE) == 0) {
279 return 0;
280 }
281
282 int i;
283 for (i = 0; i < SHA256_DIGEST_SIZE; ++i) {
284 if (blockhash[i] != 0) {
285 fd->curr_block = -1;
286 return -EIO;
287 }
288 }
289
290 memcpy(blockhash, hash, SHA256_DIGEST_SIZE);
291 return 0;
292 }
293
handle_read(void * data,struct fuse_data * fd,const struct fuse_in_header * hdr)294 static int handle_read(void* data, struct fuse_data* fd, const struct fuse_in_header* hdr) {
295 const struct fuse_read_in* req = data;
296 struct fuse_out_header outhdr;
297 struct iovec vec[3];
298 int vec_used;
299 int result;
300
301 if (hdr->nodeid != PACKAGE_FILE_ID) return -ENOENT;
302
303 uint64_t offset = req->offset;
304 uint32_t size = req->size;
305
306 // The docs on the fuse kernel interface are vague about what to
307 // do when a read request extends past the end of the file. We
308 // can return a short read -- the return structure does include a
309 // length field -- but in testing that caused the program using
310 // the file to segfault. (I speculate that this is due to the
311 // reading program accessing it via mmap; maybe mmap dislikes when
312 // you return something short of a whole page?) To fix this we
313 // zero-pad reads that extend past the end of the file so we're
314 // always returning exactly as many bytes as were requested.
315 // (Users of the mapped file have to know its real length anyway.)
316
317 outhdr.len = sizeof(outhdr) + size;
318 outhdr.error = 0;
319 outhdr.unique = hdr->unique;
320 vec[0].iov_base = &outhdr;
321 vec[0].iov_len = sizeof(outhdr);
322
323 uint32_t block = offset / fd->block_size;
324 result = fetch_block(fd, block);
325 if (result != 0) return result;
326
327 // Two cases:
328 //
329 // - the read request is entirely within this block. In this
330 // case we can reply immediately.
331 //
332 // - the read request goes over into the next block. Note that
333 // since we mount the filesystem with max_read=block_size, a
334 // read can never span more than two blocks. In this case we
335 // copy the block to extra_block and issue a fetch for the
336 // following block.
337
338 uint32_t block_offset = offset - (block * fd->block_size);
339
340 if (size + block_offset <= fd->block_size) {
341 // First case: the read fits entirely in the first block.
342
343 vec[1].iov_base = fd->block_data + block_offset;
344 vec[1].iov_len = size;
345 vec_used = 2;
346 } else {
347 // Second case: the read spills over into the next block.
348
349 memcpy(fd->extra_block, fd->block_data + block_offset,
350 fd->block_size - block_offset);
351 vec[1].iov_base = fd->extra_block;
352 vec[1].iov_len = fd->block_size - block_offset;
353
354 result = fetch_block(fd, block+1);
355 if (result != 0) return result;
356 vec[2].iov_base = fd->block_data;
357 vec[2].iov_len = size - vec[1].iov_len;
358 vec_used = 3;
359 }
360
361 if (writev(fd->ffd, vec, vec_used) < 0) {
362 printf("*** READ REPLY FAILED: %s ***\n", strerror(errno));
363 }
364 return NO_STATUS;
365 }
366
run_fuse_sideload(struct provider_vtab * vtab,void * cookie,uint64_t file_size,uint32_t block_size)367 int run_fuse_sideload(struct provider_vtab* vtab, void* cookie,
368 uint64_t file_size, uint32_t block_size)
369 {
370 int result;
371
372 // If something's already mounted on our mountpoint, try to remove
373 // it. (Mostly in case of a previous abnormal exit.)
374 umount2(FUSE_SIDELOAD_HOST_MOUNTPOINT, MNT_FORCE);
375
376 if (block_size < 1024) {
377 fprintf(stderr, "block size (%u) is too small\n", block_size);
378 return -1;
379 }
380 if (block_size > (1<<22)) { // 4 MiB
381 fprintf(stderr, "block size (%u) is too large\n", block_size);
382 return -1;
383 }
384
385 struct fuse_data fd;
386 memset(&fd, 0, sizeof(fd));
387 fd.vtab = vtab;
388 fd.cookie = cookie;
389 fd.file_size = file_size;
390 fd.block_size = block_size;
391 fd.file_blocks = (file_size == 0) ? 0 : (((file_size-1) / block_size) + 1);
392
393 if (fd.file_blocks > (1<<18)) {
394 fprintf(stderr, "file has too many blocks (%u)\n", fd.file_blocks);
395 result = -1;
396 goto done;
397 }
398
399 fd.hashes = (uint8_t*)calloc(fd.file_blocks, SHA256_DIGEST_SIZE);
400 if (fd.hashes == NULL) {
401 fprintf(stderr, "failed to allocate %d bites for hashes\n",
402 fd.file_blocks * SHA256_DIGEST_SIZE);
403 result = -1;
404 goto done;
405 }
406
407 fd.uid = getuid();
408 fd.gid = getgid();
409
410 fd.curr_block = -1;
411 fd.block_data = (uint8_t*)malloc(block_size);
412 if (fd.block_data == NULL) {
413 fprintf(stderr, "failed to allocate %d bites for block_data\n", block_size);
414 result = -1;
415 goto done;
416 }
417 fd.extra_block = (uint8_t*)malloc(block_size);
418 if (fd.extra_block == NULL) {
419 fprintf(stderr, "failed to allocate %d bites for extra_block\n", block_size);
420 result = -1;
421 goto done;
422 }
423
424 fd.ffd = open("/dev/fuse", O_RDWR);
425 if (fd.ffd < 0) {
426 perror("open /dev/fuse");
427 result = -1;
428 goto done;
429 }
430
431 char opts[256];
432 snprintf(opts, sizeof(opts),
433 ("fd=%d,user_id=%d,group_id=%d,max_read=%u,"
434 "allow_other,rootmode=040000"),
435 fd.ffd, fd.uid, fd.gid, block_size);
436
437 result = mount("/dev/fuse", FUSE_SIDELOAD_HOST_MOUNTPOINT,
438 "fuse", MS_NOSUID | MS_NODEV | MS_RDONLY | MS_NOEXEC, opts);
439 if (result < 0) {
440 perror("mount");
441 goto done;
442 }
443 uint8_t request_buffer[sizeof(struct fuse_in_header) + PATH_MAX*8];
444 for (;;) {
445 ssize_t len = TEMP_FAILURE_RETRY(read(fd.ffd, request_buffer, sizeof(request_buffer)));
446 if (len == -1) {
447 perror("read request");
448 if (errno == ENODEV) {
449 result = -1;
450 break;
451 }
452 continue;
453 }
454
455 if ((size_t)len < sizeof(struct fuse_in_header)) {
456 fprintf(stderr, "request too short: len=%zu\n", (size_t)len);
457 continue;
458 }
459
460 struct fuse_in_header* hdr = (struct fuse_in_header*) request_buffer;
461 void* data = request_buffer + sizeof(struct fuse_in_header);
462
463 result = -ENOSYS;
464
465 switch (hdr->opcode) {
466 case FUSE_INIT:
467 result = handle_init(data, &fd, hdr);
468 break;
469
470 case FUSE_LOOKUP:
471 result = handle_lookup(data, &fd, hdr);
472 break;
473
474 case FUSE_GETATTR:
475 result = handle_getattr(data, &fd, hdr);
476 break;
477
478 case FUSE_OPEN:
479 result = handle_open(data, &fd, hdr);
480 break;
481
482 case FUSE_READ:
483 result = handle_read(data, &fd, hdr);
484 break;
485
486 case FUSE_FLUSH:
487 result = handle_flush(data, &fd, hdr);
488 break;
489
490 case FUSE_RELEASE:
491 result = handle_release(data, &fd, hdr);
492 break;
493
494 default:
495 fprintf(stderr, "unknown fuse request opcode %d\n", hdr->opcode);
496 break;
497 }
498
499 if (result == NO_STATUS_EXIT) {
500 result = 0;
501 break;
502 }
503
504 if (result != NO_STATUS) {
505 struct fuse_out_header outhdr;
506 outhdr.len = sizeof(outhdr);
507 outhdr.error = result;
508 outhdr.unique = hdr->unique;
509 TEMP_FAILURE_RETRY(write(fd.ffd, &outhdr, sizeof(outhdr)));
510 }
511 }
512
513 done:
514 fd.vtab->close(fd.cookie);
515
516 result = umount2(FUSE_SIDELOAD_HOST_MOUNTPOINT, MNT_DETACH);
517 if (result < 0) {
518 printf("fuse_sideload umount failed: %s\n", strerror(errno));
519 }
520
521 if (fd.ffd) close(fd.ffd);
522 free(fd.hashes);
523 free(fd.block_data);
524 free(fd.extra_block);
525
526 return result;
527 }
528