Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add a whitelist of sockets on fork.

Browse Source 
Maintain a whitelist of AF_UNIX sockets that are permitted
to exist at the time of forking. If an open socket does not belong
to the whitelist (or is not AF_UNIX), the process will abort. If an
open socket is whitelisted, it will be redirected to /dev/null after
a sucessful fork. This allows us to unify our handling of the special
zygote sockets (/dev/socket/zygote[_secondary]) with the existing
whitelist of non socket file descriptors.

This change also removes non-fatal ALOGW messages since they have the
side effect of reopening the logging socket.

bug: 30963384
Change-Id: Ie04dac62d0e0f29354df9ac15af217ad652ffbbe
This commit is contained in:
Narayan Kamath
2016-08-30 15:36:19 +01:00
parent 0a272fcba7
commit 3764a260f0
2 changed files with 107 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
core/jni/com_android_internal_os_Zygote.cpp
View File

@@ -454,6 +454,10 @@ static pid_t ForkAndSpecializeCommon(JNIEnv* env, uid_t uid, gid_t gid, jintArra
SetForkLoad(true);
#endif
// Close any logging related FDs before we start evaluating the list of
// file descriptors.
__android_log_close();
// If this is the first fork for this zygote, create the open FD table.
// If it isn't, we just need to check whether the list of open files has
// changed (and it shouldn't in the normal case).
@@ -477,7 +481,7 @@ static pid_t ForkAndSpecializeCommon(JNIEnv* env, uid_t uid, gid_t gid, jintArra
// Re-open all remaining open file descriptors so that they aren't shared
// with the zygote across a fork.
if (!gOpenFdTable->Reopen()) {
if (!gOpenFdTable->ReopenOrDetach()) {
RuntimeAbort(env, __LINE__, "Unable to reopen whitelisted descriptors.");
}

120
core/jni/fd_utils-inl.h
View File

@@ -25,22 +25,32 @@
#include <grp.h>
#include <inttypes.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/un.h>
#include <unistd.h>
#include <cutils/log.h>
#include "JNIHelp.h"
#include "ScopedPrimitiveArray.h"
// Whitelist of open paths that the zygote is allowed to keep open
// that will be recreated across forks. In addition to files here,
// all files ending with ".jar" under /system/framework" are
// whitelisted. See FileDescriptorInfo::IsWhitelisted for the
// canonical definition.
// Whitelist of open paths that the zygote is allowed to keep open.
//
// In addition to the paths listed here, all files ending with
// ".jar" under /system/framework" are whitelisted. See
// FileDescriptorInfo::IsWhitelisted for the canonical definition.
//
// If the whitelisted path is associated with a regular file or a
// character device, the file is reopened after a fork with the same
// offset and mode. If the whilelisted path is associated with a
// AF_UNIX socket, the socket will refer to /dev/null after each
// fork, and all operations on it will fail.
static const char* kPathWhitelist[] = {
"/dev/null",
"/dev/pmsg0",
"/dev/socket/zygote",
"/dev/socket/zygote_secondary",
"/system/etc/event-log-tags",
"/sys/kernel/debug/tracing/trace_marker",
"/system/framework/framework-res.apk",
@@ -65,9 +75,17 @@ class FileDescriptorInfo {
return NULL;
}
// Ignore (don't reopen or fail on) socket fds for now.
if (S_ISSOCK(f_stat.st_mode)) {
ALOGW("Unsupported socket FD: %d, ignoring.", fd);
std::string socket_name;
if (!GetSocketName(fd, &socket_name)) {
return NULL;
}
if (!IsWhitelisted(socket_name)) {
ALOGE("Socket name not whitelisted : %s (fd=%d)", socket_name.c_str(), fd);
return NULL;
}
return new FileDescriptorInfo(fd);
}
@@ -146,10 +164,9 @@ class FileDescriptorInfo {
return f_stat.st_ino == stat.st_ino && f_stat.st_dev == stat.st_dev;
}
bool Reopen() const {
// Always skip over socket FDs for now.
bool ReopenOrDetach() const {
if (is_sock) {
return true;
return DetachSocket();
}
// NOTE: This might happen if the file was unlinked after being opened.
@@ -186,9 +203,7 @@ class FileDescriptorInfo {
return false;
}
if (close(new_fd) == -1) {
ALOGW("Failed close(%d) : %s", new_fd, strerror(errno));
}
close(new_fd);
return true;
}
@@ -264,6 +279,74 @@ class FileDescriptorInfo {
return true;
}
// Returns the locally-bound name of the socket |fd|. Returns true
// iff. all of the following hold :
//
// - the socket's sa_family is AF_UNIX.
// - the length of the path is greater than zero (i.e, not an unnamed socket).
// - the first byte of the path isn't zero (i.e, not a socket with an abstract
// address).
static bool GetSocketName(const int fd, std::string* result) {
sockaddr_storage ss;
sockaddr* addr = reinterpret_cast<sockaddr*>(&ss);
socklen_t addr_len = sizeof(ss);
if (TEMP_FAILURE_RETRY(getsockname(fd, addr, &addr_len)) == -1) {
ALOGE("Failed getsockname(%d) : %s", fd, strerror(errno));
return false;
}
if (addr->sa_family != AF_UNIX) {
ALOGE("Unsupported socket (fd=%d) with family %d", fd, addr->sa_family);
return false;
}
const sockaddr_un* unix_addr = reinterpret_cast<const sockaddr_un*>(&ss);
size_t path_len = addr_len - offsetof(struct sockaddr_un, sun_path);
// This is an unnamed local socket, we do not accept it.
if (path_len == 0) {
ALOGE("Unsupported AF_UNIX socket (fd=%d) with empty path.", fd);
return false;
}
// This is a local socket with an abstract address, we do not accept it.
if (unix_addr->sun_path[0] == '\0') {
ALOGE("Unsupported AF_UNIX socket (fd=%d) with abstract address.", fd);
return false;
}
// If we're here, sun_path must refer to a null terminated filesystem
// pathname (man 7 unix). Remove the terminator before assigning it to an
// std::string.
if (unix_addr->sun_path[path_len - 1] == '\0') {
--path_len;
}
result->assign(unix_addr->sun_path, path_len);
return true;
}
bool DetachSocket() const {
const int dev_null_fd = open("/dev/null", O_RDWR);
if (dev_null_fd < 0) {
ALOGE("Failed to open /dev/null : %s", strerror(errno));
return false;
}
if (dup2(dev_null_fd, fd) == -1) {
ALOGE("Failed dup2 on socket descriptor %d : %s", fd, strerror(errno));
return false;
}
if (close(dev_null_fd) == -1) {
ALOGE("Failed close(%d) : %s", dev_null_fd, strerror(errno));
return false;
}
return true;
}
DISALLOW_COPY_AND_ASSIGN(FileDescriptorInfo);
};
@@ -337,12 +420,13 @@ class FileDescriptorTable {
}
// Reopens all file descriptors that are contained in the table. Returns true
// if all descriptors were re-opened, and false if an error occurred.
bool Reopen() {
// if all descriptors were successfully re-opened or detached, and false if an
// error occurred.
bool ReopenOrDetach() {
std::unordered_map<int, FileDescriptorInfo*>::const_iterator it;
for (it = open_fd_map_.begin(); it != open_fd_map_.end(); ++it) {
const FileDescriptorInfo* info = it->second;
if (info == NULL || !info->Reopen()) {
if (info == NULL || !info->ReopenOrDetach()) {
return false;
}
}
@@ -373,7 +457,7 @@ class FileDescriptorTable {
//
// TODO(narayan): This will be an error in a future android release.
// error = true;
ALOGW("Zygote closed file descriptor %d.", it->first);
// ALOGW("Zygote closed file descriptor %d.", it->first);
open_fd_map_.erase(it);
} else {
// The entry from the file descriptor table is still open. Restat
@@ -404,7 +488,7 @@ class FileDescriptorTable {
//
// TODO(narayan): This will be an error in a future android release.
// error = true;
ALOGW("Zygote opened %zd new file descriptor(s).", open_fds.size());
// ALOGW("Zygote opened %zd new file descriptor(s).", open_fds.size());
// TODO(narayan): This code will be removed in a future android release.
std::set<int>::const_iterator it;