Add a remote binder service for executing commands
To summarize, three binaries are involved to run a command remotely:
- pvm_exec: the client executable on the host side to wrap the
executable command with hints of FD passing
- compsvc: listen to requests, spin off and sandbox a worker for
execution setup
- compsvc_worker: set up authfs, prepare the fds and exec the actual
task
Please see the code documentation for details.
Bug: 171316742
Test: [shell 1] adb shell compsvc /system/bin/sleep
[shell 2] adb shell exec 8</dev/zero 7<>/dev/null pvm_exec
--in-fd 8 --out-fd 7 -- sleep 300
# Saw FDs in /proc/${sleep_pid}/fd
Change-Id: I4758a4dc7bc70b6e5cce79e151c84c9990d9bc89
diff --git a/compos/src/compsvc.rs b/compos/src/compsvc.rs
new file mode 100644
index 0000000..e912463
--- /dev/null
+++ b/compos/src/compsvc.rs
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//! compsvc is a service to run computational tasks in a PVM upon request. It is able to set up
+//! file descriptors backed by fd_server and pass the file descriptors to the actual tasks for
+//! read/write. The service also attempts to sandbox the execution so that one task cannot leak or
+//! impact future tasks.
+//!
+//! Example:
+//! $ compsvc /system/bin/sleep
+//!
+//! The current architecture / process hierarchy looks like:
+//! - compsvc (handle requests)
+//! - compsvc_worker (for environment setup)
+//! - authfs (fd translation)
+//! - actual task
+
+use anyhow::{bail, Context, Result};
+use log::error;
+use minijail::{self, Minijail};
+use std::path::PathBuf;
+
+use compos_aidl_interface::aidl::com::android::compos::ICompService::{
+ BnCompService, ICompService,
+};
+use compos_aidl_interface::aidl::com::android::compos::Metadata::Metadata;
+use compos_aidl_interface::binder::{
+ add_service, BinderFeatures, Interface, ProcessState, Result as BinderResult, Status,
+ StatusCode, Strong,
+};
+
+const SERVICE_NAME: &str = "compsvc";
+// TODO(b/161470604): Move the executable into an apex.
+const WORKER_BIN: &str = "/system/bin/compsvc_worker";
+// TODO: Replace with a valid directory setup in the VM.
+const AUTHFS_MOUNTPOINT: &str = "/data/local/tmp/authfs_mnt";
+
+struct CompService {
+ worker_bin: PathBuf,
+ task_bin: String,
+ debuggable: bool,
+}
+
+impl CompService {
+ pub fn new_binder(service: CompService) -> Strong<dyn ICompService> {
+ BnCompService::new_binder(service, BinderFeatures::default())
+ }
+
+ fn run_worker_in_jail_and_wait(&self, args: &[String]) -> Result<(), minijail::Error> {
+ let mut jail = Minijail::new()?;
+
+ // TODO(b/185175567): New user and uid namespace when supported. Run as nobody.
+ // New mount namespace to isolate the FUSE mount.
+ jail.namespace_vfs();
+
+ let inheritable_fds = if self.debuggable {
+ vec![1, 2] // inherit/redirect stdout/stderr for debugging
+ } else {
+ vec![]
+ };
+ let _pid = jail.run(&self.worker_bin, &inheritable_fds, &args)?;
+ jail.wait()
+ }
+
+ fn build_worker_args(&self, args: &[String], metadata: &Metadata) -> Vec<String> {
+ let mut worker_args = vec![
+ WORKER_BIN.to_string(),
+ "--authfs-root".to_string(),
+ AUTHFS_MOUNTPOINT.to_string(),
+ ];
+ for annotation in &metadata.input_fd_annotations {
+ worker_args.push("--in-fd".to_string());
+ worker_args.push(format!("{}:{}", annotation.fd, annotation.file_size));
+ }
+ for annotation in &metadata.output_fd_annotations {
+ worker_args.push("--out-fd".to_string());
+ worker_args.push(annotation.fd.to_string());
+ }
+ if self.debuggable {
+ worker_args.push("--debug".to_string());
+ }
+ worker_args.push("--".to_string());
+
+ // Do not accept arbitrary code execution. We want to execute some specific task of this
+ // service. Use the associated executable.
+ worker_args.push(self.task_bin.clone());
+ worker_args.extend_from_slice(&args[1..]);
+ worker_args
+ }
+}
+
+impl Interface for CompService {}
+
+impl ICompService for CompService {
+ fn execute(&self, args: &[String], metadata: &Metadata) -> BinderResult<i8> {
+ let worker_args = self.build_worker_args(args, metadata);
+
+ match self.run_worker_in_jail_and_wait(&worker_args) {
+ Ok(_) => Ok(0), // TODO(b/161471326): Sign the output on succeed.
+ Err(minijail::Error::ReturnCode(exit_code)) => {
+ error!("Task failed with exit code {}", exit_code);
+ Err(Status::from(StatusCode::FAILED_TRANSACTION))
+ }
+ Err(e) => {
+ error!("Unexpected error: {}", e);
+ Err(Status::from(StatusCode::UNKNOWN_ERROR))
+ }
+ }
+ }
+}
+
+fn parse_args() -> Result<CompService> {
+ #[rustfmt::skip]
+ let matches = clap::App::new("compsvc")
+ .arg(clap::Arg::with_name("debug")
+ .long("debug"))
+ .arg(clap::Arg::with_name("task_bin")
+ .required(true))
+ .get_matches();
+
+ Ok(CompService {
+ task_bin: matches.value_of("task_bin").unwrap().to_string(),
+ worker_bin: PathBuf::from(WORKER_BIN),
+ debuggable: matches.is_present("debug"),
+ })
+}
+
+fn main() -> Result<()> {
+ android_logger::init_once(
+ android_logger::Config::default().with_tag("compsvc").with_min_level(log::Level::Debug),
+ );
+
+ let service = parse_args()?;
+
+ ProcessState::start_thread_pool();
+ // TODO: switch to remote binder
+ add_service(SERVICE_NAME, CompService::new_binder(service).as_binder())
+ .with_context(|| format!("Failed to register service {}", SERVICE_NAME))?;
+ ProcessState::join_thread_pool();
+ bail!("Unexpected exit after join_thread_pool")
+}