blob: ab228e1e0c6ee948d443fab3add6ae041ba1c6c4 [file] [log] [blame]
Victor Hsieh51789de2021-08-06 16:50:49 -07001/*
2 * Copyright (C) 2021 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
Alan Stokesfadcef22022-01-24 17:00:59 +000017use anyhow::{anyhow, bail, Context, Result};
Victor Hsieh616f8222022-01-14 13:06:32 -080018use log::{debug, info, warn};
Victor Hsieh51789de2021-08-06 16:50:49 -070019use minijail::{self, Minijail};
Alan Stokes92472512022-01-04 11:48:38 +000020use regex::Regex;
Alan Stokes2d2e4db2022-01-28 16:41:52 +000021use rustutils::system_properties;
Alan Stokesfadcef22022-01-24 17:00:59 +000022use std::collections::HashMap;
Victor Hsiehf9968692021-11-18 11:34:39 -080023use std::env;
Alan Stokes92472512022-01-04 11:48:38 +000024use std::ffi::OsString;
Alan Stokes35bac3c2021-12-16 14:37:24 +000025use std::path::{self, Path, PathBuf};
Alan Stokes92472512022-01-04 11:48:38 +000026use std::process::Command;
Victor Hsieh51789de2021-08-06 16:50:49 -070027
28use authfs_aidl_interface::aidl::com::android::virt::fs::{
Victor Hsieh015bcb52021-11-17 17:28:01 -080029 AuthFsConfig::{
Victor Hsiehf9968692021-11-18 11:34:39 -080030 AuthFsConfig, InputDirFdAnnotation::InputDirFdAnnotation,
Victor Hsieh616f8222022-01-14 13:06:32 -080031 OutputDirFdAnnotation::OutputDirFdAnnotation,
Victor Hsieh015bcb52021-11-17 17:28:01 -080032 },
Victor Hsieh015bcb52021-11-17 17:28:01 -080033 IAuthFsService::IAuthFsService,
Victor Hsieh51789de2021-08-06 16:50:49 -070034};
Alan Stokes0e82b502022-08-08 14:44:48 +010035use binder::Strong;
Alan Stokes2d2e4db2022-01-28 16:41:52 +000036use compos_aidl_interface::aidl::com::android::compos::ICompOsService::CompilationMode::CompilationMode;
Alan Stokes46a1dff2021-12-14 10:56:05 +000037use compos_common::odrefresh::ExitCode;
Victor Hsieh51789de2021-08-06 16:50:49 -070038
Victor Hsiehf9968692021-11-18 11:34:39 -080039const FD_SERVER_PORT: i32 = 3264; // TODO: support dynamic port
40
Alan Stokes46a1dff2021-12-14 10:56:05 +000041pub struct OdrefreshContext<'a> {
Alan Stokes2d2e4db2022-01-28 16:41:52 +000042 compilation_mode: CompilationMode,
Victor Hsiehf9968692021-11-18 11:34:39 -080043 system_dir_fd: i32,
44 output_dir_fd: i32,
Alan Stokes9646db92021-12-14 13:22:33 +000045 staging_dir_fd: i32,
Alan Stokes46a1dff2021-12-14 10:56:05 +000046 target_dir_name: &'a str,
47 zygote_arch: &'a str,
Victor Hsieh9bfbc5f2021-12-16 11:45:10 -080048 system_server_compiler_filter: &'a str,
Alan Stokes46a1dff2021-12-14 10:56:05 +000049}
50
51impl<'a> OdrefreshContext<'a> {
52 pub fn new(
Alan Stokes2d2e4db2022-01-28 16:41:52 +000053 compilation_mode: CompilationMode,
Alan Stokes46a1dff2021-12-14 10:56:05 +000054 system_dir_fd: i32,
55 output_dir_fd: i32,
56 staging_dir_fd: i32,
57 target_dir_name: &'a str,
58 zygote_arch: &'a str,
Victor Hsieh9bfbc5f2021-12-16 11:45:10 -080059 system_server_compiler_filter: &'a str,
Alan Stokes46a1dff2021-12-14 10:56:05 +000060 ) -> Result<Self> {
Alan Stokes2d2e4db2022-01-28 16:41:52 +000061 if compilation_mode != CompilationMode::NORMAL_COMPILE {
Andrew Scull65ddfc42022-02-14 21:03:58 +000062 // Conservatively check debuggability.
63 let debuggable =
64 system_properties::read_bool("ro.boot.microdroid.app_debuggable", false)
65 .unwrap_or(false);
Alan Stokes2d2e4db2022-01-28 16:41:52 +000066 if !debuggable {
67 bail!("Requested compilation mode only available in debuggable VMs");
68 }
69 }
70
Alan Stokes46a1dff2021-12-14 10:56:05 +000071 if system_dir_fd < 0 || output_dir_fd < 0 || staging_dir_fd < 0 {
72 bail!("The remote FDs are expected to be non-negative");
73 }
Victor Hsieh9bfbc5f2021-12-16 11:45:10 -080074 if !matches!(zygote_arch, "zygote64" | "zygote64_32") {
Alan Stokes46a1dff2021-12-14 10:56:05 +000075 bail!("Invalid zygote arch");
76 }
Alan Stokes35bac3c2021-12-16 14:37:24 +000077 // Disallow any sort of path traversal
78 if target_dir_name.contains(path::MAIN_SEPARATOR) {
79 bail!("Invalid target directory {}", target_dir_name);
80 }
81
Victor Hsieh9bfbc5f2021-12-16 11:45:10 -080082 // We're not validating/allowlisting the compiler filter, and just assume the compiler will
83 // reject an invalid string. We need to accept "verify" filter anyway, and potential
84 // performance degration by the attacker is not currently in scope. This also allows ART to
85 // specify new compiler filter and configure through system property without change to
86 // CompOS.
87
88 Ok(Self {
Alan Stokes2d2e4db2022-01-28 16:41:52 +000089 compilation_mode,
Victor Hsieh9bfbc5f2021-12-16 11:45:10 -080090 system_dir_fd,
91 output_dir_fd,
92 staging_dir_fd,
93 target_dir_name,
94 zygote_arch,
95 system_server_compiler_filter,
96 })
Alan Stokes46a1dff2021-12-14 10:56:05 +000097 }
98}
99
Victor Hsiehec38ae22022-02-10 00:06:26 +0000100pub fn odrefresh<F>(
Alan Stokes46a1dff2021-12-14 10:56:05 +0000101 odrefresh_path: &Path,
102 context: OdrefreshContext,
Victor Hsiehf9968692021-11-18 11:34:39 -0800103 authfs_service: Strong<dyn IAuthFsService>,
Victor Hsiehec38ae22022-02-10 00:06:26 +0000104 success_fn: F,
105) -> Result<ExitCode>
106where
107 F: FnOnce(PathBuf) -> Result<()>,
108{
Victor Hsiehf9968692021-11-18 11:34:39 -0800109 // Mount authfs (via authfs_service). The authfs instance unmounts once the `authfs` variable
110 // is out of scope.
111 let authfs_config = AuthFsConfig {
112 port: FD_SERVER_PORT,
113 inputDirFdAnnotations: vec![InputDirFdAnnotation {
Alan Stokes46a1dff2021-12-14 10:56:05 +0000114 fd: context.system_dir_fd,
Victor Hsieh99782572022-01-05 15:38:33 -0800115 // 0 is the index of extra_apks in vm_config_extra_apk.json
116 manifestPath: "/mnt/extra-apk/0/assets/build_manifest.pb".to_string(),
117 prefix: "system/".to_string(),
Victor Hsiehf9968692021-11-18 11:34:39 -0800118 }],
Alan Stokes9646db92021-12-14 13:22:33 +0000119 outputDirFdAnnotations: vec![
Alan Stokes46a1dff2021-12-14 10:56:05 +0000120 OutputDirFdAnnotation { fd: context.output_dir_fd },
121 OutputDirFdAnnotation { fd: context.staging_dir_fd },
Alan Stokes9646db92021-12-14 13:22:33 +0000122 ],
Victor Hsiehf9968692021-11-18 11:34:39 -0800123 ..Default::default()
124 };
125 let authfs = authfs_service.mount(&authfs_config)?;
126 let mountpoint = PathBuf::from(authfs.getMountPoint()?);
127
Alan Stokesfadcef22022-01-24 17:00:59 +0000128 // Make a copy of our environment as the basis of the one we will give odrefresh
129 let mut odrefresh_vars = EnvMap::from_current_env();
130
Victor Hsiehf9968692021-11-18 11:34:39 -0800131 let mut android_root = mountpoint.clone();
Alan Stokes46a1dff2021-12-14 10:56:05 +0000132 android_root.push(context.system_dir_fd.to_string());
Victor Hsiehf9968692021-11-18 11:34:39 -0800133 android_root.push("system");
Alan Stokesfadcef22022-01-24 17:00:59 +0000134 odrefresh_vars.set("ANDROID_ROOT", path_to_str(&android_root)?);
Alan Stokes46a1dff2021-12-14 10:56:05 +0000135 debug!("ANDROID_ROOT={:?}", &android_root);
Victor Hsiehf9968692021-11-18 11:34:39 -0800136
Alan Stokes46a1dff2021-12-14 10:56:05 +0000137 let art_apex_data = mountpoint.join(context.output_dir_fd.to_string());
Alan Stokesfadcef22022-01-24 17:00:59 +0000138 odrefresh_vars.set("ART_APEX_DATA", path_to_str(&art_apex_data)?);
Alan Stokes46a1dff2021-12-14 10:56:05 +0000139 debug!("ART_APEX_DATA={:?}", &art_apex_data);
Victor Hsieh64df53d2021-11-30 17:09:51 -0800140
Alan Stokes46a1dff2021-12-14 10:56:05 +0000141 let staging_dir = mountpoint.join(context.staging_dir_fd.to_string());
Victor Hsiehf9968692021-11-18 11:34:39 -0800142
Alan Stokesfadcef22022-01-24 17:00:59 +0000143 set_classpaths(&mut odrefresh_vars, &android_root)?;
Alan Stokes92472512022-01-04 11:48:38 +0000144
Victor Hsieh9bfbc5f2021-12-16 11:45:10 -0800145 let mut args = vec![
Victor Hsiehf9968692021-11-18 11:34:39 -0800146 "odrefresh".to_string(),
Alan Stokes48c1d2b2022-01-10 15:54:04 +0000147 "--compilation-os-mode".to_string(),
Alan Stokes46a1dff2021-12-14 10:56:05 +0000148 format!("--zygote-arch={}", context.zygote_arch),
149 format!("--dalvik-cache={}", context.target_dir_name),
Victor Hsiehf9968692021-11-18 11:34:39 -0800150 format!("--staging-dir={}", staging_dir.display()),
Victor Hsieh9bfbc5f2021-12-16 11:45:10 -0800151 "--no-refresh".to_string(),
Victor Hsiehf9968692021-11-18 11:34:39 -0800152 ];
Victor Hsieh9bfbc5f2021-12-16 11:45:10 -0800153
154 if !context.system_server_compiler_filter.is_empty() {
155 args.push(format!(
156 "--system-server-compiler-filter={}",
157 context.system_server_compiler_filter
158 ));
159 }
Alan Stokes48c1d2b2022-01-10 15:54:04 +0000160
Alan Stokes2d2e4db2022-01-28 16:41:52 +0000161 let compile_flag = match context.compilation_mode {
162 CompilationMode::NORMAL_COMPILE => "--compile",
163 CompilationMode::TEST_COMPILE => "--force-compile",
164 other => bail!("Unknown compilation mode {:?}", other),
165 };
166 args.push(compile_flag.to_string());
Victor Hsieh9bfbc5f2021-12-16 11:45:10 -0800167
Alan Stokes9646db92021-12-14 13:22:33 +0000168 debug!("Running odrefresh with args: {:?}", &args);
Alan Stokesfadcef22022-01-24 17:00:59 +0000169 let jail = spawn_jailed_task(odrefresh_path, &args, &odrefresh_vars.into_env())
Victor Hsiehf9968692021-11-18 11:34:39 -0800170 .context("Spawn odrefresh")?;
Alan Stokes46a1dff2021-12-14 10:56:05 +0000171 let exit_code = match jail.wait() {
Alan Stokes2d2e4db2022-01-28 16:41:52 +0000172 Ok(_) => 0,
173 Err(minijail::Error::ReturnCode(exit_code)) => exit_code,
174 Err(e) => bail!("Unexpected minijail error: {}", e),
175 };
Alan Stokes46a1dff2021-12-14 10:56:05 +0000176
Alan Stokes126fd512021-12-16 15:00:01 +0000177 let exit_code = ExitCode::from_i32(exit_code.into())?;
Alan Stokes46a1dff2021-12-14 10:56:05 +0000178 info!("odrefresh exited with {:?}", exit_code);
179
180 if exit_code == ExitCode::CompilationSuccess {
Alan Stokes46a1dff2021-12-14 10:56:05 +0000181 let target_dir = art_apex_data.join(context.target_dir_name);
Victor Hsiehec38ae22022-02-10 00:06:26 +0000182 success_fn(target_dir)?;
Victor Hsiehf9968692021-11-18 11:34:39 -0800183 }
Alan Stokes46a1dff2021-12-14 10:56:05 +0000184
185 Ok(exit_code)
186}
187
Alan Stokesfadcef22022-01-24 17:00:59 +0000188fn path_to_str(path: &Path) -> Result<&str> {
189 path.to_str().ok_or_else(|| anyhow!("Bad path {:?}", path))
190}
191
192fn set_classpaths(odrefresh_vars: &mut EnvMap, android_root: &Path) -> Result<()> {
Alan Stokes92472512022-01-04 11:48:38 +0000193 let export_lines = run_derive_classpath(android_root)?;
Alan Stokesfadcef22022-01-24 17:00:59 +0000194 load_classpath_vars(odrefresh_vars, &export_lines)
Alan Stokes92472512022-01-04 11:48:38 +0000195}
196
197fn run_derive_classpath(android_root: &Path) -> Result<String> {
198 let classpaths_root = android_root.join("etc/classpaths");
199
200 let mut bootclasspath_arg = OsString::new();
201 bootclasspath_arg.push("--bootclasspath-fragment=");
202 bootclasspath_arg.push(classpaths_root.join("bootclasspath.pb"));
203
204 let mut systemserverclasspath_arg = OsString::new();
205 systemserverclasspath_arg.push("--systemserverclasspath-fragment=");
206 systemserverclasspath_arg.push(classpaths_root.join("systemserverclasspath.pb"));
207
208 let result = Command::new("/apex/com.android.sdkext/bin/derive_classpath")
209 .arg(bootclasspath_arg)
210 .arg(systemserverclasspath_arg)
211 .arg("/proc/self/fd/1")
212 .output()
213 .context("Failed to run derive_classpath")?;
214
215 if !result.status.success() {
216 bail!("derive_classpath returned {}", result.status);
217 }
218
219 String::from_utf8(result.stdout).context("Converting derive_classpath output")
220}
221
Alan Stokesfadcef22022-01-24 17:00:59 +0000222fn load_classpath_vars(odrefresh_vars: &mut EnvMap, export_lines: &str) -> Result<()> {
Alan Stokes92472512022-01-04 11:48:38 +0000223 // Each line should be in the format "export <var name> <value>"
224 let pattern = Regex::new(r"^export ([^ ]+) ([^ ]+)$").context("Failed to construct Regex")?;
225 for line in export_lines.lines() {
226 if let Some(captures) = pattern.captures(line) {
227 let name = &captures[1];
228 let value = &captures[2];
Alan Stokesfadcef22022-01-24 17:00:59 +0000229 odrefresh_vars.set(name, value);
Alan Stokes92472512022-01-04 11:48:38 +0000230 } else {
231 warn!("Malformed line from derive_classpath: {}", line);
232 }
233 }
234
235 Ok(())
236}
237
Alan Stokesfadcef22022-01-24 17:00:59 +0000238fn spawn_jailed_task(executable: &Path, args: &[String], env_vars: &[String]) -> Result<Minijail> {
Victor Hsieh51789de2021-08-06 16:50:49 -0700239 // TODO(b/185175567): Run in a more restricted sandbox.
240 let jail = Minijail::new()?;
Alan Stokesfadcef22022-01-24 17:00:59 +0000241 let keep_fds = [];
242 let command = minijail::Command::new_for_path(executable, &keep_fds, args, Some(env_vars))?;
243 let _pid = jail.run_command(command)?;
Victor Hsieh51789de2021-08-06 16:50:49 -0700244 Ok(jail)
245}
Alan Stokesfadcef22022-01-24 17:00:59 +0000246
247struct EnvMap(HashMap<String, String>);
248
249impl EnvMap {
250 fn from_current_env() -> Self {
251 Self(env::vars().collect())
252 }
253
254 fn set(&mut self, key: &str, value: &str) {
255 self.0.insert(key.to_owned(), value.to_owned());
256 }
257
258 fn into_env(self) -> Vec<String> {
259 // execve() expects an array of "k=v" strings, rather than a list of (k, v) pairs.
260 self.0.into_iter().map(|(k, v)| k + "=" + &v).collect()
261 }
262}