David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 1 | // Copyright 2021, The Android Open Source Project |
| 2 | // |
| 3 | // Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | // you may not use this file except in compliance with the License. |
| 5 | // You may obtain a copy of the License at |
| 6 | // |
| 7 | // http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | // |
| 9 | // Unless required by applicable law or agreed to in writing, software |
| 10 | // distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | // See the License for the specific language governing permissions and |
| 13 | // limitations under the License. |
| 14 | |
| 15 | //! Implementation of the AIDL interface of the VirtualizationService. |
| 16 | |
| 17 | use crate::{get_calling_pid, get_calling_uid}; |
David Brazdil | 33a3102 | 2023-01-12 16:55:16 +0000 | [diff] [blame] | 18 | use crate::atom::{forward_vm_booted_atom, forward_vm_creation_atom, forward_vm_exited_atom}; |
Alice Wang | c2fec93 | 2023-02-23 16:24:02 +0000 | [diff] [blame] | 19 | use crate::rkpvm::request_certificate; |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 20 | use android_os_permissions_aidl::aidl::android::os::IPermissionController; |
Alice Wang | c2fec93 | 2023-02-23 16:24:02 +0000 | [diff] [blame] | 21 | use android_system_virtualizationservice::{ |
Inseob Kim | 53d0b21 | 2023-07-20 16:58:37 +0900 | [diff] [blame] | 22 | aidl::android::system::virtualizationservice::AssignableDevice::AssignableDevice, |
Alice Wang | c2fec93 | 2023-02-23 16:24:02 +0000 | [diff] [blame] | 23 | aidl::android::system::virtualizationservice::VirtualMachineDebugInfo::VirtualMachineDebugInfo, |
| 24 | binder::ParcelFileDescriptor, |
| 25 | }; |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 26 | use android_system_virtualizationservice_internal::aidl::android::system::virtualizationservice_internal::{ |
| 27 | AtomVmBooted::AtomVmBooted, |
| 28 | AtomVmCreationRequested::AtomVmCreationRequested, |
| 29 | AtomVmExited::AtomVmExited, |
| 30 | IGlobalVmContext::{BnGlobalVmContext, IGlobalVmContext}, |
| 31 | IVirtualizationServiceInternal::IVirtualizationServiceInternal, |
| 32 | }; |
| 33 | use android_system_virtualmachineservice::aidl::android::system::virtualmachineservice::IVirtualMachineService::VM_TOMBSTONES_SERVICE_PORT; |
Alice Wang | d1b11a0 | 2023-04-18 12:30:20 +0000 | [diff] [blame] | 34 | use anyhow::{anyhow, ensure, Context, Result}; |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 35 | use binder::{self, BinderFeatures, ExceptionCode, Interface, LazyServiceGuard, Status, Strong}; |
Inseob Kim | 1ca0f65 | 2023-07-20 17:18:12 +0900 | [diff] [blame] | 36 | use lazy_static::lazy_static; |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 37 | use libc::VMADDR_CID_HOST; |
| 38 | use log::{error, info, warn}; |
| 39 | use rustutils::system_properties; |
Inseob Kim | 6ef8097 | 2023-07-20 17:23:36 +0900 | [diff] [blame^] | 40 | use std::collections::HashMap; |
Inseob Kim | 1ca0f65 | 2023-07-20 17:18:12 +0900 | [diff] [blame] | 41 | use std::fs::{canonicalize, create_dir, remove_dir_all, set_permissions, File, Permissions}; |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 42 | use std::io::{Read, Write}; |
Inseob Kim | 1ca0f65 | 2023-07-20 17:18:12 +0900 | [diff] [blame] | 43 | use std::os::fd::FromRawFd; |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 44 | use std::os::unix::fs::PermissionsExt; |
| 45 | use std::os::unix::raw::{pid_t, uid_t}; |
Inseob Kim | 1ca0f65 | 2023-07-20 17:18:12 +0900 | [diff] [blame] | 46 | use std::path::{Path, PathBuf}; |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 47 | use std::sync::{Arc, Mutex, Weak}; |
| 48 | use tombstoned_client::{DebuggerdDumpType, TombstonedConnection}; |
| 49 | use vsock::{VsockListener, VsockStream}; |
Inseob Kim | 1ca0f65 | 2023-07-20 17:18:12 +0900 | [diff] [blame] | 50 | use nix::fcntl::OFlag; |
| 51 | use nix::unistd::{chown, pipe2, Uid}; |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 52 | |
| 53 | /// The unique ID of a VM used (together with a port number) for vsock communication. |
| 54 | pub type Cid = u32; |
| 55 | |
| 56 | pub const BINDER_SERVICE_IDENTIFIER: &str = "android.system.virtualizationservice"; |
| 57 | |
| 58 | /// Directory in which to write disk image files used while running VMs. |
| 59 | pub const TEMPORARY_DIRECTORY: &str = "/data/misc/virtualizationservice"; |
| 60 | |
| 61 | /// The first CID to assign to a guest VM managed by the VirtualizationService. CIDs lower than this |
| 62 | /// are reserved for the host or other usage. |
| 63 | const GUEST_CID_MIN: Cid = 2048; |
| 64 | const GUEST_CID_MAX: Cid = 65535; |
| 65 | |
| 66 | const SYSPROP_LAST_CID: &str = "virtualizationservice.state.last_cid"; |
| 67 | |
| 68 | const CHUNK_RECV_MAX_LEN: usize = 1024; |
| 69 | |
| 70 | fn is_valid_guest_cid(cid: Cid) -> bool { |
| 71 | (GUEST_CID_MIN..=GUEST_CID_MAX).contains(&cid) |
| 72 | } |
| 73 | |
| 74 | /// Singleton service for allocating globally-unique VM resources, such as the CID, and running |
| 75 | /// singleton servers, like tombstone receiver. |
| 76 | #[derive(Debug, Default)] |
| 77 | pub struct VirtualizationServiceInternal { |
| 78 | state: Arc<Mutex<GlobalState>>, |
| 79 | } |
| 80 | |
| 81 | impl VirtualizationServiceInternal { |
| 82 | pub fn init() -> VirtualizationServiceInternal { |
| 83 | let service = VirtualizationServiceInternal::default(); |
| 84 | |
| 85 | std::thread::spawn(|| { |
| 86 | if let Err(e) = handle_stream_connection_tombstoned() { |
| 87 | warn!("Error receiving tombstone from guest or writing them. Error: {:?}", e); |
| 88 | } |
| 89 | }); |
| 90 | |
| 91 | service |
| 92 | } |
| 93 | } |
| 94 | |
| 95 | impl Interface for VirtualizationServiceInternal {} |
| 96 | |
| 97 | impl IVirtualizationServiceInternal for VirtualizationServiceInternal { |
| 98 | fn removeMemlockRlimit(&self) -> binder::Result<()> { |
| 99 | let pid = get_calling_pid(); |
| 100 | let lim = libc::rlimit { rlim_cur: libc::RLIM_INFINITY, rlim_max: libc::RLIM_INFINITY }; |
| 101 | |
Andrew Walbran | b58d1b4 | 2023-07-07 13:54:49 +0100 | [diff] [blame] | 102 | // SAFETY: borrowing the new limit struct only |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 103 | let ret = unsafe { libc::prlimit(pid, libc::RLIMIT_MEMLOCK, &lim, std::ptr::null_mut()) }; |
| 104 | |
| 105 | match ret { |
| 106 | 0 => Ok(()), |
| 107 | -1 => Err(Status::new_exception_str( |
| 108 | ExceptionCode::ILLEGAL_STATE, |
| 109 | Some(std::io::Error::last_os_error().to_string()), |
| 110 | )), |
| 111 | n => Err(Status::new_exception_str( |
| 112 | ExceptionCode::ILLEGAL_STATE, |
| 113 | Some(format!("Unexpected return value from prlimit(): {n}")), |
| 114 | )), |
| 115 | } |
| 116 | } |
| 117 | |
| 118 | fn allocateGlobalVmContext( |
| 119 | &self, |
| 120 | requester_debug_pid: i32, |
| 121 | ) -> binder::Result<Strong<dyn IGlobalVmContext>> { |
| 122 | check_manage_access()?; |
| 123 | |
| 124 | let requester_uid = get_calling_uid(); |
| 125 | let requester_debug_pid = requester_debug_pid as pid_t; |
| 126 | let state = &mut *self.state.lock().unwrap(); |
| 127 | state.allocate_vm_context(requester_uid, requester_debug_pid).map_err(|e| { |
| 128 | Status::new_exception_str(ExceptionCode::ILLEGAL_STATE, Some(e.to_string())) |
| 129 | }) |
| 130 | } |
| 131 | |
| 132 | fn atomVmBooted(&self, atom: &AtomVmBooted) -> Result<(), Status> { |
| 133 | forward_vm_booted_atom(atom); |
| 134 | Ok(()) |
| 135 | } |
| 136 | |
| 137 | fn atomVmCreationRequested(&self, atom: &AtomVmCreationRequested) -> Result<(), Status> { |
| 138 | forward_vm_creation_atom(atom); |
| 139 | Ok(()) |
| 140 | } |
| 141 | |
| 142 | fn atomVmExited(&self, atom: &AtomVmExited) -> Result<(), Status> { |
| 143 | forward_vm_exited_atom(atom); |
| 144 | Ok(()) |
| 145 | } |
| 146 | |
| 147 | fn debugListVms(&self) -> binder::Result<Vec<VirtualMachineDebugInfo>> { |
| 148 | check_debug_access()?; |
| 149 | |
| 150 | let state = &mut *self.state.lock().unwrap(); |
| 151 | let cids = state |
| 152 | .held_contexts |
| 153 | .iter() |
| 154 | .filter_map(|(_, inst)| Weak::upgrade(inst)) |
| 155 | .map(|vm| VirtualMachineDebugInfo { |
| 156 | cid: vm.cid as i32, |
| 157 | temporaryDirectory: vm.get_temp_dir().to_string_lossy().to_string(), |
| 158 | requesterUid: vm.requester_uid as i32, |
Charisee | 96113f3 | 2023-01-26 09:00:42 +0000 | [diff] [blame] | 159 | requesterPid: vm.requester_debug_pid, |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 160 | }) |
| 161 | .collect(); |
| 162 | Ok(cids) |
| 163 | } |
Alice Wang | c2fec93 | 2023-02-23 16:24:02 +0000 | [diff] [blame] | 164 | |
| 165 | fn requestCertificate( |
| 166 | &self, |
| 167 | csr: &[u8], |
| 168 | instance_img_fd: &ParcelFileDescriptor, |
| 169 | ) -> binder::Result<Vec<u8>> { |
| 170 | check_manage_access()?; |
| 171 | info!("Received csr. Getting certificate..."); |
| 172 | request_certificate(csr, instance_img_fd).map_err(|e| { |
| 173 | error!("Failed to get certificate. Error: {e:?}"); |
| 174 | Status::new_exception_str(ExceptionCode::SERVICE_SPECIFIC, Some(e.to_string())) |
| 175 | }) |
| 176 | } |
Inseob Kim | 53d0b21 | 2023-07-20 16:58:37 +0900 | [diff] [blame] | 177 | |
| 178 | fn getAssignableDevices(&self) -> binder::Result<Vec<AssignableDevice>> { |
| 179 | check_use_custom_virtual_machine()?; |
| 180 | |
| 181 | // TODO(b/291191362): read VM DTBO to find assignable devices. |
| 182 | Ok(vec![AssignableDevice { |
| 183 | kind: "eh".to_owned(), |
| 184 | node: "/sys/bus/platform/devices/16d00000.eh".to_owned(), |
| 185 | }]) |
| 186 | } |
Inseob Kim | 1ca0f65 | 2023-07-20 17:18:12 +0900 | [diff] [blame] | 187 | |
| 188 | fn bindDevicesToVfioDriver(&self, devices: &[String]) -> binder::Result<ParcelFileDescriptor> { |
| 189 | check_use_custom_virtual_machine()?; |
| 190 | |
Inseob Kim | 6ef8097 | 2023-07-20 17:23:36 +0900 | [diff] [blame^] | 191 | devices.iter().try_for_each(|x| bind_device(x))?; |
Inseob Kim | 1ca0f65 | 2023-07-20 17:18:12 +0900 | [diff] [blame] | 192 | |
| 193 | // TODO(b/278008182): create a file descriptor containing DTBO for devices. |
| 194 | let (raw_read, raw_write) = pipe2(OFlag::O_CLOEXEC).map_err(|e| { |
| 195 | Status::new_exception_str( |
| 196 | ExceptionCode::SERVICE_SPECIFIC, |
| 197 | Some(format!("can't create fd for DTBO: {e:?}")), |
| 198 | ) |
| 199 | })?; |
| 200 | // SAFETY: We are the sole owner of this FD as we just created it, and it is valid and open. |
| 201 | let read_fd = unsafe { File::from_raw_fd(raw_read) }; |
| 202 | // SAFETY: We are the sole owner of this FD as we just created it, and it is valid and open. |
| 203 | let _write_fd = unsafe { File::from_raw_fd(raw_write) }; |
| 204 | |
| 205 | Ok(ParcelFileDescriptor::new(read_fd)) |
| 206 | } |
| 207 | } |
| 208 | |
| 209 | lazy_static! { |
| 210 | static ref SYSFS_PLATFORM_DEVICES: &'static Path = Path::new("/sys/devices/platform/"); |
| 211 | static ref VFIO_PLATFORM_DRIVER: &'static Path = |
| 212 | Path::new("/sys/bus/platform/drivers/vfio-platform"); |
| 213 | } |
| 214 | |
| 215 | fn bind_device(device: &str) -> binder::Result<()> { |
| 216 | // Check platform device exists |
| 217 | let dev_sysfs_path = canonicalize(device).map_err(|e| { |
| 218 | Status::new_exception_str( |
| 219 | ExceptionCode::SERVICE_SPECIFIC, |
| 220 | Some(format!("can't canonicalize: {e:?}")), |
| 221 | ) |
| 222 | })?; |
| 223 | if !dev_sysfs_path.starts_with(*SYSFS_PLATFORM_DEVICES) { |
| 224 | return Err(Status::new_exception_str( |
| 225 | ExceptionCode::ILLEGAL_ARGUMENT, |
| 226 | Some(format!("{device} is not a platform device")), |
| 227 | )); |
| 228 | } |
| 229 | |
| 230 | // Check platform device is bound to VFIO driver |
| 231 | let dev_driver_path = canonicalize(dev_sysfs_path.join("driver")).map_err(|e| { |
| 232 | Status::new_exception_str( |
| 233 | ExceptionCode::SERVICE_SPECIFIC, |
| 234 | Some(format!("can't canonicalize: {e:?}")), |
| 235 | ) |
| 236 | })?; |
| 237 | if dev_driver_path != *VFIO_PLATFORM_DRIVER { |
| 238 | // TODO(b/278008182): unbind driver and bind to VFIO |
| 239 | return Err(Status::new_exception_str( |
| 240 | ExceptionCode::UNSUPPORTED_OPERATION, |
| 241 | Some("not implemented".to_owned()), |
| 242 | )); |
| 243 | } |
| 244 | |
| 245 | // already bound to VFIO driver |
| 246 | Ok(()) |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 247 | } |
| 248 | |
| 249 | #[derive(Debug, Default)] |
| 250 | struct GlobalVmInstance { |
| 251 | /// The unique CID assigned to the VM for vsock communication. |
| 252 | cid: Cid, |
| 253 | /// UID of the client who requested this VM instance. |
| 254 | requester_uid: uid_t, |
| 255 | /// PID of the client who requested this VM instance. |
| 256 | requester_debug_pid: pid_t, |
| 257 | } |
| 258 | |
| 259 | impl GlobalVmInstance { |
| 260 | fn get_temp_dir(&self) -> PathBuf { |
| 261 | let cid = self.cid; |
| 262 | format!("{TEMPORARY_DIRECTORY}/{cid}").into() |
| 263 | } |
| 264 | } |
| 265 | |
| 266 | /// The mutable state of the VirtualizationServiceInternal. There should only be one instance |
| 267 | /// of this struct. |
| 268 | #[derive(Debug, Default)] |
| 269 | struct GlobalState { |
| 270 | /// VM contexts currently allocated to running VMs. A CID is never recycled as long |
| 271 | /// as there is a strong reference held by a GlobalVmContext. |
| 272 | held_contexts: HashMap<Cid, Weak<GlobalVmInstance>>, |
| 273 | } |
| 274 | |
| 275 | impl GlobalState { |
| 276 | /// Get the next available CID, or an error if we have run out. The last CID used is stored in |
| 277 | /// a system property so that restart of virtualizationservice doesn't reuse CID while the host |
| 278 | /// Android is up. |
| 279 | fn get_next_available_cid(&mut self) -> Result<Cid> { |
| 280 | // Start trying to find a CID from the last used CID + 1. This ensures |
| 281 | // that we do not eagerly recycle CIDs. It makes debugging easier but |
| 282 | // also means that retrying to allocate a CID, eg. because it is |
| 283 | // erroneously occupied by a process, will not recycle the same CID. |
| 284 | let last_cid_prop = |
| 285 | system_properties::read(SYSPROP_LAST_CID)?.and_then(|val| match val.parse::<Cid>() { |
| 286 | Ok(num) => { |
| 287 | if is_valid_guest_cid(num) { |
| 288 | Some(num) |
| 289 | } else { |
| 290 | error!("Invalid value '{}' of property '{}'", num, SYSPROP_LAST_CID); |
| 291 | None |
| 292 | } |
| 293 | } |
| 294 | Err(_) => { |
| 295 | error!("Invalid value '{}' of property '{}'", val, SYSPROP_LAST_CID); |
| 296 | None |
| 297 | } |
| 298 | }); |
| 299 | |
| 300 | let first_cid = if let Some(last_cid) = last_cid_prop { |
| 301 | if last_cid == GUEST_CID_MAX { |
| 302 | GUEST_CID_MIN |
| 303 | } else { |
| 304 | last_cid + 1 |
| 305 | } |
| 306 | } else { |
| 307 | GUEST_CID_MIN |
| 308 | }; |
| 309 | |
| 310 | let cid = self |
| 311 | .find_available_cid(first_cid..=GUEST_CID_MAX) |
| 312 | .or_else(|| self.find_available_cid(GUEST_CID_MIN..first_cid)) |
| 313 | .ok_or_else(|| anyhow!("Could not find an available CID."))?; |
| 314 | |
| 315 | system_properties::write(SYSPROP_LAST_CID, &format!("{}", cid))?; |
| 316 | Ok(cid) |
| 317 | } |
| 318 | |
| 319 | fn find_available_cid<I>(&self, mut range: I) -> Option<Cid> |
| 320 | where |
| 321 | I: Iterator<Item = Cid>, |
| 322 | { |
| 323 | range.find(|cid| !self.held_contexts.contains_key(cid)) |
| 324 | } |
| 325 | |
| 326 | fn allocate_vm_context( |
| 327 | &mut self, |
| 328 | requester_uid: uid_t, |
| 329 | requester_debug_pid: pid_t, |
| 330 | ) -> Result<Strong<dyn IGlobalVmContext>> { |
| 331 | // Garbage collect unused VM contexts. |
| 332 | self.held_contexts.retain(|_, instance| instance.strong_count() > 0); |
| 333 | |
| 334 | let cid = self.get_next_available_cid()?; |
| 335 | let instance = Arc::new(GlobalVmInstance { cid, requester_uid, requester_debug_pid }); |
| 336 | create_temporary_directory(&instance.get_temp_dir(), requester_uid)?; |
| 337 | |
| 338 | self.held_contexts.insert(cid, Arc::downgrade(&instance)); |
| 339 | let binder = GlobalVmContext { instance, ..Default::default() }; |
| 340 | Ok(BnGlobalVmContext::new_binder(binder, BinderFeatures::default())) |
| 341 | } |
| 342 | } |
| 343 | |
| 344 | fn create_temporary_directory(path: &PathBuf, requester_uid: uid_t) -> Result<()> { |
| 345 | if path.as_path().exists() { |
| 346 | remove_temporary_dir(path).unwrap_or_else(|e| { |
| 347 | warn!("Could not delete temporary directory {:?}: {}", path, e); |
| 348 | }); |
| 349 | } |
| 350 | // Create a directory that is owned by client's UID but system's GID, and permissions 0700. |
| 351 | // If the chown() fails, this will leave behind an empty directory that will get removed |
| 352 | // at the next attempt, or if virtualizationservice is restarted. |
| 353 | create_dir(path).with_context(|| format!("Could not create temporary directory {:?}", path))?; |
| 354 | chown(path, Some(Uid::from_raw(requester_uid)), None) |
| 355 | .with_context(|| format!("Could not set ownership of temporary directory {:?}", path))?; |
| 356 | Ok(()) |
| 357 | } |
| 358 | |
| 359 | /// Removes a directory owned by a different user by first changing its owner back |
| 360 | /// to VirtualizationService. |
| 361 | pub fn remove_temporary_dir(path: &PathBuf) -> Result<()> { |
Alice Wang | d1b11a0 | 2023-04-18 12:30:20 +0000 | [diff] [blame] | 362 | ensure!(path.as_path().is_dir(), "Path {:?} is not a directory", path); |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 363 | chown(path, Some(Uid::current()), None)?; |
| 364 | set_permissions(path, Permissions::from_mode(0o700))?; |
Alice Wang | d1b11a0 | 2023-04-18 12:30:20 +0000 | [diff] [blame] | 365 | remove_dir_all(path)?; |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 366 | Ok(()) |
| 367 | } |
| 368 | |
| 369 | /// Implementation of the AIDL `IGlobalVmContext` interface. |
| 370 | #[derive(Debug, Default)] |
| 371 | struct GlobalVmContext { |
| 372 | /// Strong reference to the context's instance data structure. |
| 373 | instance: Arc<GlobalVmInstance>, |
| 374 | /// Keeps our service process running as long as this VM context exists. |
| 375 | #[allow(dead_code)] |
| 376 | lazy_service_guard: LazyServiceGuard, |
| 377 | } |
| 378 | |
| 379 | impl Interface for GlobalVmContext {} |
| 380 | |
| 381 | impl IGlobalVmContext for GlobalVmContext { |
| 382 | fn getCid(&self) -> binder::Result<i32> { |
| 383 | Ok(self.instance.cid as i32) |
| 384 | } |
| 385 | |
| 386 | fn getTemporaryDirectory(&self) -> binder::Result<String> { |
| 387 | Ok(self.instance.get_temp_dir().to_string_lossy().to_string()) |
| 388 | } |
| 389 | } |
| 390 | |
| 391 | fn handle_stream_connection_tombstoned() -> Result<()> { |
| 392 | // Should not listen for tombstones on a guest VM's port. |
| 393 | assert!(!is_valid_guest_cid(VM_TOMBSTONES_SERVICE_PORT as Cid)); |
| 394 | let listener = |
| 395 | VsockListener::bind_with_cid_port(VMADDR_CID_HOST, VM_TOMBSTONES_SERVICE_PORT as Cid)?; |
| 396 | for incoming_stream in listener.incoming() { |
| 397 | let mut incoming_stream = match incoming_stream { |
| 398 | Err(e) => { |
| 399 | warn!("invalid incoming connection: {:?}", e); |
| 400 | continue; |
| 401 | } |
| 402 | Ok(s) => s, |
| 403 | }; |
| 404 | std::thread::spawn(move || { |
| 405 | if let Err(e) = handle_tombstone(&mut incoming_stream) { |
| 406 | error!("Failed to write tombstone- {:?}", e); |
| 407 | } |
| 408 | }); |
| 409 | } |
| 410 | Ok(()) |
| 411 | } |
| 412 | |
| 413 | fn handle_tombstone(stream: &mut VsockStream) -> Result<()> { |
| 414 | if let Ok(addr) = stream.peer_addr() { |
| 415 | info!("Vsock Stream connected to cid={} for tombstones", addr.cid()); |
| 416 | } |
| 417 | let tb_connection = |
| 418 | TombstonedConnection::connect(std::process::id() as i32, DebuggerdDumpType::Tombstone) |
| 419 | .context("Failed to connect to tombstoned")?; |
| 420 | let mut text_output = tb_connection |
| 421 | .text_output |
| 422 | .as_ref() |
| 423 | .ok_or_else(|| anyhow!("Could not get file to write the tombstones on"))?; |
| 424 | let mut num_bytes_read = 0; |
| 425 | loop { |
| 426 | let mut chunk_recv = [0; CHUNK_RECV_MAX_LEN]; |
| 427 | let n = stream |
| 428 | .read(&mut chunk_recv) |
| 429 | .context("Failed to read tombstone data from Vsock stream")?; |
| 430 | if n == 0 { |
| 431 | break; |
| 432 | } |
| 433 | num_bytes_read += n; |
| 434 | text_output.write_all(&chunk_recv[0..n]).context("Failed to write guests tombstones")?; |
| 435 | } |
| 436 | info!("Received {} bytes from guest & wrote to tombstone file", num_bytes_read); |
| 437 | tb_connection.notify_completion()?; |
| 438 | Ok(()) |
| 439 | } |
| 440 | |
| 441 | /// Checks whether the caller has a specific permission |
| 442 | fn check_permission(perm: &str) -> binder::Result<()> { |
| 443 | let calling_pid = get_calling_pid(); |
| 444 | let calling_uid = get_calling_uid(); |
| 445 | // Root can do anything |
| 446 | if calling_uid == 0 { |
| 447 | return Ok(()); |
| 448 | } |
| 449 | let perm_svc: Strong<dyn IPermissionController::IPermissionController> = |
| 450 | binder::get_interface("permission")?; |
| 451 | if perm_svc.checkPermission(perm, calling_pid, calling_uid as i32)? { |
| 452 | Ok(()) |
| 453 | } else { |
| 454 | Err(Status::new_exception_str( |
| 455 | ExceptionCode::SECURITY, |
| 456 | Some(format!("does not have the {} permission", perm)), |
| 457 | )) |
| 458 | } |
| 459 | } |
| 460 | |
| 461 | /// Check whether the caller of the current Binder method is allowed to call debug methods. |
| 462 | fn check_debug_access() -> binder::Result<()> { |
| 463 | check_permission("android.permission.DEBUG_VIRTUAL_MACHINE") |
| 464 | } |
| 465 | |
| 466 | /// Check whether the caller of the current Binder method is allowed to manage VMs |
| 467 | fn check_manage_access() -> binder::Result<()> { |
| 468 | check_permission("android.permission.MANAGE_VIRTUAL_MACHINE") |
| 469 | } |
Inseob Kim | 53d0b21 | 2023-07-20 16:58:37 +0900 | [diff] [blame] | 470 | |
| 471 | /// Check whether the caller of the current Binder method is allowed to use custom VMs |
| 472 | fn check_use_custom_virtual_machine() -> binder::Result<()> { |
| 473 | check_permission("android.permission.USE_CUSTOM_VIRTUAL_MACHINE") |
| 474 | } |