snapuserd: Allow connecting to the first-stage daemon.
Currently there is no socket for daemon instances launched during the
selinux phase of init. We don't create any sockets due to the complexity
of the required sepolicy.
This workaround will allow us to create the socket with very minimal
sepolicy changes. init will launch a one-off instance of snapuserd in
"proxy" mode, and then the following steps will occur:
1. The proxy daemon will be given two sockets, the "normal" socket that
snapuserd clients would connect to, and a "proxy" socket.
2. The proxy daemon will listen on the proxy socket.
3. The first-stage daemon will wake up and connect to the proxy daemon
as a client.
4. The proxy will send the normal socket via SCM_RIGHTS, then exit.
5. The first-stage daemon can now listen and accept on the normal
socket.
Ordering of these events is achieved through a snapuserd.proxy_ready
property.
Some special-casing was needed in init to make this work. The snapuserd
socket owned by snapuserd_proxy is placed into a "persist" mode so it
doesn't get deleted when snapuserd_proxy exits. There's also a special
case method to create a Service object around a previously existing pid.
Finally, first-stage init is technically on a different updateable
partition than snapuserd. Thus, we add a way to query snapuserd to see
if it supports socket handoff. If it does, we communicate this
information through an environment variable to second-stage init.
Bug: 193833730
Test: manual test
Change-Id: I1950b31028980f0138bc03578cd455eb60ea4a58
diff --git a/init/init.cpp b/init/init.cpp
index a7325ca..bde8e04 100644
--- a/init/init.cpp
+++ b/init/init.cpp
@@ -725,6 +725,40 @@
}
}
+static Result<void> ConnectEarlyStageSnapuserdAction(const BuiltinArguments& args) {
+ auto pid = GetSnapuserdFirstStagePid();
+ if (!pid) {
+ return {};
+ }
+
+ auto info = GetSnapuserdFirstStageInfo();
+ if (auto iter = std::find(info.begin(), info.end(), "socket"s); iter == info.end()) {
+ // snapuserd does not support socket handoff, so exit early.
+ return {};
+ }
+
+ // Socket handoff is supported.
+ auto svc = ServiceList::GetInstance().FindService("snapuserd");
+ if (!svc) {
+ LOG(FATAL) << "Failed to find snapuserd service entry";
+ }
+
+ svc->SetShutdownCritical();
+ svc->SetStartedInFirstStage(*pid);
+
+ svc = ServiceList::GetInstance().FindService("snapuserd_proxy");
+ if (!svc) {
+ LOG(FATAL) << "Failed find snapuserd_proxy service entry, merge will never initiate";
+ }
+ if (!svc->MarkSocketPersistent("snapuserd")) {
+ LOG(FATAL) << "Could not find snapuserd socket in snapuserd_proxy service entry";
+ }
+ if (auto result = svc->Start(); !result.ok()) {
+ LOG(FATAL) << "Could not start snapuserd_proxy: " << result.error();
+ }
+ return {};
+}
+
int SecondStageMain(int argc, char** argv) {
if (REBOOT_BOOTLOADER_ON_PANIC) {
InstallRebootSignalHandlers();
@@ -852,6 +886,7 @@
am.QueueBuiltinAction(SetupCgroupsAction, "SetupCgroups");
am.QueueBuiltinAction(SetKptrRestrictAction, "SetKptrRestrict");
am.QueueBuiltinAction(TestPerfEventSelinuxAction, "TestPerfEventSelinux");
+ am.QueueBuiltinAction(ConnectEarlyStageSnapuserdAction, "ConnectEarlyStageSnapuserd");
am.QueueEventTrigger("early-init");
// Queue an action that waits for coldboot done so we know ueventd has set up all of /dev...