ACPR/android_system_core
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "Revert "Revert "Add derive_gid flag for mounting sdcardfs""" into oc-mr1-dev

Browse source
This commit is contained in:
TreeHugger Robot 2017-09-15 21:59:31 +00:00 • committed by Android (Google) Code Review
commit df77f328e7
1 changed files with 40 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

60
sdcard/sdcard.cpp
View file

@ -317,17 +317,31 @@ static void run(const char* source_path, const char* label, uid_t uid,
LOG(FATAL) << "terminated prematurely"; LOG(FATAL) << "terminated prematurely";
} }
static bool sdcardfs_setup(const std::string& source_path, const std::string& dest_path, uid_t fsuid, static bool sdcardfs_setup(const std::string& source_path, const std::string& dest_path,
gid_t fsgid, bool multi_user, userid_t userid, gid_t gid, mode_t mask) { uid_t fsuid, gid_t fsgid, bool multi_user, userid_t userid, gid_t gid,
std::string opts = android::base::StringPrintf("fsuid=%d,fsgid=%d,%smask=%d,userid=%d,gid=%d", mode_t mask, bool derive_gid) {
fsuid, fsgid, multi_user?"multiuser,":"", mask, userid, gid); std::string opts = android::base::StringPrintf(
"fsuid=%d,fsgid=%d,%s%smask=%d,userid=%d,gid=%d", fsuid, fsgid,
multi_user ? "multiuser," : "", derive_gid ? "derive_gid," : "", mask, userid, gid);
if (mount(source_path.c_str(), dest_path.c_str(), "sdcardfs", if (mount(source_path.c_str(), dest_path.c_str(), "sdcardfs",
MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_NOATIME, opts.c_str()) == -1) { MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_NOATIME, opts.c_str()) == -1) {
PLOG(ERROR) << "failed to mount sdcardfs filesystem"; if (derive_gid) {
return false; PLOG(ERROR) << "trying to mount sdcardfs filesystem without derive_gid";
/* Maybe this isn't supported on this kernel. Try without. */
opts = android::base::StringPrintf("fsuid=%d,fsgid=%d,%smask=%d,userid=%d,gid=%d",
fsuid, fsgid, multi_user ? "multiuser," : "", mask,
userid, gid);
if (mount(source_path.c_str(), dest_path.c_str(), "sdcardfs",
MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_NOATIME, opts.c_str()) == -1) {
PLOG(ERROR) << "failed to mount sdcardfs filesystem";
return false;
}
} else {
PLOG(ERROR) << "failed to mount sdcardfs filesystem";
return false;
}
} }
return true; return true;
} }
@ -353,7 +367,8 @@ static bool sdcardfs_setup_bind_remount(const std::string& source_path, const st
} }
static void run_sdcardfs(const std::string& source_path, const std::string& label, uid_t uid, static void run_sdcardfs(const std::string& source_path, const std::string& label, uid_t uid,
gid_t gid, userid_t userid, bool multi_user, bool full_write) { gid_t gid, userid_t userid, bool multi_user, bool full_write,
bool derive_gid) {
std::string dest_path_default = "/mnt/runtime/default/" + label; std::string dest_path_default = "/mnt/runtime/default/" + label;
std::string dest_path_read = "/mnt/runtime/read/" + label; std::string dest_path_read = "/mnt/runtime/read/" + label;
std::string dest_path_write = "/mnt/runtime/write/" + label; std::string dest_path_write = "/mnt/runtime/write/" + label;
@ -363,10 +378,10 @@ static void run_sdcardfs(const std::string& source_path, const std::string& labe
// Multi-user storage is fully isolated per user, so "other" // Multi-user storage is fully isolated per user, so "other"
// permissions are completely masked off. // permissions are completely masked off.
if (!sdcardfs_setup(source_path, dest_path_default, uid, gid, multi_user, userid, if (!sdcardfs_setup(source_path, dest_path_default, uid, gid, multi_user, userid,
AID_SDCARD_RW, 0006) AID_SDCARD_RW, 0006, derive_gid) ||
|| !sdcardfs_setup_bind_remount(dest_path_default, dest_path_read, AID_EVERYBODY, 0027) !sdcardfs_setup_bind_remount(dest_path_default, dest_path_read, AID_EVERYBODY, 0027) ||
|| !sdcardfs_setup_bind_remount(dest_path_default, dest_path_write, !sdcardfs_setup_bind_remount(dest_path_default, dest_path_write, AID_EVERYBODY,
AID_EVERYBODY, full_write ? 0007 : 0027)) { full_write ? 0007 : 0027)) {
LOG(FATAL) << "failed to sdcardfs_setup"; LOG(FATAL) << "failed to sdcardfs_setup";
} }
} else { } else {
@ -374,11 +389,11 @@ static void run_sdcardfs(const std::string& source_path, const std::string& labe
// the Android directories are masked off to a single user // the Android directories are masked off to a single user
// deep inside attr_from_stat(). // deep inside attr_from_stat().
if (!sdcardfs_setup(source_path, dest_path_default, uid, gid, multi_user, userid, if (!sdcardfs_setup(source_path, dest_path_default, uid, gid, multi_user, userid,
AID_SDCARD_RW, 0006) AID_SDCARD_RW, 0006, derive_gid) ||
|| !sdcardfs_setup_bind_remount(dest_path_default, dest_path_read, !sdcardfs_setup_bind_remount(dest_path_default, dest_path_read, AID_EVERYBODY,
AID_EVERYBODY, full_write ? 0027 : 0022) full_write ? 0027 : 0022) ||
|| !sdcardfs_setup_bind_remount(dest_path_default, dest_path_write, !sdcardfs_setup_bind_remount(dest_path_default, dest_path_write, AID_EVERYBODY,
AID_EVERYBODY, full_write ? 0007 : 0022)) { full_write ? 0007 : 0022)) {
LOG(FATAL) << "failed to sdcardfs_setup"; LOG(FATAL) << "failed to sdcardfs_setup";
} }
} }
@ -435,7 +450,8 @@ static int usage() {
<< " -g: specify GID to run as" << " -g: specify GID to run as"
<< " -U: specify user ID that owns device" << " -U: specify user ID that owns device"
<< " -m: source_path is multi-user" << " -m: source_path is multi-user"
<< " -w: runtime write mount has full write access"; << " -w: runtime write mount has full write access"
<< " -P preserve owners on the lower file system";
return 1; return 1;
} }
@ -447,12 +463,13 @@ int main(int argc, char **argv) {
userid_t userid = 0; userid_t userid = 0;
bool multi_user = false; bool multi_user = false;
bool full_write = false; bool full_write = false;
bool derive_gid = false;
int i; int i;
struct rlimit rlim; struct rlimit rlim;
int fs_version; int fs_version;
int opt; int opt;
while ((opt = getopt(argc, argv, "u:g:U:mw")) != -1) { while ((opt = getopt(argc, argv, "u:g:U:mwG")) != -1) {
switch (opt) { switch (opt) {
case 'u': case 'u':
uid = strtoul(optarg, NULL, 10); uid = strtoul(optarg, NULL, 10);
@ -469,6 +486,9 @@ int main(int argc, char **argv) {
case 'w': case 'w':
full_write = true; full_write = true;
break; break;
case 'G':
derive_gid = true;
break;
case '?': case '?':
default: default:
return usage(); return usage();
@ -512,7 +532,7 @@ int main(int argc, char **argv) {
} }
if (should_use_sdcardfs()) { if (should_use_sdcardfs()) {
run_sdcardfs(source_path, label, uid, gid, userid, multi_user, full_write); run_sdcardfs(source_path, label, uid, gid, userid, multi_user, full_write, derive_gid);
} else { } else {
run(source_path, label, uid, gid, userid, multi_user, full_write); run(source_path, label, uid, gid, userid, multi_user, full_write);
} }