Previously, ServiceParser did the check, but only when it's invoked by
host_init_verifier. Host_init_verifier can do it directly, which removes
unnecessary runtime dependencies from init.
Bug: 326827772
Test: host_init_verifier detects wrong HIDL interface names.
Change-Id: I4c8bb0e89a5def7341c48c52af730795a6ee13c0
This requires a bit of refactoring: moving things around.
libinit_host is used by host_apex_verifier which needs check_builtins as
well.
Bug: 325565247
Test: atest host-apex-verifier
Test: m out/target/product/vsoc_x86_64/host_init_verifier_output.txt
Change-Id: Ifed54dd2149afbab2bf63f7e42c410c2354895fc
Fix the following compiler warning:
//system/core/init:host_init_verifier clang++ host_init_verifier.cp
system/core/init/host_init_verifier.cpp:112:9: warning: ISO C++ requires field designators to be specified in declaration order; field 'pw_shell' will be initialized after field 'pw_uid' [-Wreorder-init-list]
.pw_uid = 0,
^~~~~~~~~~~
system/core/init/host_init_verifier.cpp:111:21: note: previous initialization for field 'pw_shell' is here
.pw_shell = static_shell,
^~~~~~~~~~~~
Change-Id: I930c668d7fb1d12ebe9307b1549776da71a9a95a
Signed-off-by: Bart Van Assche <bvanassche@google.com>
Bazel's intermediates/inputs are symlinks in its execution root, unlike Soong.
e.g.
$ file $(readlink -f out/bazel/output/execroot/__main__/packages/modules/adb/apex/adbd.rc)
/usr/local/google/home/jingwen/aosp/master-with-phones/packages/modules/adb/apex/adbd.rc:
ASCII text
Test: presubmits
Change-Id: I3977a37ee989e07bee56abb019a21055b8cef567
If a service that runs under root doesn't have the capabilities field in
it's definition, then it will inherit all the capabilities that init
has.
This change adds a linter to detect such services and ask developers to
explicitly specify capabilities that their service needs. If service
doesn't require any capabilities then empty capabilities fields should
be added in the service definition.
The actual access control list on what capabilities a process can use is
controlled by the SELinux, so inheriting all the init capabilities is
not a security issue here. However, asking services to explicitly
specify the capabilities they need is a good defense-in-depth mechanism.
So far this linter only checks the services on /system partition.
All currently offending services are added to the exempt list. I will
work on fixing some of them in the follow-up changes.
Bug: 249796710
Test: m dist
Change-Id: I2db06af165ae320a9c5086756067dceef20cd28d
Also includes new --out_<partition> flags for
system,system_ext,product,vendor,odm
to allow host_init_verifier to work with a collection of init rc files.
Test: host_init_verifier --out_system=... --out_vendor=...
where vendor contains an init rc file that overrides a service
present in system. Observe parse failure and non-zero exit.
Bug: 163089173
Change-Id: I520fef613e0036df8a7d47a98d47405eaa969110
Long overdue clean up; there is no reason to include fs_config.h in
android_filesystem_config.h, and the fact that it causes problems if
it's done, necessitating EXCLUDE_FS_CONFIG_STRUCTURES to exist, is a
good reason to fix it.
Bug: 149785767
Test: build
Change-Id: I5ba2541cd1045c22486140649c90db39163081fd
The previous code would lazily check for 'exact' and accept any other
value as a prefix match. This should be a tighter check allowing only
'exact', 'prefix', or an empty string for this option.
Test: build fails if an invalid string is used for the match operation
Test: build succeeds normally
Test: `getprop -Z` shows exact vs prefix is differentiated correctly
Change-Id: I21dcb193810d65f468f8960967eabfd261f71e21
We have all of the 'type' information for properties available during
build time, so let's check this when setting properties in init.
Test: setprop apexd.status bad results in:
host_init_verifier: Command 'setprop apexd.status bad'
(out/soong/.intermediates/system/core/rootdir/init.rc/android_x86_core/init.rc:927)
failed: Property type check failed, value doesn't match expected type
'enum starting ready'
host_init_verifier: Failed to parse init script
'out/soong/.intermediates/system/core/rootdir/init.rc/android_x86_core/init.rc'
with 1 errors
Test: CF builds without that error
Change-Id: Iaad07747c09f4a10b2b816c455d6e8a485357ab9
Since it's available in C++, it's easier to build host_init_verifier
with this than create a new way to export the json file.
Bug: 141567104
Test: manually change hidl interface in a manifest
host_init_verifier: system/core/rootdir/init.rc: 69:
host_init_verifier: Interface is not in the known set of hidl_interfaces: 'android.hardwar.edne@1.0::IFoo'. Please ensure the interface is spelled correctly and built by a hidl_interface target.
Change-Id: Ic73dcb51855cb751734bc497d8e69f379966c511
Includes refactoring out interface inheritance hierarchy logic to a new
interface_utils file.
Bug: 137397100
Test: 'm' with an init_rc that misspells an interface in an
interface_start, interface_restart, or interface_stop line.
Change-Id: I9f650289d64ae2b13435a81e1693c7ab5e6e9ecf
Host init verifier already checks that the names and number of
arguments for builtins are correct, but it can check more. This
change ensures that property expansions are well formed, and that
arguments that can be parsed on the host are correct. For example it
checks that UIDs and GIDs exist, that numerical values can be parsed,
and that rlimit strings are correct.
Test: build
Change-Id: Ied8882498a88a9f8324db6b8d1020aeeccc8177b
I've heard that keyword_map is too complex, in particular the tuple
and the pair in BuiltinFunctionMap, so this change removes a lot of
that complexity and, more importantly, better documents how all of
this works.
Test: boot, init unit tests
Change-Id: I74e5f9de7f2ec524cb6127bb9da2956b5f307f56
Bug: 118016875
Test: Added 'interface' lines to an init_rc file and observed errors
when misspelled or missing entire inheritance hierarchy.
Change-Id: I681420f15539742d8415808b2a0dcbf0bf6faaf1
Test: Adding a misspelling to an init_rc's interface line and observing
build failure.
Bug: 77646540
Change-Id: I58f66d73f0bd9b4203e8259161843b56ad428d73
Now that Result<T> is actually expected<T, ...>, and the expected
proposal states expected<void, ...> as the way to indicate an expected
object that returns either successfully with no object or an error,
let's move init's Result<Success> to the preferred Result<void>.
Bug: 132145659
Test: boot, init unit tests
Change-Id: Ib2f98396d8e6e274f95a496fcdfd8341f77585ee
Also get rid of the copy in parser. There's no incentive to switch to
a tokenizer that doesn't modify the input, nor is there a reason to
waste cycles making a copy of every init script as its processed.
Bug: 36970783
Test: boot
Change-Id: I8aca9c9d6f1961e1ab35dee50691a6791fc6ec66
It's not going to be possible to safely assume $OUT has the right init
scripts to be parsed at a given point, so instead we fall back to
parsing init scripts individually.
This isn't a full revert of the previous commits. We retain parsing
correctness of the 'import' statements and we retain using the new
host side property functionality.
Also, fix a bug where main was not actually returning -1 on failure
Bug: 36970783
Test: testing individual files still works correctly
Change-Id: I4ae5620f234caa08993deb2c30825904a75f6654
Bug: 36970783
Test: test bullhead successfully at TOT
Test: create errors and check that they're caught
Test: create uid in passwd and check that it's successful
Change-Id: I237fb8df16a294757fe898bdbbd42e850bcb8301
Allow specifying properties on the command line when running host init
verifier. This is needed particularly for importing files that have a
property expansion in their path.
Handle the import statement on host, basing paths off of the out
directory of Android builds.
Bug: 36970783
Test: verify that bullhead imports the correct files and checks them
Change-Id: I4fe263016b3764a372708b559bc0c739b1b7e5e3
