From 6f4d78b0fc76861e0e48c35538275a9db3b083dd Mon Sep 17 00:00:00 2001 From: snake-4 <18491360+snake-4@users.noreply.github.com> Date: Tue, 9 Apr 2024 22:35:40 +0200 Subject: [PATCH] Added maps parser and fixed child zygote namespaces --- module/jni/Android.mk | 2 +- module/jni/include/map_parser.hpp | 27 ++++++++ module/jni/include/mountinfo_parser.hpp | 8 +-- module/jni/include/utils.hpp | 10 +++ module/jni/main.cpp | 83 ++++++++++++++----------- module/jni/map_parser.cpp | 59 ++++++++++++++++++ module/jni/mountinfo_parser.cpp | 8 +-- module/jni/utils.cpp | 29 +++++++++ 8 files changed, 180 insertions(+), 46 deletions(-) create mode 100644 module/jni/include/map_parser.hpp create mode 100644 module/jni/include/utils.hpp create mode 100644 module/jni/map_parser.cpp create mode 100644 module/jni/utils.cpp diff --git a/module/jni/Android.mk b/module/jni/Android.mk index 8643b20..0fa02ca 100644 --- a/module/jni/Android.mk +++ b/module/jni/Android.mk @@ -3,7 +3,7 @@ LOCAL_PATH := $(call my-dir) include $(CLEAR_VARS) LOCAL_C_INCLUDES := $(LOCAL_PATH)/include LOCAL_MODULE := zygisk -LOCAL_SRC_FILES := mount_parser.cpp mountinfo_parser.cpp unmount.cpp main.cpp +LOCAL_SRC_FILES := utils.cpp map_parser.cpp mount_parser.cpp mountinfo_parser.cpp unmount.cpp main.cpp LOCAL_STATIC_LIBRARIES := libcxx LOCAL_LDLIBS := -llog include $(BUILD_SHARED_LIBRARY) diff --git a/module/jni/include/map_parser.hpp b/module/jni/include/map_parser.hpp new file mode 100644 index 0000000..6a7d279 --- /dev/null +++ b/module/jni/include/map_parser.hpp @@ -0,0 +1,27 @@ +#include +#include +#include +#include + +class map_entry_t +{ +public: + map_entry_t(uintptr_t address_start, uintptr_t address_end, uintptr_t offset, + const std::string &perms, const std::string &pathname, dev_t device, ino_t inode); + + uintptr_t getAddressStart() const; + uintptr_t getAddressEnd() const; + const std::string &getPerms() const; + uintptr_t getOffset() const; + dev_t getDevice() const; + ino_t getInode() const; + const std::string &getPathname() const; + +private: + uintptr_t address_start, address_end, offset; + std::string perms, pathname; + dev_t device; + ino_t inode; +}; + +std::vector parseMapsFromPath(const char *path); diff --git a/module/jni/include/mountinfo_parser.hpp b/module/jni/include/mountinfo_parser.hpp index 170e387..e41f919 100644 --- a/module/jni/include/mountinfo_parser.hpp +++ b/module/jni/include/mountinfo_parser.hpp @@ -12,10 +12,10 @@ public: const std::string &filesystem_type, const std::string &mount_source, const std::string &super_options); - const int &getMountId() const; - const int &getParentId() const; - const int &getMajor() const; - const int &getMinor() const; + int getMountId() const; + int getParentId() const; + int getMajor() const; + int getMinor() const; const std::string &getRoot() const; const std::string &getMountPoint() const; const std::unordered_map &getMountOptions() const; diff --git a/module/jni/include/utils.hpp b/module/jni/include/utils.hpp new file mode 100644 index 0000000..5054275 --- /dev/null +++ b/module/jni/include/utils.hpp @@ -0,0 +1,10 @@ +#pragma once +#include +#include "zygisk.hpp" + +#define DCL_HOOK_FUNC(ret, func, ...) \ + ret (*old_##func)(__VA_ARGS__); \ + ret new_##func(__VA_ARGS__) + +int is_userapp_uid(int uid); +bool hook_plt_by_name(zygisk::Api *api, const std::string &libName, const std::string &symbolName, void *hookFunc, void **origFunc); diff --git a/module/jni/main.cpp b/module/jni/main.cpp index 5147549..671a744 100644 --- a/module/jni/main.cpp +++ b/module/jni/main.cpp @@ -1,11 +1,10 @@ #include #include - #include #include "zygisk.hpp" #include "logging.hpp" -#include "android_filesystem_config.h" +#include "utils.hpp" using zygisk::Api; using zygisk::AppSpecializeArgs; @@ -13,14 +12,16 @@ using zygisk::ServerSpecializeArgs; void do_unmount(); -static int shouldSkipUid(int uid) +DCL_HOOK_FUNC(static int, unshare, int flags) { - int appid = uid % AID_USER_OFFSET; - if (appid >= AID_APP_START && appid <= AID_APP_END) - return false; - if (appid >= AID_ISOLATED_START && appid <= AID_ISOLATED_END) - return false; - return true; + // Do not allow CLONE_NEWNS. + flags &= ~(CLONE_NEWNS); + if (!flags) + { + // If CLONE_NEWNS was the only flag, skip the call. + return 0; + } + return old_unshare(flags); } class ZygiskModule : public zygisk::ModuleBase @@ -39,43 +40,45 @@ public: uint32_t flags = api->getFlags(); bool isRoot = (flags & zygisk::StateFlag::PROCESS_GRANTED_ROOT) != 0; bool isOnDenylist = (flags & zygisk::StateFlag::PROCESS_ON_DENYLIST) != 0; - if (isRoot || !isOnDenylist || shouldSkipUid(args->uid)) + if (isRoot || !isOnDenylist || !is_userapp_uid(args->uid)) { - LOGD("Skipping pid=%d uid=%d", getpid(), args->uid); + LOGD("Skipping pid=%d ppid=%d uid=%d", getpid(), getppid(), args->uid); return; } - LOGD("Unmounting in preAppSpecialize for pid=%d uid=%d", getpid(), args->uid); + LOGD("Processing pid=%d ppid=%d uid=%d", getpid(), getppid(), args->uid); /* - * Create only one namespace per zygote, child Zygotes will inherit it - * But then again, why won't they also inherit the unmounts of the parent? - * Either way, unshare in child Zygote will crash at the open FD sanity check. + * Calling unshare twice invalidates FD hard links, which fails Zygote sanity checks. + * So we hook unshare to prevent further namespace creations. + * The logic behind whether there's going to be an unshare or not changes with each major Android version. + * For maximum compatibility, we will always unshare but prevent further unshare by this Zygote fork in appSpecialize. */ - if (!*args->is_child_zygote) + if (!plt_hook_wrapper("libandroid_runtime.so", "unshare", new_unshare, old_unshare)) { - LOGD("Creating new mount namespace for parent pid=%d uid=%d", getpid(), args->uid); + LOGE("plt_hook_wrapper(\"libandroid_runtime.so\", \"unshare\", new_unshare, old_unshare) returned false"); + return; + } - /* - * preAppSpecialize is before ensureInAppMountNamespace. - * postAppSpecialize is after seccomp setup. - * So we unshare here to create a pseudo app mount namespace - */ - if (unshare(CLONE_NEWNS) == -1) - { - LOGE("unshare(CLONE_NEWNS) returned -1: %d (%s)", errno, strerror(errno)); - // Don't unmount anything in global namespace - return; - } + /* + * preAppSpecialize is before any possible unshare calls. + * postAppSpecialize is after seccomp setup. + * So we unshare here to create an app mount namespace. + */ + if (unshare(CLONE_NEWNS) == -1) + { + LOGE("unshare(CLONE_NEWNS) returned -1: %d (%s)", errno, strerror(errno)); + return; + } - /* - * Mount the pseudo app mount namespace's root as MS_SLAVE, so every mount/umount from - * Zygote shared pre-specialization mountspace is propagated to this one. - */ - if (mount("rootfs", "/", NULL, (MS_SLAVE | MS_REC), NULL) == -1) - { - LOGE("mount(\"rootfs\", \"/\", NULL, (MS_SLAVE | MS_REC), NULL) returned -1"); - } + /* + * Mount the app mount namespace's root as MS_SLAVE, so every mount/umount from + * Zygote shared pre-specialization namespace is propagated to this one. + */ + if (mount("rootfs", "/", NULL, (MS_SLAVE | MS_REC), NULL) == -1) + { + LOGE("mount(\"rootfs\", \"/\", NULL, (MS_SLAVE | MS_REC), NULL) returned -1"); + return; } do_unmount(); @@ -86,9 +89,15 @@ public: api->setOption(zygisk::Option::DLCLOSE_MODULE_LIBRARY); } + template + bool plt_hook_wrapper(const std::string &libName, const std::string &symbolName, Return (&hookFunction)(Args...), Return (*&originalFunction)(Args...)) + { + return hook_plt_by_name(api, libName, symbolName, (void *)&hookFunction, (void **)&originalFunction) && api->pltHookCommit(); + } + private: Api *api; JNIEnv *env; }; -REGISTER_ZYGISK_MODULE(ZygiskModule) +REGISTER_ZYGISK_MODULE(ZygiskModule) \ No newline at end of file diff --git a/module/jni/map_parser.cpp b/module/jni/map_parser.cpp new file mode 100644 index 0000000..e627a4d --- /dev/null +++ b/module/jni/map_parser.cpp @@ -0,0 +1,59 @@ +#include +#include +#include +#include +#include // For makedev + +#include "map_parser.hpp" +#include "logging.hpp" + +map_entry_t::map_entry_t(uintptr_t address_start, uintptr_t address_end, uintptr_t offset, const std::string &perms, const std::string &pathname, dev_t device, ino_t inode) + : address_start(address_start), address_end(address_end), perms(perms), + offset(offset), device(device), inode(inode), pathname(pathname) {} + +uintptr_t map_entry_t::getAddressStart() const { return address_start; } +uintptr_t map_entry_t::getAddressEnd() const { return address_end; } +const std::string &map_entry_t::getPerms() const { return perms; } +uintptr_t map_entry_t::getOffset() const { return offset; } +dev_t map_entry_t::getDevice() const { return device; } +ino_t map_entry_t::getInode() const { return inode; } +const std::string &map_entry_t::getPathname() const { return pathname; } + +std::vector parseMapsFromPath(const char *path) +{ + std::vector ret; + + std::ifstream ifs(path, std::ifstream::in); + if (!ifs) + { + LOGE("parseMapsFromPath could not open file \"%s\"", path); + return ret; + } + + for (std::string line; std::getline(ifs, line);) + { + std::istringstream iss(line); + + uintptr_t address_start, address_end, offset; + std::string perms; + std::string pathname; + ino_t inode; + int dev_major, dev_minor; + char dummy_char; + + iss >> std::hex >> address_start >> dummy_char >> address_end >> perms >> offset >> dev_major >> dummy_char >> dev_minor >> std::dec >> inode; + + if (iss.fail()) + { + LOGE("parseMapsFromPath failed to parse line: %s", line.c_str()); + continue; + } + + // This operation can fail, it doesn't matter as it's an optional field. + std::getline(iss >> std::ws, pathname); + + ret.emplace_back(map_entry_t(address_start, address_end, offset, perms, pathname, makedev(dev_major, dev_minor), inode)); + } + + return ret; +} diff --git a/module/jni/mountinfo_parser.cpp b/module/jni/mountinfo_parser.cpp index e903134..350b99e 100644 --- a/module/jni/mountinfo_parser.cpp +++ b/module/jni/mountinfo_parser.cpp @@ -22,10 +22,10 @@ mountinfo_entry_t::mountinfo_entry_t(int mount_id, int parent_id, int major, int this->super_options = parseMountOptions(super_options); } -const int &mountinfo_entry_t::getMountId() const { return mount_id; } -const int &mountinfo_entry_t::getParentId() const { return parent_id; } -const int &mountinfo_entry_t::getMajor() const { return major; } -const int &mountinfo_entry_t::getMinor() const { return minor; } +int mountinfo_entry_t::getMountId() const { return mount_id; } +int mountinfo_entry_t::getParentId() const { return parent_id; } +int mountinfo_entry_t::getMajor() const { return major; } +int mountinfo_entry_t::getMinor() const { return minor; } const std::string &mountinfo_entry_t::getRoot() const { return root; } const std::string &mountinfo_entry_t::getMountPoint() const { return mount_point; } const std::unordered_map &mountinfo_entry_t::getMountOptions() const { return mount_options; } diff --git a/module/jni/utils.cpp b/module/jni/utils.cpp new file mode 100644 index 0000000..7e47cde --- /dev/null +++ b/module/jni/utils.cpp @@ -0,0 +1,29 @@ +#include + +#include "map_parser.hpp" +#include "utils.hpp" +#include "android_filesystem_config.h" +#include "zygisk.hpp" + +bool hook_plt_by_name(zygisk::Api *api, const std::string &libName, const std::string &symbolName, void *hookFunc, void **origFunc) +{ + for (const auto &map : parseMapsFromPath("/proc/self/maps")) + { + if (map.getPathname().ends_with("/" + libName)) + { + api->pltHookRegister(map.getDevice(), map.getInode(), symbolName.c_str(), hookFunc, origFunc); + return true; + } + } + return false; +} + +int is_userapp_uid(int uid) +{ + int appid = uid % AID_USER_OFFSET; + if (appid >= AID_APP_START && appid <= AID_APP_END) + return true; + if (appid >= AID_ISOLATED_START && appid <= AID_ISOLATED_END) + return true; + return false; +}