Added maps parser and fixed child zygote namespaces

module/jni/Android.mk

@@ -3,7 +3,7 @@ LOCAL_PATH := $(call my-dir)
 include $(CLEAR_VARS)
 LOCAL_C_INCLUDES := $(LOCAL_PATH)/include
 LOCAL_MODULE := zygisk
-LOCAL_SRC_FILES := mount_parser.cpp mountinfo_parser.cpp unmount.cpp main.cpp
+LOCAL_SRC_FILES := utils.cpp map_parser.cpp mount_parser.cpp mountinfo_parser.cpp unmount.cpp main.cpp
 LOCAL_STATIC_LIBRARIES := libcxx
 LOCAL_LDLIBS := -llog
 include $(BUILD_SHARED_LIBRARY)

module/jni/include/map_parser.hpp

@@ -0,0 +1,27 @@
+#include <sstream>
+#include <string>
+#include <vector>
+#include <sys/types.h>
+
+class map_entry_t
+{
+public:
+    map_entry_t(uintptr_t address_start, uintptr_t address_end, uintptr_t offset,
+                const std::string &perms, const std::string &pathname, dev_t device, ino_t inode);
+
+    uintptr_t getAddressStart() const;
+    uintptr_t getAddressEnd() const;
+    const std::string &getPerms() const;
+    uintptr_t getOffset() const;
+    dev_t getDevice() const;
+    ino_t getInode() const;
+    const std::string &getPathname() const;
+
+private:
+    uintptr_t address_start, address_end, offset;
+    std::string perms, pathname;
+    dev_t device;
+    ino_t inode;
+};
+
+std::vector<map_entry_t> parseMapsFromPath(const char *path);

module/jni/include/mountinfo_parser.hpp

@@ -12,10 +12,10 @@ public:
                       const std::string &filesystem_type, const std::string &mount_source,
                       const std::string &super_options);
 
-    const int &getMountId() const;
-    const int &getParentId() const;
-    const int &getMajor() const;
-    const int &getMinor() const;
+    int getMountId() const;
+    int getParentId() const;
+    int getMajor() const;
+    int getMinor() const;
     const std::string &getRoot() const;
     const std::string &getMountPoint() const;
     const std::unordered_map<std::string, std::string> &getMountOptions() const;

module/jni/include/utils.hpp

@@ -0,0 +1,10 @@
+#pragma once
+#include <string>
+#include "zygisk.hpp"
+
+#define DCL_HOOK_FUNC(ret, func, ...) \
+    ret (*old_##func)(__VA_ARGS__);   \
+    ret new_##func(__VA_ARGS__)
+
+int is_userapp_uid(int uid);
+bool hook_plt_by_name(zygisk::Api *api, const std::string &libName, const std::string &symbolName, void *hookFunc, void **origFunc);

module/jni/main.cpp

@@ -1,11 +1,10 @@
 #include <unistd.h>
 #include <sched.h>
-
 #include <sys/mount.h>
 
 #include "zygisk.hpp"
 #include "logging.hpp"
-#include "android_filesystem_config.h"
+#include "utils.hpp"
 
 using zygisk::Api;
 using zygisk::AppSpecializeArgs;
@@ -13,14 +12,16 @@ using zygisk::ServerSpecializeArgs;
 
 void do_unmount();
 
-static int shouldSkipUid(int uid)
+DCL_HOOK_FUNC(static int, unshare, int flags)
 {
-    int appid = uid % AID_USER_OFFSET;
-    if (appid >= AID_APP_START && appid <= AID_APP_END)
-        return false;
-    if (appid >= AID_ISOLATED_START && appid <= AID_ISOLATED_END)
-        return false;
-    return true;
+    // Do not allow CLONE_NEWNS.
+    flags &= ~(CLONE_NEWNS);
+    if (!flags)
+    {
+        // If CLONE_NEWNS was the only flag, skip the call.
+        return 0;
+    }
+    return old_unshare(flags);
 }
 
 class ZygiskModule : public zygisk::ModuleBase
@@ -39,43 +40,45 @@ public:
         uint32_t flags = api->getFlags();
         bool isRoot = (flags & zygisk::StateFlag::PROCESS_GRANTED_ROOT) != 0;
         bool isOnDenylist = (flags & zygisk::StateFlag::PROCESS_ON_DENYLIST) != 0;
-        if (isRoot || !isOnDenylist || shouldSkipUid(args->uid))
+        if (isRoot || !isOnDenylist || !is_userapp_uid(args->uid))
         {
-            LOGD("Skipping pid=%d uid=%d", getpid(), args->uid);
+            LOGD("Skipping pid=%d ppid=%d uid=%d", getpid(), getppid(), args->uid);
             return;
         }
 
-        LOGD("Unmounting in preAppSpecialize for pid=%d uid=%d", getpid(), args->uid);
+        LOGD("Processing pid=%d ppid=%d uid=%d", getpid(), getppid(), args->uid);
 
         /*
-         * Create only one namespace per zygote, child Zygotes will inherit it
-         * But then again, why won't they also inherit the unmounts of the parent?
-         * Either way, unshare in child Zygote will crash at the open FD sanity check.
+         * Calling unshare twice invalidates FD hard links, which fails Zygote sanity checks.
+         * So we hook unshare to prevent further namespace creations.
+         * The logic behind whether there's going to be an unshare or not changes with each major Android version.
+         * For maximum compatibility, we will always unshare but prevent further unshare by this Zygote fork in appSpecialize.
          */
-        if (!*args->is_child_zygote)
+        if (!plt_hook_wrapper("libandroid_runtime.so", "unshare", new_unshare, old_unshare))
         {
-            LOGD("Creating new mount namespace for parent pid=%d uid=%d", getpid(), args->uid);
+            LOGE("plt_hook_wrapper(\"libandroid_runtime.so\", \"unshare\", new_unshare, old_unshare) returned false");
+            return;
+        }
 
-            /*
-             * preAppSpecialize is before ensureInAppMountNamespace.
-             * postAppSpecialize is after seccomp setup.
-             * So we unshare here to create a pseudo app mount namespace
-             */
-            if (unshare(CLONE_NEWNS) == -1)
-            {
-                LOGE("unshare(CLONE_NEWNS) returned -1: %d (%s)", errno, strerror(errno));
-                // Don't unmount anything in global namespace
-                return;
-            }
+        /*
+         * preAppSpecialize is before any possible unshare calls.
+         * postAppSpecialize is after seccomp setup.
+         * So we unshare here to create an app mount namespace.
+         */
+        if (unshare(CLONE_NEWNS) == -1)
+        {
+            LOGE("unshare(CLONE_NEWNS) returned -1: %d (%s)", errno, strerror(errno));
+            return;
+        }
 
-            /*
-             * Mount the pseudo app mount namespace's root as MS_SLAVE, so every mount/umount from
-             * Zygote shared pre-specialization mountspace is propagated to this one.
-             */
-            if (mount("rootfs", "/", NULL, (MS_SLAVE | MS_REC), NULL) == -1)
-            {
-                LOGE("mount(\"rootfs\", \"/\", NULL, (MS_SLAVE | MS_REC), NULL) returned -1");
-            }
+        /*
+         * Mount the app mount namespace's root as MS_SLAVE, so every mount/umount from
+         * Zygote shared pre-specialization namespace is propagated to this one.
+         */
+        if (mount("rootfs", "/", NULL, (MS_SLAVE | MS_REC), NULL) == -1)
+        {
+            LOGE("mount(\"rootfs\", \"/\", NULL, (MS_SLAVE | MS_REC), NULL) returned -1");
+            return;
         }
 
         do_unmount();
@@ -86,6 +89,12 @@ public:
         api->setOption(zygisk::Option::DLCLOSE_MODULE_LIBRARY);
     }
 
+    template <typename Return, typename... Args>
+    bool plt_hook_wrapper(const std::string &libName, const std::string &symbolName, Return (&hookFunction)(Args...), Return (*&originalFunction)(Args...))
+    {
+        return hook_plt_by_name(api, libName, symbolName, (void *)&hookFunction, (void **)&originalFunction) && api->pltHookCommit();
+    }
+
 private:
     Api *api;
     JNIEnv *env;

module/jni/map_parser.cpp

@@ -0,0 +1,59 @@
+#include <string>
+#include <sstream>
+#include <fstream>
+#include <vector>
+#include <sys/sysmacros.h> // For makedev
+
+#include "map_parser.hpp"
+#include "logging.hpp"
+
+map_entry_t::map_entry_t(uintptr_t address_start, uintptr_t address_end, uintptr_t offset, const std::string &perms, const std::string &pathname, dev_t device, ino_t inode)
+    : address_start(address_start), address_end(address_end), perms(perms),
+      offset(offset), device(device), inode(inode), pathname(pathname) {}
+
+uintptr_t map_entry_t::getAddressStart() const { return address_start; }
+uintptr_t map_entry_t::getAddressEnd() const { return address_end; }
+const std::string &map_entry_t::getPerms() const { return perms; }
+uintptr_t map_entry_t::getOffset() const { return offset; }
+dev_t map_entry_t::getDevice() const { return device; }
+ino_t map_entry_t::getInode() const { return inode; }
+const std::string &map_entry_t::getPathname() const { return pathname; }
+
+std::vector<map_entry_t> parseMapsFromPath(const char *path)
+{
+    std::vector<map_entry_t> ret;
+
+    std::ifstream ifs(path, std::ifstream::in);
+    if (!ifs)
+    {
+        LOGE("parseMapsFromPath could not open file \"%s\"", path);
+        return ret;
+    }
+
+    for (std::string line; std::getline(ifs, line);)
+    {
+        std::istringstream iss(line);
+
+        uintptr_t address_start, address_end, offset;
+        std::string perms;
+        std::string pathname;
+        ino_t inode;
+        int dev_major, dev_minor;
+        char dummy_char;
+
+        iss >> std::hex >> address_start >> dummy_char >> address_end >> perms >> offset >> dev_major >> dummy_char >> dev_minor >> std::dec >> inode;
+
+        if (iss.fail())
+        {
+            LOGE("parseMapsFromPath failed to parse line: %s", line.c_str());
+            continue;
+        }
+
+        // This operation can fail, it doesn't matter as it's an optional field.
+        std::getline(iss >> std::ws, pathname);
+
+        ret.emplace_back(map_entry_t(address_start, address_end, offset, perms, pathname, makedev(dev_major, dev_minor), inode));
+    }
+
+    return ret;
+}

module/jni/mountinfo_parser.cpp

@@ -22,10 +22,10 @@ mountinfo_entry_t::mountinfo_entry_t(int mount_id, int parent_id, int major, int
     this->super_options = parseMountOptions(super_options);
 }
 
-const int &mountinfo_entry_t::getMountId() const { return mount_id; }
-const int &mountinfo_entry_t::getParentId() const { return parent_id; }
-const int &mountinfo_entry_t::getMajor() const { return major; }
-const int &mountinfo_entry_t::getMinor() const { return minor; }
+int mountinfo_entry_t::getMountId() const { return mount_id; }
+int mountinfo_entry_t::getParentId() const { return parent_id; }
+int mountinfo_entry_t::getMajor() const { return major; }
+int mountinfo_entry_t::getMinor() const { return minor; }
 const std::string &mountinfo_entry_t::getRoot() const { return root; }
 const std::string &mountinfo_entry_t::getMountPoint() const { return mount_point; }
 const std::unordered_map<std::string, std::string> &mountinfo_entry_t::getMountOptions() const { return mount_options; }

module/jni/utils.cpp

@@ -0,0 +1,29 @@
+#include <string>
+
+#include "map_parser.hpp"
+#include "utils.hpp"
+#include "android_filesystem_config.h"
+#include "zygisk.hpp"
+
+bool hook_plt_by_name(zygisk::Api *api, const std::string &libName, const std::string &symbolName, void *hookFunc, void **origFunc)
+{
+    for (const auto &map : parseMapsFromPath("/proc/self/maps"))
+    {
+        if (map.getPathname().ends_with("/" + libName))
+        {
+            api->pltHookRegister(map.getDevice(), map.getInode(), symbolName.c_str(), hookFunc, origFunc);
+            return true;
+        }
+    }
+    return false;
+}
+
+int is_userapp_uid(int uid)
+{
+    int appid = uid % AID_USER_OFFSET;
+    if (appid >= AID_APP_START && appid <= AID_APP_END)
+        return true;
+    if (appid >= AID_ISOLATED_START && appid <= AID_ISOLATED_END)
+        return true;
+    return false;
+}