From 64269c8c4fad291a3d7efe938f4fbddbadf3d8da Mon Sep 17 00:00:00 2001 From: LoveSy Date: Thu, 1 Feb 2024 23:28:56 +0800 Subject: [PATCH] Use rustix for prctl (#1333) --- userspace/ksud/Cargo.lock | 18 ++++++-- userspace/ksud/Cargo.toml | 2 +- userspace/ksud/src/ksu.rs | 84 +++++++++------------------------- userspace/ksud/src/sepolicy.rs | 15 +----- 4 files changed, 38 insertions(+), 81 deletions(-) diff --git a/userspace/ksud/Cargo.lock b/userspace/ksud/Cargo.lock index 6278826e..4bffd606 100644 --- a/userspace/ksud/Cargo.lock +++ b/userspace/ksud/Cargo.lock @@ -859,7 +859,7 @@ dependencies = [ "regex", "retry", "rust-embed", - "rustix 0.38.30", + "rustix 0.38.30 (git+https://github.com/Kernel-SU/rustix.git)", "serde", "serde_json", "sha256", @@ -1155,7 +1155,7 @@ dependencies = [ "hex", "lazy_static", "procfs-core", - "rustix 0.38.30", + "rustix 0.38.30 (registry+https://github.com/rust-lang/crates.io-index)", ] [[package]] @@ -1374,6 +1374,18 @@ name = "rustix" version = "0.38.30" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "322394588aaf33c24007e8bb3238ee3e4c5c09c084ab32bc73890b99ff326bca" +dependencies = [ + "bitflags 2.4.1", + "errno 0.3.8", + "libc", + "linux-raw-sys 0.4.13", + "windows-sys 0.52.0", +] + +[[package]] +name = "rustix" +version = "0.38.30" +source = "git+https://github.com/Kernel-SU/rustix.git#cea95a423076be6a793679773fb4e80a3e40f38c" dependencies = [ "bitflags 2.4.1", "errno 0.3.8", @@ -1690,7 +1702,7 @@ dependencies = [ "either", "home", "once_cell", - "rustix 0.38.30", + "rustix 0.38.30 (registry+https://github.com/rust-lang/crates.io-index)", "windows-sys 0.48.0", ] diff --git a/userspace/ksud/Cargo.toml b/userspace/ksud/Cargo.toml index cfeba42b..b13c16e1 100644 --- a/userspace/ksud/Cargo.toml +++ b/userspace/ksud/Cargo.toml @@ -39,7 +39,7 @@ chrono = "0.4" hole-punch = { git = "https://github.com/tiann/hole-punch" } [target.'cfg(any(target_os = "android", target_os = "linux"))'.dependencies] -rustix = { version = "0.38", features = ["all-apis"] } +rustix = { git = "https://github.com/Kernel-SU/rustix.git", features = ["all-apis"] } # some android specific dependencies which compiles under unix are also listed here for convenience of coding android-properties = { version = "0.2.2", features = ["bionic-deprecated"] } procfs = "0.16" diff --git a/userspace/ksud/src/ksu.rs b/userspace/ksud/src/ksu.rs index 6d917ee6..29042a38 100644 --- a/userspace/ksud/src/ksu.rs +++ b/userspace/ksud/src/ksu.rs @@ -1,7 +1,4 @@ use anyhow::{Ok, Result}; - -#[cfg(unix)] -use anyhow::ensure; use getopts::Options; use std::env; #[cfg(unix)] @@ -20,39 +17,14 @@ use rustix::{ thread::{set_thread_res_gid, set_thread_res_uid, Gid, Uid}, }; -pub const KERNEL_SU_OPTION: u32 = 0xDEAD_BEEF; - -const CMD_GRANT_ROOT: u64 = 0; -// const CMD_BECOME_MANAGER: u64 = 1; -const CMD_GET_VERSION: u64 = 2; -// const CMD_ALLOW_SU: u64 = 3; -// const CMD_DENY_SU: u64 = 4; -// const CMD_GET_ALLOW_LIST: u64 = 5; -// const CMD_GET_DENY_LIST: u64 = 6; -const CMD_REPORT_EVENT: u64 = 7; -pub const CMD_SET_SEPOLICY: u64 = 8; -pub const CMD_CHECK_SAFEMODE: u64 = 9; - const EVENT_POST_FS_DATA: u64 = 1; const EVENT_BOOT_COMPLETED: u64 = 2; const EVENT_MODULE_MOUNTED: u64 = 3; #[cfg(any(target_os = "linux", target_os = "android"))] pub fn grant_root() -> Result<()> { - let mut result: u32 = 0; - unsafe { - #[allow(clippy::cast_possible_wrap)] - libc::prctl( - KERNEL_SU_OPTION as i32, // supposed to overflow - CMD_GRANT_ROOT, - 0, - 0, - std::ptr::addr_of_mut!(result).cast::(), - ); - } - - ensure!(result == KERNEL_SU_OPTION, "grant root failed"); - Err(std::process::Command::new("sh").exec().into()) + rustix::process::ksu_grant_root()?; + Ok(()) } #[cfg(not(any(target_os = "linux", target_os = "android")))] @@ -302,46 +274,32 @@ fn add_path_to_env(path: &str) -> Result<()> { Ok(()) } +#[cfg(any(target_os = "linux", target_os = "android"))] pub fn get_version() -> i32 { - let mut result: i32 = 0; - #[cfg(any(target_os = "linux", target_os = "android"))] - unsafe { - #[allow(clippy::cast_possible_wrap)] - libc::prctl( - KERNEL_SU_OPTION as i32, // supposed to overflow - CMD_GET_VERSION, - std::ptr::addr_of_mut!(result).cast::(), - ); - } - result + rustix::process::ksu_get_version() } +#[cfg(not(any(target_os = "linux", target_os = "android")))] +pub fn get_version() -> i32 { + 0 +} + +#[cfg(any(target_os = "linux", target_os = "android"))] fn report_event(event: u64) { - #[cfg(any(target_os = "linux", target_os = "android"))] - unsafe { - #[allow(clippy::cast_possible_wrap)] - libc::prctl( - KERNEL_SU_OPTION as i32, // supposed to overflow - CMD_REPORT_EVENT, - event, - ); - } + rustix::process::ksu_report_event(event) } +#[cfg(not(any(target_os = "linux", target_os = "android")))] +fn report_event(_event: u64) {} + +#[cfg(any(target_os = "linux", target_os = "android"))] pub fn check_kernel_safemode() -> bool { - let mut result: i32 = 0; - #[cfg(any(target_os = "linux", target_os = "android"))] - unsafe { - #[allow(clippy::cast_possible_wrap)] - libc::prctl( - KERNEL_SU_OPTION as i32, // supposed to overflow - CMD_CHECK_SAFEMODE, - 0, - 0, - std::ptr::addr_of_mut!(result).cast::(), - ); - } - result == KERNEL_SU_OPTION as i32 + rustix::process::ksu_check_kernel_safemode() +} + +#[cfg(not(any(target_os = "linux", target_os = "android")))] +pub fn check_kernel_safemode() -> bool { + false } pub fn report_post_fs_data() { diff --git a/userspace/ksud/src/sepolicy.rs b/userspace/ksud/src/sepolicy.rs index c409fcc0..581c416a 100644 --- a/userspace/ksud/src/sepolicy.rs +++ b/userspace/ksud/src/sepolicy.rs @@ -696,20 +696,7 @@ fn apply_one_rule<'a>(statement: &'a PolicyStatement<'a>, strict: bool) -> Resul let policies: Vec = statement.try_into()?; for policy in policies { - let mut result: u32 = 0; - let cpolicy = FfiPolicy::from(policy); - unsafe { - #[allow(clippy::cast_possible_wrap)] - libc::prctl( - crate::ksu::KERNEL_SU_OPTION as i32, // supposed to overflow - crate::ksu::CMD_SET_SEPOLICY, - 0, - std::ptr::addr_of!(cpolicy).cast::(), - std::ptr::addr_of_mut!(result).cast::(), - ); - } - - if result != crate::ksu::KERNEL_SU_OPTION { + if !rustix::process::ksu_set_policy(&FfiPolicy::from(policy)) { log::warn!("apply rule: {:?} failed.", statement); if strict { return Err(anyhow::anyhow!("apply rule {:?} failed.", statement));