Skip to content

Commit 1a03a36

Browse files
koushkoush
committed
require that --daemon is uid/gid 0
execv invocation fixes Change-Id: I80e7100a834b7eca2d9c8560c221cffd41492f03
1 parent 1a63a88 commit 1a03a36

File tree

9 files changed

+123
-44
lines changed

9 files changed

+123
-44
lines changed

‎.gitignore

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,5 @@ obj
55
local.properties
66
gen
77
.DS_Store
8-
.settings
8+
.settings
9+
libs

‎Superuser/AndroidManifest.xml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
33
package="com.koushikdutta.superuser"
4-
android:versionCode="1022"
5-
android:versionName="1.0.2.2" >
4+
android:versionCode="1023"
5+
android:versionName="1.0.2.3" >
66

77
<uses-sdk
88
android:minSdkVersion="8"

‎Superuser/assets/update-binary

100644100755
File mode changed.

‎Superuser/jni/Application.mk

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
APP_ABI := x86 armeabi mips
2-
NDK_TOOLCHAIN_VERSION=4.7
2+
NDK_TOOLCHAIN_VERSION=4.8
33
APP_PIE = false

‎Superuser/jni/su/activity.c

Lines changed: 110 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,15 @@
2626

2727
#include "su.h"
2828

29+
/* intent actions */
30+
#define ACTION_REQUEST "start", "-n", REQUESTOR "/" REQUESTOR_PREFIX ".RequestActivity"
31+
#define ACTION_NOTIFY "start", "-n", REQUESTOR "/" REQUESTOR_PREFIX ".NotifyActivity"
32+
#define ACTION_RESULT "broadcast", "-n", REQUESTOR "/" REQUESTOR_PREFIX ".SuReceiver"
33+
34+
#define AM_PATH "/system/bin/app_process", "/system/bin", "com.android.commands.am.Am"
35+
2936
// TODO: leverage this with exec_log?
30-
int silent_run(char* command) {
31-
char *args[] = { "sh", "-c", command, NULL, };
37+
int silent_run(char* const args[]) {
3238
set_identity(0);
3339
pid_t pid;
3440
pid = fork();
@@ -45,7 +51,8 @@ int silent_run(char* command) {
4551
int null = open("/dev/null", O_WRONLY | O_CLOEXEC);
4652
dup2(null, 1);
4753
dup2(null, 2);
48-
execv(_PATH_BSHELL, args);
54+
setenv("CLASSPATH", "/system/framework/am.jar", 1);
55+
execv(args[0], args);
4956
PLOGE("exec am");
5057
_exit(EXIT_FAILURE);
5158
return -1;
@@ -58,39 +65,97 @@ int get_owner_login_user_args(struct su_context *ctx, char* user, int user_len)
5865
if (0 != ctx->user.android_user_id) {
5966
needs_owner_login_prompt = 1;
6067
}
61-
snprintf(user, user_len, "--user 0");
68+
snprintf(user, user_len, "0");
6269
}
6370
else if (ctx->user.multiuser_mode == MULTIUSER_MODE_USER) {
64-
snprintf(user, user_len, "--user %d", ctx->user.android_user_id);
71+
snprintf(user, user_len, "%d", ctx->user.android_user_id);
6572
}
6673
else if (ctx->user.multiuser_mode == MULTIUSER_MODE_NONE) {
6774
user[0] = '\0';
6875
}
6976
else {
70-
snprintf(user, user_len, "--user 0");
77+
snprintf(user, user_len, "0");
7178
}
7279

7380
return needs_owner_login_prompt;
7481
}
7582

7683
int send_result(struct su_context *ctx, policy_t policy) {
77-
char user[64];
78-
get_owner_login_user_args(ctx, user, sizeof(user));
79-
84+
char binary_version[256];
85+
sprintf(binary_version, "%d", VERSION_CODE);
86+
87+
char uid[256];
88+
sprintf(uid, "%d", ctx->from.uid);
89+
90+
char desired_uid[256];
91+
sprintf(desired_uid, "%d", ctx->to.uid);
92+
8093
if (0 != ctx->user.android_user_id) {
81-
char user_result_command[ARG_MAX];
82-
snprintf(user_result_command, sizeof(user_result_command), "exec /system/bin/am " ACTION_RESULT " --ei binary_version %d --es from_name '%s' --es desired_name '%s' --ei uid %d --ei desired_uid %d --es command '%s' --es action %s --user %d",
83-
VERSION_CODE,
84-
ctx->from.name, ctx->to.name,
85-
ctx->from.uid, ctx->to.uid, get_command(&ctx->to), policy == ALLOW ? "allow" : "deny", ctx->user.android_user_id);
94+
char android_user_id[256];
95+
sprintf(android_user_id, "%d", ctx->user.android_user_id);
96+
97+
char *user_result_command[] = {
98+
AM_PATH,
99+
ACTION_RESULT,
100+
"--ei",
101+
"binary_version",
102+
binary_version,
103+
"--es",
104+
"from_name",
105+
ctx->from.name,
106+
"--es",
107+
"desired_name",
108+
ctx->to.name,
109+
"--ei",
110+
"uid",
111+
uid,
112+
"--ei",
113+
"desired_uid",
114+
desired_uid,
115+
"--es",
116+
"command",
117+
get_command(&ctx->to),
118+
"--es",
119+
"action",
120+
policy == ALLOW ? "allow" : "deny",
121+
"--user",
122+
android_user_id,
123+
NULL
124+
};
86125
silent_run(user_result_command);
87126
}
88127

89-
char result_command[ARG_MAX];
90-
snprintf(result_command, sizeof(result_command), "exec /system/bin/am " ACTION_RESULT " --ei binary_version %d --es from_name '%s' --es desired_name '%s' --ei uid %d --ei desired_uid %d --es command '%s' --es action %s %s",
91-
VERSION_CODE,
92-
ctx->from.name, ctx->to.name,
93-
ctx->from.uid, ctx->to.uid, get_command(&ctx->to), policy == ALLOW ? "allow" : "deny", user);
128+
char user[64];
129+
get_owner_login_user_args(ctx, user, sizeof(user));
130+
131+
char *result_command[] = {
132+
AM_PATH,
133+
ACTION_RESULT,
134+
"--ei",
135+
"binary_version",
136+
binary_version,
137+
"--es",
138+
"from_name",
139+
ctx->from.name,
140+
"--es",
141+
"desired_name",
142+
ctx->to.name,
143+
"--ei",
144+
"uid",
145+
uid,
146+
"--ei",
147+
"desired_uid",
148+
desired_uid,
149+
"--es",
150+
"command",
151+
get_command(&ctx->to),
152+
"--es",
153+
"action",
154+
policy == ALLOW ? "allow" : "deny",
155+
"--user",
156+
user,
157+
NULL
158+
};
94159
return silent_run(result_command);
95160
}
96161

@@ -104,26 +169,40 @@ int send_request(struct su_context *ctx) {
104169

105170
int ret;
106171
if (needs_owner_login_prompt) {
107-
// in multiuser mode, the owner gets the su prompt
108-
char notify_command[ARG_MAX];
172+
char uid[256];
173+
sprintf(uid, "%d", ctx->from.uid);
174+
175+
char android_user_id[256];
176+
sprintf(android_user_id, "%d", ctx->user.android_user_id);
109177

110-
// start the activity that confirms the request
111-
snprintf(notify_command, sizeof(notify_command),
112-
"exec /system/bin/am " ACTION_NOTIFY " --ei caller_uid %d --user %d",
113-
ctx->from.uid, ctx->user.android_user_id);
178+
// in multiuser mode, the owner gets the su prompt
179+
char *notify_command[] = {
180+
AM_PATH,
181+
ACTION_NOTIFY,
182+
"--ei",
183+
"caller_uid",
184+
uid,
185+
"--user",
186+
android_user_id,
187+
NULL
188+
};
114189

115190
int ret = silent_run(notify_command);
116191
if (ret) {
117192
return ret;
118193
}
119194
}
120195

121-
char request_command[ARG_MAX];
122-
123-
// start the activity that confirms the request
124-
snprintf(request_command, sizeof(request_command),
125-
"exec /system/bin/am " ACTION_REQUEST " --es socket '%s' %s",
126-
ctx->sock_path, user);
196+
char *request_command[] = {
197+
AM_PATH,
198+
ACTION_REQUEST,
199+
"--es",
200+
"socket",
201+
ctx->sock_path,
202+
"--user",
203+
user,
204+
NULL
205+
};
127206

128207
return silent_run(request_command);
129208
}

‎Superuser/jni/su/daemon.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -375,6 +375,11 @@ static int daemon_accept(int fd) {
375375
}
376376

377377
int run_daemon() {
378+
if (getuid() != 0 || getgid() != 0) {
379+
PLOGE("daemon requires root. uid/gid not root");
380+
return -1;
381+
}
382+
378383
int fd;
379384
struct sockaddr_un sun;
380385

‎Superuser/jni/su/su.h

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -71,18 +71,13 @@
7171
#define REQUESTOR_DATABASE_PATH REQUESTOR "/databases/su.sqlite"
7272
#define REQUESTOR_MULTIUSER_MODE REQUESTOR_FILES_PATH "/multiuser_mode"
7373

74-
/* intent actions */
75-
#define ACTION_REQUEST "start -n " REQUESTOR "/" REQUESTOR_PREFIX ".RequestActivity"
76-
#define ACTION_NOTIFY "start -n " REQUESTOR "/" REQUESTOR_PREFIX ".NotifyActivity"
77-
#define ACTION_RESULT "broadcast -n " REQUESTOR "/" REQUESTOR_PREFIX ".SuReceiver"
78-
7974
#define DEFAULT_SHELL "/system/bin/sh"
8075

8176
#define xstr(a) str(a)
8277
#define str(a) #a
8378

8479
#ifndef VERSION_CODE
85-
#define VERSION_CODE 13
80+
#define VERSION_CODE 14
8681
#endif
8782
#define VERSION xstr(VERSION_CODE) " " REQUESTOR
8883

@@ -160,7 +155,6 @@ extern policy_t database_check(struct su_context *ctx);
160155
extern void set_identity(unsigned int uid);
161156
extern int send_request(struct su_context *ctx);
162157
extern int send_result(struct su_context *ctx, policy_t policy);
163-
extern int silent_run(char* command);
164158

165159
static inline char *get_command(const struct su_request *to)
166160
{

‎Superuser/project.properties

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,6 @@
1111
#proguard.config=${sdk.dir}/tools/proguard/proguard-android.txt:proguard-project.txt
1212

1313
# Project target.
14-
target=android-18
14+
target=android-19
1515
android.library.reference.1=../../Widgets/Widgets
1616
ndk.executable=ndk-build

‎Superuser/src/com/koushikdutta/superuser/util/SuHelper.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
import android.util.Log;
55

66
public class SuHelper {
7-
public static String CURRENT_VERSION = "13";
7+
public static String CURRENT_VERSION = "14";
88
public static void checkSu(Context context) throws Exception {
99
Process p = Runtime.getRuntime().exec("su -v");
1010
String result = Settings.readToEnd(p.getInputStream());

0 commit comments

Comments
 (0)