Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2b525c22 authored by dianlujitao's avatar dianlujitao Committed by Luca Stefani
Browse files

adb_root: Enforce caller UID

 * AID_SYSTEM - Settings app
 * AID_SHELL - adbd
 * Apply minor clean up while at it

Change-Id: I15a5d18204a96cc2f8352a6cc7f6f901193aa5b9
parent a2ea48af
Loading
Loading
Loading
Loading
+20 −5
Original line number Diff line number Diff line
@@ -17,20 +17,27 @@
#include <android-base/file.h>
#include <android-base/logging.h>
#include <android-base/strings.h>
#include <private/android_filesystem_config.h>

#include "adbroot_service.h"

namespace {
const std::string kStoragePath = "/data/adbroot/";
const std::string kEnabled = "enabled";

static android::binder::Status SecurityException(const std::string& msg) {
    LOG(ERROR) << msg;
    return android::binder::Status::fromExceptionCode(android::binder::Status::EX_SECURITY,
            android::String8(msg.c_str()));
}
}  // anonymous namespace

namespace android {
namespace adbroot {

using ::android::base::ReadFileToString;
using ::android::base::Trim;
using ::android::base::WriteStringToFile;
using base::ReadFileToString;
using base::Trim;
using base::WriteStringToFile;

ADBRootService::ADBRootService() : enabled_(false) {
    std::string buf;
@@ -40,19 +47,27 @@ ADBRootService::ADBRootService() : enabled_(false) {
}

void ADBRootService::Register() {
    auto ret = android::BinderService<ADBRootService>::publish();
    if (ret != android::OK) {
    auto ret = BinderService<ADBRootService>::publish();
    if (ret != OK) {
        LOG(FATAL) << "Could not register adbroot service: " << ret;
    }
}

binder::Status ADBRootService::setEnabled(bool enabled) {
    uid_t uid = IPCThreadState::self()->getCallingUid();
    if (uid != AID_SYSTEM) {
        return SecurityException("Caller must be system");
    }
    enabled_ = enabled;
    WriteStringToFile(std::to_string(enabled), kStoragePath + kEnabled);
    return binder::Status::ok();
}

binder::Status ADBRootService::getEnabled(bool* _aidl_return) {
    uid_t uid = IPCThreadState::self()->getCallingUid();
    if (uid != AID_SYSTEM && uid != AID_SHELL) {
        return SecurityException("Caller must be system or shell");
    }
    *_aidl_return = enabled_;
    return binder::Status::ok();
}
+1 −1
Original line number Diff line number Diff line
@@ -34,5 +34,5 @@ int main(int /* argc */, char** argv) {
    }
    android::IPCThreadState::self()->joinThreadPool();

    exit(0);
    return 0;
}