1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <errno.h>
17 #include <fcntl.h>
18 #include <sched.h>
19 #include <stdbool.h>
20 #include <stdio.h>
21 #include <stdlib.h>
22 #include <unistd.h>
23
24 #include <sys/mount.h>
25 #include <sys/stat.h>
26 #include <sys/syscall.h>
27 #include <sys/types.h>
28
29 #include "appspawn_sandbox.h"
30 #include "appspawn_utils.h"
31 #include "securec.h"
32
33 /*
34 名称 fs-type flags options 说明
35 default MS_BIND MS_REC 默认可读写
36 rdonly MS_NODEV MS_RDONLY 只读挂载
37 epfs epfs MS_NODEV 待讨论
38 dac_override MS_NODEV MS_RDONLY "support_overwrite=1"
39 开启const.filemanager.full_mount.enable
40 fuse fuse MS_NOSUID MS_NODEV MS_NOEXEC MS_NOATIME MS_LAZYTIME
41 dlp_fuse fuse MS_NOSUID MS_NODEV MS_NOEXEC MS_NOATIME MS_LAZYTIME 为dlpmanager管理应用专用的挂载参数
42 shared MS_BIND MS_REC root
43 namespace上是MS_SHARED方式挂载
44
45 */
46 /**
47 "dac-override-sensitive": "true", 默认值：false。使能后直接使用默认值
48 "sandbox-flags-customized": [ "MS_NODEV", "MS_RDONLY" ],
49 "fs-type": "sharefs",
50 "options": "support_overwrite=1"
51 */
52 #define FUSE_MOUNT_FLAGS (MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_NOATIME | MS_LAZYTIME)
53 #define FUSE_MOUNT_OPTIONS \
54 "fd=%d, rootmode=40000,user_id=%d,group_id=%d,allow_other," \
55 "context=\"u:object_r:dlp_fuse_file:s0\", fscontext=u:object_r:dlp_fuse_file:s0"
56
57 static const MountArgTemplate DEF_MOUNT_ARG_TMP[MOUNT_TMP_MAX] = {
58 {"default", MOUNT_TMP_DEFAULT, NULL, MS_BIND | MS_REC, NULL, MS_SLAVE},
59 {"rdonly", MOUNT_TMP_RDONLY, NULL, MS_NODEV | MS_RDONLY, NULL, MS_SLAVE},
60 {"epfs", MOUNT_TMP_EPFS, "epfs", MS_NODEV, NULL, MS_SLAVE},
61 {"dac_override", MOUNT_TMP_DAC_OVERRIDE, "sharefs", MS_NODEV | MS_RDONLY, "support_overwrite=1", MS_SLAVE},
62 {"fuse", MOUNT_TMP_FUSE, "fuse", FUSE_MOUNT_FLAGS, FUSE_MOUNT_OPTIONS, MS_SHARED},
63 {"dlp_fuse", MOUNT_TMP_DLP_FUSE, "fuse", FUSE_MOUNT_FLAGS, FUSE_MOUNT_OPTIONS, MS_SHARED},
64 {"shared", MOUNT_TMP_SHRED, NULL, MS_BIND | MS_REC, NULL, MS_SHARED},
65 };
66
67 static const SandboxFlagInfo MOUNT_FLAGS_MAP[] = {
68 {"rec", MS_REC}, {"MS_REC", MS_REC},
69 {"bind", MS_BIND}, {"MS_BIND", MS_BIND}, {"move", MS_MOVE}, {"MS_MOVE", MS_MOVE},
70 {"slave", MS_SLAVE}, {"MS_SLAVE", MS_SLAVE}, {"rdonly", MS_RDONLY}, {"MS_RDONLY", MS_RDONLY},
71 {"shared", MS_SHARED}, {"MS_SHARED", MS_SHARED}, {"unbindable", MS_UNBINDABLE},
72 {"MS_UNBINDABLE", MS_UNBINDABLE}, {"remount", MS_REMOUNT}, {"MS_REMOUNT", MS_REMOUNT},
73 {"nosuid", MS_NOSUID}, {"MS_NOSUID", MS_NOSUID}, {"nodev", MS_NODEV}, {"MS_NODEV", MS_NODEV},
74 {"noexec", MS_NOEXEC}, {"MS_NOEXEC", MS_NOEXEC}, {"noatime", MS_NOATIME}, {"MS_NOATIME", MS_NOATIME},
75 {"lazytime", MS_LAZYTIME}, {"MS_LAZYTIME", MS_LAZYTIME}
76 };
77
78 static const SandboxFlagInfo PATH_MODE_MAP[] = {
79 {"S_IRUSR", S_IRUSR}, {"S_IWUSR", S_IWUSR}, {"S_IXUSR", S_IXUSR},
80 {"S_IRGRP", S_IRGRP}, {"S_IWGRP", S_IWGRP}, {"S_IXGRP", S_IXGRP},
81 {"S_IROTH", S_IROTH}, {"S_IWOTH", S_IWOTH}, {"S_IXOTH", S_IXOTH},
82 {"S_IRWXU", S_IRWXU}, {"S_IRWXG", S_IRWXG}, {"S_IRWXO", S_IRWXO}
83 };
84
GetMountCategory(const char * name)85 uint32_t GetMountCategory(const char *name)
86 {
87 APPSPAWN_CHECK_ONLY_EXPER(name != NULL, return MOUNT_TMP_DEFAULT);
88 uint32_t count = ARRAY_LENGTH(DEF_MOUNT_ARG_TMP);
89 for (uint32_t i = 0; i < count; i++) {
90 if (strcmp(DEF_MOUNT_ARG_TMP[i].name, name) == 0) {
91 return DEF_MOUNT_ARG_TMP[i].category;
92 }
93 }
94 return MOUNT_TMP_DEFAULT;
95 }
96
GetMountArgTemplate(uint32_t category)97 const MountArgTemplate *GetMountArgTemplate(uint32_t category)
98 {
99 uint32_t count = ARRAY_LENGTH(DEF_MOUNT_ARG_TMP);
100 if (category > count) {
101 return NULL;
102 }
103 for (uint32_t i = 0; i < count; i++) {
104 if (DEF_MOUNT_ARG_TMP[i].category == category) {
105 return &DEF_MOUNT_ARG_TMP[i];
106 }
107 }
108 return NULL;
109 }
110
GetSandboxFlagInfo(const char * key,const SandboxFlagInfo * flagsInfos,uint32_t count)111 const SandboxFlagInfo *GetSandboxFlagInfo(const char *key, const SandboxFlagInfo *flagsInfos, uint32_t count)
112 {
113 APPSPAWN_CHECK_ONLY_EXPER(key != NULL, return NULL);
114 APPSPAWN_CHECK_ONLY_EXPER(flagsInfos != NULL, return NULL);
115 for (uint32_t i = 0; i < count; i++) {
116 if (strcmp(flagsInfos[i].name, key) == 0) {
117 return &flagsInfos[i];
118 }
119 }
120 return NULL;
121 }
122
GetPathMode(const char * name)123 int GetPathMode(const char *name)
124 {
125 APPSPAWN_CHECK_ONLY_EXPER(name != NULL, return 0);
126 const SandboxFlagInfo *info = GetSandboxFlagInfo(name, PATH_MODE_MAP, ARRAY_LENGTH(PATH_MODE_MAP));
127 if (info != NULL) {
128 return info->flags;
129 }
130 return 0;
131 }
132
DumpSandboxFlags(char * buffer,uint32_t bufferSize,unsigned long flags,const SandboxFlagInfo * flagsInfos,uint32_t count)133 static void DumpSandboxFlags(char *buffer, uint32_t bufferSize, unsigned long flags,
134 const SandboxFlagInfo *flagsInfos, uint32_t count)
135 {
136 bool first = true;
137 size_t currLen = 0;
138 int len = 0;
139 unsigned long tmp = flags;
140 for (uint32_t i = 0; i < count; i++) {
141 if ((flagsInfos[i].flags & tmp) == 0) {
142 continue;
143 }
144 tmp &= ~(flagsInfos[i].flags);
145 if (!first) {
146 len = sprintf_s(buffer + currLen, bufferSize - currLen - 1, " %s ", "|");
147 APPSPAWN_CHECK_ONLY_EXPER(len > 0, return);
148 currLen += len;
149 }
150 first = false;
151 len = sprintf_s(buffer + currLen, bufferSize - currLen, "%s", flagsInfos[i].name);
152 APPSPAWN_CHECK_ONLY_EXPER(len > 0, return);
153 currLen += len;
154 }
155 }
156
DumpMode(const char * info,mode_t mode)157 static void DumpMode(const char *info, mode_t mode)
158 {
159 APPSPAWN_CHECK_ONLY_EXPER(info != NULL, return);
160 char buffer[64] = {0}; // 64 to show flags
161 DumpSandboxFlags(buffer, sizeof(buffer), mode, PATH_MODE_MAP, ARRAY_LENGTH(PATH_MODE_MAP));
162 APPSPAPWN_DUMP("%{public}s[0x%{public}x] %{public}s", info, (uint32_t)(mode), buffer);
163 }
164
DumpMountFlags(const char * info,unsigned long mountFlags)165 static void DumpMountFlags(const char *info, unsigned long mountFlags)
166 {
167 APPSPAWN_CHECK_ONLY_EXPER(info != NULL, return);
168 char buffer[128] = {0}; // 64 to show flags
169 DumpSandboxFlags(buffer, sizeof(buffer), mountFlags, MOUNT_FLAGS_MAP, ARRAY_LENGTH(MOUNT_FLAGS_MAP));
170 APPSPAPWN_DUMP("%{public}s[0x%{public}x] %{public}s", info, (uint32_t)(mountFlags), buffer);
171 }
172
DumpMountPathMountNode(const PathMountNode * pathNode)173 void DumpMountPathMountNode(const PathMountNode *pathNode)
174 {
175 const MountArgTemplate *tmp = GetMountArgTemplate(pathNode->category);
176 if (tmp == NULL) {
177 return;
178 }
179 APPSPAPWN_DUMP(" sandbox node category: %{public}u(%{public}s)", tmp->category, tmp->name);
180 DumpMountFlags(" sandbox node mountFlags: ", tmp->mountFlags);
181 APPSPAPWN_DUMP(" sandbox node mountSharedFlag: %{public}s",
182 tmp->mountSharedFlag == MS_SLAVE ? "MS_SLAVE" : "MS_SHARED");
183 APPSPAPWN_DUMP(" sandbox node options: %{public}s", tmp->options ? tmp->options : "null");
184 APPSPAPWN_DUMP(" sandbox node fsType: %{public}s", tmp->fsType ? tmp->fsType : "null");
185 DumpMode(" sandbox node destMode: ", pathNode->destMode);
186 APPSPAPWN_DUMP(" sandbox node config mountSharedFlag: %{public}s",
187 pathNode->mountSharedFlag ? "MS_SHARED" : "MS_SLAVE");
188 }