1 /*
2  * Copyright (C) 2012-2014 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include <limits.h>
18 #include <sys/cdefs.h>
19 #include <sys/prctl.h>
20 #include <sys/socket.h>
21 #include <sys/types.h>
22 #include <sys/un.h>
23 #include <unistd.h>
24 
25 #include <thread>
26 
27 #include <cutils/sockets.h>
28 #include <private/android_filesystem_config.h>
29 #include <private/android_logger.h>
30 
31 #include "LogBuffer.h"
32 #include "LogListener.h"
33 #include "LogPermissions.h"
34 
LogListener(LogBuffer * buf)35 LogListener::LogListener(LogBuffer* buf) : socket_(GetLogSocket()), logbuf_(buf) {}
36 
StartListener()37 bool LogListener::StartListener() {
38     if (socket_ <= 0) {
39         return false;
40     }
41     auto thread = std::thread(&LogListener::ThreadFunction, this);
42     thread.detach();
43     return true;
44 }
45 
ThreadFunction()46 void LogListener::ThreadFunction() {
47     prctl(PR_SET_NAME, "logd.writer");
48 
49     while (true) {
50         HandleData();
51     }
52 }
53 
HandleData()54 void LogListener::HandleData() {
55     // + 1 to ensure null terminator if MAX_PAYLOAD buffer is received
56     __attribute__((uninitialized)) char
57             buffer[sizeof(android_log_header_t) + LOGGER_ENTRY_MAX_PAYLOAD + 1];
58     struct iovec iov = {buffer, sizeof(buffer) - 1};
59 
60     alignas(4) char control[CMSG_SPACE(sizeof(struct ucred))];
61     struct msghdr hdr = {
62         nullptr, 0, &iov, 1, control, sizeof(control), 0,
63     };
64 
65     // To clear the entire buffer is secure/safe, but this contributes to 1.68%
66     // overhead under logging load. We are safe because we check counts, but
67     // still need to clear null terminator
68     // memset(buffer, 0, sizeof(buffer));
69     ssize_t n = recvmsg(socket_, &hdr, 0);
70     if (n <= (ssize_t)(sizeof(android_log_header_t))) {
71         return;
72     }
73 
74     buffer[n] = 0;
75 
76     struct ucred* cred = nullptr;
77 
78     struct cmsghdr* cmsg = CMSG_FIRSTHDR(&hdr);
79     while (cmsg != nullptr) {
80         if (cmsg->cmsg_level == SOL_SOCKET &&
81             cmsg->cmsg_type == SCM_CREDENTIALS) {
82             cred = (struct ucred*)CMSG_DATA(cmsg);
83             break;
84         }
85         cmsg = CMSG_NXTHDR(&hdr, cmsg);
86     }
87 
88     if (cred == nullptr) {
89         return;
90     }
91 
92     if (cred->uid == AID_LOGD) {
93         // ignore log messages we send to ourself.
94         // Such log messages are often generated by libraries we depend on
95         // which use standard Android logging.
96         return;
97     }
98 
99     android_log_header_t* header =
100         reinterpret_cast<android_log_header_t*>(buffer);
101     log_id_t logId = static_cast<log_id_t>(header->id);
102     if (/* logId < LOG_ID_MIN || */ logId >= LOG_ID_MAX ||
103         logId == LOG_ID_KERNEL) {
104         return;
105     }
106 
107     if ((logId == LOG_ID_SECURITY) &&
108         (!__android_log_security() ||
109          !clientHasLogCredentials(cred->uid, cred->gid, cred->pid))) {
110         return;
111     }
112 
113     char* msg = ((char*)buffer) + sizeof(android_log_header_t);
114     n -= sizeof(android_log_header_t);
115 
116     // NB: hdr.msg_flags & MSG_TRUNC is not tested, silently passing a
117     // truncated message to the logs.
118 
119     logbuf_->Log(logId, header->realtime, cred->uid, cred->pid, header->tid, msg,
120                  ((size_t)n <= UINT16_MAX) ? (uint16_t)n : UINT16_MAX);
121 }
122 
GetLogSocket()123 int LogListener::GetLogSocket() {
124     static const char socketName[] = "logdw";
125     int sock = android_get_control_socket(socketName);
126 
127     if (sock < 0) {  // logd started up in init.sh
128         sock = socket_local_server(
129             socketName, ANDROID_SOCKET_NAMESPACE_RESERVED, SOCK_DGRAM);
130 
131         int on = 1;
132         if (setsockopt(sock, SOL_SOCKET, SO_PASSCRED, &on, sizeof(on))) {
133             return -1;
134         }
135     }
136     return sock;
137 }
138