Hold the manager APK at a label its receiver can read - #949
Open
JingMatrix wants to merge 1 commit into
Open
Conversation
The manager APK is the one file in the module directory that leaves it as a descriptor rather than as bytes: the framework service hands it to the host process to inject, and the manager service hands it to an installed manager to update itself. The kernel judges that hand-off by the receiver -- selinux_binder_transfer_file checks the file against cred_sid(to) -- so the read is asked of u:r:shell:s0 for the parasitic host, and of the app's own domain for an installed one, never of the daemon's root context. Opening the file as root proves nothing about whether it can be passed on. What makes the hand-off work is the label the installer leaves: Magisk's set_perm_recursive writes system_file over the module tree, and the platform lets every appdomain and coredomain read one. Nothing holds it there. /data/adb is adb_data_file in the platform's file_contexts, and init runs restorecon --recursive --skip-ce /data at post-fs-data whenever the file_contexts digest stored on a directory no longer matches -- which is what a system image flashed over a kept /data does. The default comes back, adb_data_file is readable by adbd alone, and every launch from then on fails the transfer. Magisk's own boot restorecon does not repair it either, relabelling only what is unlabeled. The daemon is already the thing that reasserts labels at startup -- its directory under /data/adb/lspd, the dex2oat wrappers and the oat hook beside this APK -- so it reasserts this one too, and only when the label has drifted. system_file rather than xposed_file: the shipped rule grants xposed_file to shell but not to untrusted_app, which would leave an installed manager unable to update itself. The failure this leaves behind names nothing. The host is handed no descriptor, the parse of it fails, and what the user sees is the host's own activity dying on the intent it was never given. Reported in #948.
1 task
|
thanks this solve my problem in #948 ❤️ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
manager.apkis the only file in the module directory that leaves it as a descriptor: the daemon passes it over binder to the parasitic host, and to an installed manager updating itself. The kernel judges that transfer by the receiver —selinux_binder_transfer_filechecks the file againstcred_sid(to), so the read is asked ofu:r:shell:s0.The installer labels the module tree
system_file, which every appdomain and coredomain may read. Nothing holds it there:/data/adbisadb_data_fileby default, and init'srestorecon --recursive --skip-ce /datarewalks the tree whenever a directory's stored digest stops matching — a system image flashed over a kept/data. Every launch then fails the transfer, and the host dies on an intent it was never given (#948).So the daemon reasserts the label at startup, beside
/data/adb/lspdand the dex2oat wrappers, and only when it has drifted.