tools/helpers/lxc.py

   1 # Copyright 2021 Erfan Abdi
   2 # SPDX-License-Identifier: GPL-3.0-or-later
   3 import subprocess
   4 import os
   5 import logging
   6 import glob
   7 import shutil
   8 import time
   9 import platform
  10 import gbinder
  11 import tools.config
  12 import tools.helpers.run
  13
  14 def get_lxc_version(args):
  15     if shutil.which("lxc-info") is not None:
  16         command = ["lxc-info", "--version"]
  17         version_str = tools.helpers.run.user(args, command, output_return=True)
  18         return int(version_str[0])
  19     else:
  20         return 0
  21
  22 def add_node_entry(nodes, src, dist, mnt_type, options, check):
  23     if check and not os.path.exists(src):
  24         return False
  25     entry = "lxc.mount.entry = "
  26     entry += src + " "
  27     if dist is None:
  28         dist = src[1:]
  29     entry += dist + " "
  30     entry += mnt_type + " "
  31     entry += options
  32     nodes.append(entry)
  33     return True
  34
  35 def generate_nodes_lxc_config(args):
  36     nodes = []
  37     def make_entry(src, dist=None, mnt_type="none", options="bind,create=file,optional 0 0", check=True):
  38         return add_node_entry(nodes, src, dist, mnt_type, options, check)
  39
  40     # Necessary dev nodes
  41     make_entry("tmpfs", "dev", "tmpfs", "nosuid 0 0", False)
  42     make_entry("/dev/zero")
  43     make_entry("/dev/null")
  44     make_entry("/dev/full")
  45     make_entry("/dev/ashmem")
  46     make_entry("/dev/fuse")
  47     make_entry("/dev/ion")
  48     make_entry("/dev/tty")
  49     make_entry("/dev/char", options="bind,create=dir,optional 0 0")
  50
  51     # Graphic dev nodes
  52     make_entry("/dev/kgsl-3d0")
  53     make_entry("/dev/mali0")
  54     make_entry("/dev/pvr_sync")
  55     make_entry("/dev/pmsg0")
  56     make_entry("/dev/dxg")
  57     render, _ = tools.helpers.gpu.getDriNode(args)
  58     make_entry(render)
  59
  60     for n in glob.glob("/dev/fb*"):
  61         make_entry(n)
  62     for n in glob.glob("/dev/graphics/fb*"):
  63         make_entry(n)
  64     for n in glob.glob("/dev/video*"):
  65         make_entry(n)
  66     for n in glob.glob("/dev/dma_heap/*"):
  67         make_entry(n)
  68
  69     # Binder dev nodes
  70     make_entry("/dev/" + args.BINDER_DRIVER, "dev/binder", check=False)
  71     make_entry("/dev/" + args.VNDBINDER_DRIVER, "dev/vndbinder", check=False)
  72     make_entry("/dev/" + args.HWBINDER_DRIVER, "dev/hwbinder", check=False)
  73
  74     if args.vendor_type != "MAINLINE":
  75         if not make_entry("/dev/hwbinder", "dev/host_hwbinder"):
  76             raise OSError('Binder node "hwbinder" of host not found')
  77         make_entry("/vendor", "vendor_extra", options="rbind,optional 0 0")
  78
  79     # Necessary device nodes for adb
  80     make_entry("none", "dev/pts", "devpts", "defaults,mode=644,ptmxmode=666,create=dir 0 0", False)
  81     make_entry("/dev/uhid")
  82
  83     # TUN/TAP device node for VPN
  84     make_entry("/dev/net/tun", "dev/tun")
  85
  86     # Low memory killer sys node
  87     make_entry("/sys/module/lowmemorykiller", options="bind,create=dir,optional 0 0")
  88
  89     # Mount host permissions
  90     make_entry(tools.config.defaults["host_perms"],
  91                "vendor/etc/host-permissions", options="bind,optional 0 0")
  92
  93     # Necessary sw_sync node for HWC
  94     make_entry("/dev/sw_sync")
  95     make_entry("/sys/kernel/debug", options="rbind,create=dir,optional 0 0")
  96
  97     # Vibrator
  98     make_entry("/sys/class/leds/vibrator",
  99                options="bind,create=dir,optional 0 0")
 100     make_entry("/sys/devices/virtual/timed_output/vibrator",
 101                options="bind,create=dir,optional 0 0")
 102
 103     # Media dev nodes (for Mediatek)
 104     make_entry("/dev/Vcodec")
 105     make_entry("/dev/MTK_SMI")
 106     make_entry("/dev/mdp_sync")
 107     make_entry("/dev/mtk_cmdq")
 108
 109     # WSLg
 110     make_entry("tmpfs", "mnt_extra", "tmpfs", "nodev 0 0", False)
 111     make_entry("/mnt/wslg", "mnt_extra/wslg",
 112                options="rbind,create=dir,optional 0 0")
 113
 114     # Make a tmpfs at every possible rootfs mountpoint
 115     make_entry("tmpfs", "tmp", "tmpfs", "nodev 0 0", False)
 116     make_entry("tmpfs", "var", "tmpfs", "nodev 0 0", False)
 117     make_entry("tmpfs", "run", "tmpfs", "nodev 0 0", False)
 118
 119     # NFC config
 120     make_entry("/system/etc/libnfc-nci.conf", options="bind,optional 0 0")
 121
 122     return nodes
 123
 124 LXC_APPARMOR_PROFILE = "lxc-waydroid"
 125 def get_apparmor_status(args):
 126     enabled = False
 127     if shutil.which("aa-enabled"):
 128         enabled = (tools.helpers.run.user(args, ["aa-enabled", "--quiet"], check=False) == 0)
 129     if not enabled and shutil.which("systemctl"):
 130         enabled = (tools.helpers.run.user(args, ["systemctl", "is-active", "-q", "apparmor"], check=False) == 0)
 131     try:
 132         with open("/sys/kernel/security/apparmor/profiles", "r") as f:
 133             enabled &= (LXC_APPARMOR_PROFILE in f.read())
 134     except:
 135         enabled = False
 136     return enabled
 137
 138 def set_lxc_config(args):
 139     lxc_path = tools.config.defaults["lxc"] + "/waydroid"
 140     lxc_ver = get_lxc_version(args)
 141     if lxc_ver == 0:
 142         raise OSError("LXC is not installed")
 143     config_paths = tools.config.tools_src + "/data/configs/config_"
 144     seccomp_profile = tools.config.tools_src + "/data/configs/waydroid.seccomp"
 145
 146     config_snippets = [ config_paths + "base" ]
 147     # lxc v1 and v2 are bit special because some options got renamed later
 148     if lxc_ver <= 2:
 149         config_snippets.append(config_paths + "1")
 150     else:
 151         for ver in range(3, 5):
 152             snippet = config_paths + str(ver)
 153             if lxc_ver >= ver and os.path.exists(snippet):
 154                 config_snippets.append(snippet)
 155
 156     command = ["mkdir", "-p", lxc_path]
 157     tools.helpers.run.user(args, command)
 158     command = ["sh", "-c", "cat {} > \"{}\"".format(' '.join('"{0}"'.format(w) for w in config_snippets), lxc_path + "/config")]
 159     tools.helpers.run.user(args, command)
 160     command = ["sed", "-i", "s/LXCARCH/{}/".format(platform.machine()), lxc_path + "/config"]
 161     tools.helpers.run.user(args, command)
 162     command = ["cp", "-fpr", seccomp_profile, lxc_path + "/waydroid.seccomp"]
 163     tools.helpers.run.user(args, command)
 164     if get_apparmor_status(args):
 165         command = ["sed", "-i", "-E", "/lxc.aa_profile|lxc.apparmor.profile/ s/unconfined/{}/g".format(LXC_APPARMOR_PROFILE), lxc_path + "/config"]
 166         tools.helpers.run.user(args, command)
 167
 168     nodes = generate_nodes_lxc_config(args)
 169     config_nodes_tmp_path = args.work + "/config_nodes"
 170     config_nodes = open(config_nodes_tmp_path, "w")
 171     for node in nodes:
 172         config_nodes.write(node + "\n")
 173     config_nodes.close()
 174     command = ["mv", config_nodes_tmp_path, lxc_path]
 175     tools.helpers.run.user(args, command)
 176
 177     # Create empty file
 178     open(os.path.join(lxc_path, "config_session"), mode="w").close()
 179
 180 def generate_session_lxc_config(args, session):
 181     nodes = []
 182     def make_entry(src, dist=None, mnt_type="none", options="rbind,create=file 0 0"):
 183         if any(x in src for x in ["\n", "\r"]):
 184             logging.warning("User-provided mount path contains illegal character: " + src)
 185             return False
 186         if dist is None and (not os.path.exists(src) or
 187                              str(os.stat(src).st_uid) != session["user_id"]):
 188             logging.warning("User-provided mount path is not owned by user: " + src)
 189             return False
 190         return add_node_entry(nodes, src, dist, mnt_type, options, check=False)
 191
 192     # Make sure XDG_RUNTIME_DIR exists
 193     if not make_entry("tmpfs", tools.config.defaults["container_xdg_runtime_dir"], options="create=dir 0 0"):
 194         raise OSError("Failed to create XDG_RUNTIME_DIR mount point")
 195
 196     wayland_host_socket = os.path.realpath(os.path.join(session["xdg_runtime_dir"], session["wayland_display"]))
 197     wayland_container_socket = os.path.realpath(os.path.join(tools.config.defaults["container_xdg_runtime_dir"], tools.config.defaults["container_wayland_display"]))
 198     if not make_entry(wayland_host_socket, wayland_container_socket[1:]):
 199         raise OSError("Failed to bind Wayland socket")
 200
 201     # Make sure PULSE_RUNTIME_DIR exists
 202     pulse_host_socket = os.path.join(session["pulse_runtime_path"], "native")
 203     pulse_container_socket = os.path.join(tools.config.defaults["container_pulse_runtime_path"], "native")
 204     make_entry(pulse_host_socket, pulse_container_socket[1:])
 205
 206     if not make_entry(session["waydroid_data"], "data", options="rbind 0 0"):
 207         raise OSError("Failed to bind userdata")
 208
 209     lxc_path = tools.config.defaults["lxc"] + "/waydroid"
 210     config_nodes_tmp_path = args.work + "/config_session"
 211     config_nodes = open(config_nodes_tmp_path, "w")
 212     for node in nodes:
 213         config_nodes.write(node + "\n")
 214     config_nodes.close()
 215     command = ["mv", config_nodes_tmp_path, lxc_path]
 216     tools.helpers.run.user(args, command)
 217
 218 def make_base_props(args):
 219     def find_hal(hardware):
 220         hardware_props = [
 221             "ro.hardware." + hardware,
 222             "ro.hardware",
 223             "ro.product.board",
 224             "ro.arch",
 225             "ro.board.platform"]
 226         for p in hardware_props:
 227             prop = tools.helpers.props.host_get(args, p)
 228             if prop != "":
 229                 for lib in ["/odm/lib", "/odm/lib64", "/vendor/lib", "/vendor/lib64", "/system/lib", "/system/lib64"]:
 230                     hal_file = lib + "/hw/" + hardware + "." + prop + ".so"
 231                     if os.path.isfile(hal_file):
 232                         return prop
 233         return ""
 234
 235     def find_hidl(intf):
 236         if args.vendor_type == "MAINLINE":
 237             return False
 238
 239         try:
 240             sm = gbinder.ServiceManager("/dev/hwbinder")
 241             return intf in sm.list_sync()
 242         except:
 243             return False
 244
 245     props = []
 246
 247     if not os.path.exists("/dev/ashmem"):
 248         props.append("sys.use_memfd=true")
 249
 250     # Added for security reasons
 251     props.append("ro.adb.secure=1")
 252     props.append("ro.debuggable=0")
 253
 254     egl = tools.helpers.props.host_get(args, "ro.hardware.egl")
 255     dri, _ = tools.helpers.gpu.getDriNode(args)
 256
 257     gralloc = find_hal("gralloc")
 258     if not gralloc:
 259         if find_hidl("android.hardware.graphics.allocator@4.0::IAllocator/default"):
 260             gralloc = "android"
 261     if not gralloc:
 262         if dri:
 263             gralloc = "gbm"
 264             egl = "mesa"
 265             props.append("gralloc.gbm.device=" + dri)
 266         else:
 267             gralloc = "default"
 268             egl = "swiftshader"
 269         props.append("debug.stagefright.ccodec=0")
 270     props.append("ro.hardware.gralloc=" + gralloc)
 271
 272     if egl != "":
 273         props.append("ro.hardware.egl=" + egl)
 274
 275     media_profiles = tools.helpers.props.host_get(args, "media.settings.xml")
 276     if media_profiles != "":
 277         media_profiles = media_profiles.replace("vendor/", "vendor_extra/")
 278         media_profiles = media_profiles.replace("odm/", "odm_extra/")
 279         props.append("media.settings.xml=" + media_profiles)
 280
 281     ccodec = tools.helpers.props.host_get(args, "debug.stagefright.ccodec")
 282     if ccodec != "":
 283         props.append("debug.stagefright.ccodec=" + ccodec)
 284
 285     ext_library = tools.helpers.props.host_get(args, "ro.vendor.extension_library")
 286     if ext_library != "":
 287         ext_library = ext_library.replace("vendor/", "vendor_extra/")
 288         ext_library = ext_library.replace("odm/", "odm_extra/")
 289         props.append("ro.vendor.extension_library=" + ext_library)
 290
 291     vulkan = find_hal("vulkan")
 292     if not vulkan and dri:
 293         vulkan = tools.helpers.gpu.getVulkanDriver(args, os.path.basename(dri))
 294     if vulkan:
 295         props.append("ro.hardware.vulkan=" + vulkan)
 296
 297     treble = tools.helpers.props.host_get(args, "ro.treble.enabled")
 298     if treble != "true":
 299         camera = find_hal("camera")
 300         if camera != "":
 301             props.append("ro.hardware.camera=" + camera)
 302         else:
 303             if args.vendor_type == "MAINLINE":
 304                 props.append("ro.hardware.camera=v4l2")
 305
 306     opengles = tools.helpers.props.host_get(args, "ro.opengles.version")
 307     if opengles == "":
 308         opengles = "196610"
 309     props.append("ro.opengles.version=" + opengles)
 310
 311     if args.images_path not in tools.config.defaults["preinstalled_images_paths"]:
 312         props.append("waydroid.system_ota=" + args.system_ota)
 313         props.append("waydroid.vendor_ota=" + args.vendor_ota)
 314     else:
 315         props.append("waydroid.updater.disabled=true")
 316
 317     props.append("waydroid.tools_version=" + tools.config.version)
 318
 319     if args.vendor_type == "MAINLINE":
 320         props.append("ro.vndk.lite=true")
 321
 322     for product in ["brand", "device", "manufacturer", "model", "name"]:
 323         prop_product = tools.helpers.props.host_get(
 324             args, "ro.product.vendor." + product)
 325         if prop_product != "":
 326             props.append("ro.product.waydroid." + product + "=" + prop_product)
 327         else:
 328             if os.path.isfile("/proc/device-tree/" + product):
 329                 with open("/proc/device-tree/" + product) as f:
 330                     f_value = f.read().strip().rstrip('\x00')
 331                     if f_value != "":
 332                         props.append("ro.product.waydroid." +
 333                                      product + "=" + f_value)
 334
 335     prop_fp = tools.helpers.props.host_get(args, "ro.vendor.build.fingerprint")
 336     if prop_fp != "":
 337         props.append("ro.build.fingerprint=" + prop_fp)
 338
 339     # now append/override with values in [properties] section of waydroid.cfg
 340     cfg = tools.config.load(args)
 341     for k, v in cfg["properties"].items():
 342         for idx, elem in enumerate(props):
 343             if (k+"=") in elem:
 344                 props.pop(idx)
 345         props.append(k+"="+v)
 346
 347     base_props = open(args.work + "/waydroid_base.prop", "w")
 348     for prop in props:
 349         base_props.write(prop + "\n")
 350     base_props.close()
 351
 352
 353 def setup_host_perms(args):
 354     if not os.path.exists(tools.config.defaults["host_perms"]):
 355         os.mkdir(tools.config.defaults["host_perms"])
 356
 357     treble = tools.helpers.props.host_get(args, "ro.treble.enabled")
 358     if treble != "true":
 359         return
 360
 361     sku = tools.helpers.props.host_get(args, "ro.boot.product.hardware.sku")
 362     copy_list = []
 363     copy_list.extend(
 364         glob.glob("/vendor/etc/permissions/android.hardware.nfc.*"))
 365     if os.path.exists("/vendor/etc/permissions/android.hardware.consumerir.xml"):
 366         copy_list.append("/vendor/etc/permissions/android.hardware.consumerir.xml")
 367     copy_list.extend(
 368         glob.glob("/odm/etc/permissions/android.hardware.nfc.*"))
 369     if os.path.exists("/odm/etc/permissions/android.hardware.consumerir.xml"):
 370         copy_list.append("/odm/etc/permissions/android.hardware.consumerir.xml")
 371     if sku != "":
 372         copy_list.extend(
 373             glob.glob("/odm/etc/permissions/sku_{}/android.hardware.nfc.*".format(sku)))
 374         if os.path.exists("/odm/etc/permissions/sku_{}/android.hardware.consumerir.xml".format(sku)):
 375             copy_list.append(
 376                 "/odm/etc/permissions/sku_{}/android.hardware.consumerir.xml".format(sku))
 377
 378     for filename in copy_list:
 379         shutil.copy(filename, tools.config.defaults["host_perms"])
 380
 381 def status(args):
 382     command = ["lxc-info", "-P", tools.config.defaults["lxc"], "-n", "waydroid", "-sH"]
 383     try:
 384         return tools.helpers.run.user(args, command, output_return=True).strip()
 385     except:
 386         logging.info("Couldn't get LXC status. Assuming STOPPED.")
 387         return "STOPPED"
 388
 389 def wait_for_running(args):
 390     lxc_status = status(args)
 391     timeout = 10
 392     while lxc_status != "RUNNING" and timeout > 0:
 393         lxc_status = status(args)
 394         logging.info(
 395             "waiting {} seconds for container to start...".format(timeout))
 396         timeout = timeout - 1
 397         time.sleep(1)
 398     if lxc_status != "RUNNING":
 399         raise OSError("container failed to start")
 400
 401 def start(args):
 402     command = ["lxc-start", "-P", tools.config.defaults["lxc"],
 403                "-F", "-n", "waydroid", "--", "/init"]
 404     tools.helpers.run.user(args, command, output="background")
 405     wait_for_running(args)
 406     # Workaround lxc-start changing stdout/stderr permissions to 700
 407     os.chmod(args.log, 0o666)
 408
 409 def stop(args):
 410     command = ["lxc-stop", "-P",
 411                tools.config.defaults["lxc"], "-n", "waydroid", "-k"]
 412     tools.helpers.run.user(args, command)
 413
 414 def freeze(args):
 415     command = ["lxc-freeze", "-P", tools.config.defaults["lxc"], "-n", "waydroid"]
 416     tools.helpers.run.user(args, command)
 417
 418 def unfreeze(args):
 419     command = ["lxc-unfreeze", "-P",
 420                tools.config.defaults["lxc"], "-n", "waydroid"]
 421     tools.helpers.run.user(args, command)
 422
 423 ANDROID_ENV = {
 424     "PATH": "/product/bin:/apex/com.android.runtime/bin:/apex/com.android.art/bin:/system_ext/bin:/system/bin:/system/xbin:/odm/bin:/vendor/bin:/vendor/xbin",
 425     "ANDROID_ROOT": "/system",
 426     "ANDROID_DATA": "/data",
 427     "ANDROID_STORAGE": "/storage",
 428     "ANDROID_ART_ROOT": "/apex/com.android.art",
 429     "ANDROID_I18N_ROOT": "/apex/com.android.i18n",
 430     "ANDROID_TZDATA_ROOT": "/apex/com.android.tzdata",
 431     "ANDROID_RUNTIME_ROOT": "/apex/com.android.runtime",
 432     "BOOTCLASSPATH": "/apex/com.android.art/javalib/core-oj.jar:/apex/com.android.art/javalib/core-libart.jar:/apex/com.android.art/javalib/core-icu4j.jar:/apex/com.android.art/javalib/okhttp.jar:/apex/com.android.art/javalib/bouncycastle.jar:/apex/com.android.art/javalib/apache-xml.jar:/system/framework/framework.jar:/system/framework/ext.jar:/system/framework/telephony-common.jar:/system/framework/voip-common.jar:/system/framework/ims-common.jar:/system/framework/framework-atb-backward-compatibility.jar:/apex/com.android.conscrypt/javalib/conscrypt.jar:/apex/com.android.media/javalib/updatable-media.jar:/apex/com.android.mediaprovider/javalib/framework-mediaprovider.jar:/apex/com.android.os.statsd/javalib/framework-statsd.jar:/apex/com.android.permission/javalib/framework-permission.jar:/apex/com.android.sdkext/javalib/framework-sdkextensions.jar:/apex/com.android.wifi/javalib/framework-wifi.jar:/apex/com.android.tethering/javalib/framework-tethering.jar"
 433 }
 434
 435 def android_env_attach_options(args):
 436     local_env = ANDROID_ENV.copy()
 437     # Include CLASSPATH env that was generated by Android
 438     command = ["lxc-attach", "-P", tools.config.defaults["lxc"],
 439                "-n", "waydroid", "--clear-env", "--",
 440                "/system/bin/cat" ,"/data/system/environ/classpath"]
 441     allowed = ["CLASSPATH", "SYSTEMSERVER"]
 442     try:
 443         p = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL)
 444         out, _ = p.communicate()
 445         if p.returncode == 0:
 446             for line in out.decode().splitlines():
 447                 _, k, v = line.split(' ', 2)
 448                 if any(pattern in k for pattern in allowed):
 449                     local_env[k] = v
 450     except:
 451         pass
 452     env = [k + "=" + v for k, v in local_env.items()]
 453     return [x for var in env for x in ("--set-var", var)]
 454
 455 def shell(args):
 456     state = status(args)
 457     if state == "FROZEN":
 458         unfreeze(args)
 459     elif state != "RUNNING":
 460         logging.error("WayDroid container is {}".format(state))
 461         return
 462     command = ["lxc-attach", "-P", tools.config.defaults["lxc"],
 463                "-n", "waydroid", "--clear-env"]
 464     command.extend(android_env_attach_options(args))
 465     if args.uid!=None:
 466         command.append("--uid="+str(args.uid))
 467     if args.gid!=None:
 468         command.append("--gid="+str(args.gid))
 469     elif args.uid!=None:
 470         command.append("--gid="+str(args.uid))
 471     if args.nolsm or args.allcaps or args.nocgroup:
 472         elevatedprivs = "--elevated-privileges="
 473         addpipe = False
 474         if args.nolsm:
 475             if addpipe:
 476                 elevatedprivs+="|"
 477             elevatedprivs+="LSM"
 478             addpipe = True
 479         if args.allcaps:
 480             if addpipe:
 481                 elevatedprivs+="|"
 482             elevatedprivs+="CAP"
 483             addpipe = True
 484         if args.nocgroup:
 485             if addpipe:
 486                 elevatedprivs+="|"
 487             elevatedprivs+="CGROUP"
 488             addpipe = True
 489         command.append(elevatedprivs)
 490     if args.context!=None and not args.nolsm:
 491         command.append("--context="+args.context)
 492     command.append("--")
 493     if args.COMMAND:
 494         command.extend(args.COMMAND)
 495     else:
 496         command.append("/system/bin/sh")
 497
 498     try:
 499         subprocess.run(command)
 500     except KeyboardInterrupt:
 501         pass
 502
 503     if state == "FROZEN":
 504         freeze(args)
 505
 506 def logcat(args):
 507     args.COMMAND = ["/system/bin/logcat"]
 508     args.uid = None
 509     args.gid = None
 510     args.nolsm = None
 511     args.allcaps = None
 512     args.nocgroup = None
 513     args.context = None
 514     shell(args)