X-Git-Url: https://glassweightruler.freedombox.rocks/gitweb/waydroid.git/blobdiff_plain/e7a236789d5fbf791bf0233c39ba242aff82e3c5..HEAD:/tools/helpers/lxc.py?ds=sidebyside diff --git a/tools/helpers/lxc.py b/tools/helpers/lxc.py index 68948aa..79eac73 100644 --- a/tools/helpers/lxc.py +++ b/tools/helpers/lxc.py @@ -2,7 +2,6 @@ # SPDX-License-Identifier: GPL-3.0-or-later import subprocess import os -import re import logging import glob import shutil @@ -12,7 +11,6 @@ import gbinder import tools.config import tools.helpers.run - def get_lxc_version(args): if shutil.which("lxc-info") is not None: command = ["lxc-info", "--version"] @@ -56,9 +54,8 @@ def generate_nodes_lxc_config(args): make_entry("/dev/pvr_sync") make_entry("/dev/pmsg0") make_entry("/dev/dxg") - render, card = tools.helpers.gpu.getDriNode(args) - make_entry(render, "dev/dri/renderD128") - make_entry(card, "dev/dri/card0") + render, _ = tools.helpers.gpu.getDriNode(args) + make_entry(render) for n in glob.glob("/dev/fb*"): make_entry(n) @@ -66,6 +63,8 @@ def generate_nodes_lxc_config(args): make_entry(n) for n in glob.glob("/dev/video*"): make_entry(n) + for n in glob.glob("/dev/dma_heap/*"): + make_entry(n) # Binder dev nodes make_entry("/dev/" + args.BINDER_DRIVER, "dev/binder", check=False) @@ -75,7 +74,7 @@ def generate_nodes_lxc_config(args): if args.vendor_type != "MAINLINE": if not make_entry("/dev/hwbinder", "dev/host_hwbinder"): raise OSError('Binder node "hwbinder" of host not found') - make_entry("/vendor", "vendor_extra", options="bind,optional 0 0") + make_entry("/vendor", "vendor_extra", options="rbind,optional 0 0") # Necessary device nodes for adb make_entry("none", "dev/pts", "devpts", "defaults,mode=644,ptmxmode=666,create=dir 0 0", False) @@ -191,15 +190,18 @@ def generate_session_lxc_config(args, session): return add_node_entry(nodes, src, dist, mnt_type, options, check=False) # Make sure XDG_RUNTIME_DIR exists - if not make_entry("tmpfs", session["xdg_runtime_dir"], options="create=dir 0 0"): + if not make_entry("tmpfs", tools.config.defaults["container_xdg_runtime_dir"], options="create=dir 0 0"): raise OSError("Failed to create XDG_RUNTIME_DIR mount point") - wayland_socket = os.path.realpath(os.path.join(session["xdg_runtime_dir"], session["wayland_display"])) - if not make_entry(wayland_socket): + wayland_host_socket = os.path.realpath(os.path.join(session["xdg_runtime_dir"], session["wayland_display"])) + wayland_container_socket = os.path.realpath(os.path.join(tools.config.defaults["container_xdg_runtime_dir"], tools.config.defaults["container_wayland_display"])) + if not make_entry(wayland_host_socket, wayland_container_socket[1:]): raise OSError("Failed to bind Wayland socket") - pulse_socket = os.path.join(session["pulse_runtime_path"], "native") - make_entry(pulse_socket) + # Make sure PULSE_RUNTIME_DIR exists + pulse_host_socket = os.path.join(session["pulse_runtime_path"], "native") + pulse_container_socket = os.path.join(tools.config.defaults["container_pulse_runtime_path"], "native") + make_entry(pulse_host_socket, pulse_container_socket[1:]) if not make_entry(session["waydroid_data"], "data", options="rbind 0 0"): raise OSError("Failed to bind userdata") @@ -245,6 +247,10 @@ def make_base_props(args): if not os.path.exists("/dev/ashmem"): props.append("sys.use_memfd=true") + # Added for security reasons + props.append("ro.adb.secure=1") + props.append("ro.debuggable=0") + egl = tools.helpers.props.host_get(args, "ro.hardware.egl") dri, _ = tools.helpers.gpu.getDriNode(args) @@ -256,6 +262,7 @@ def make_base_props(args): if dri: gralloc = "gbm" egl = "mesa" + props.append("gralloc.gbm.device=" + dri) else: gralloc = "default" egl = "swiftshader" @@ -298,7 +305,7 @@ def make_base_props(args): opengles = tools.helpers.props.host_get(args, "ro.opengles.version") if opengles == "": - opengles = "196609" + opengles = "196610" props.append("ro.opengles.version=" + opengles) if args.images_path not in tools.config.defaults["preinstalled_images_paths"]: @@ -425,8 +432,24 @@ ANDROID_ENV = { "BOOTCLASSPATH": "/apex/com.android.art/javalib/core-oj.jar:/apex/com.android.art/javalib/core-libart.jar:/apex/com.android.art/javalib/core-icu4j.jar:/apex/com.android.art/javalib/okhttp.jar:/apex/com.android.art/javalib/bouncycastle.jar:/apex/com.android.art/javalib/apache-xml.jar:/system/framework/framework.jar:/system/framework/ext.jar:/system/framework/telephony-common.jar:/system/framework/voip-common.jar:/system/framework/ims-common.jar:/system/framework/framework-atb-backward-compatibility.jar:/apex/com.android.conscrypt/javalib/conscrypt.jar:/apex/com.android.media/javalib/updatable-media.jar:/apex/com.android.mediaprovider/javalib/framework-mediaprovider.jar:/apex/com.android.os.statsd/javalib/framework-statsd.jar:/apex/com.android.permission/javalib/framework-permission.jar:/apex/com.android.sdkext/javalib/framework-sdkextensions.jar:/apex/com.android.wifi/javalib/framework-wifi.jar:/apex/com.android.tethering/javalib/framework-tethering.jar" } -def android_env_attach_options(): - env = [k + "=" + v for k, v in ANDROID_ENV.items()] +def android_env_attach_options(args): + local_env = ANDROID_ENV.copy() + # Include CLASSPATH env that was generated by Android + command = ["lxc-attach", "-P", tools.config.defaults["lxc"], + "-n", "waydroid", "--clear-env", "--", + "/system/bin/cat" ,"/data/system/environ/classpath"] + allowed = ["CLASSPATH", "SYSTEMSERVER"] + try: + p = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL) + out, _ = p.communicate() + if p.returncode == 0: + for line in out.decode().splitlines(): + _, k, v = line.split(' ', 2) + if any(pattern in k for pattern in allowed): + local_env[k] = v + except: + pass + env = [k + "=" + v for k, v in local_env.items()] return [x for var in env for x in ("--set-var", var)] def shell(args): @@ -438,16 +461,54 @@ def shell(args): return command = ["lxc-attach", "-P", tools.config.defaults["lxc"], "-n", "waydroid", "--clear-env"] - command.extend(android_env_attach_options()) + command.extend(android_env_attach_options(args)) + if args.uid!=None: + command.append("--uid="+str(args.uid)) + if args.gid!=None: + command.append("--gid="+str(args.gid)) + elif args.uid!=None: + command.append("--gid="+str(args.uid)) + if args.nolsm or args.allcaps or args.nocgroup: + elevatedprivs = "--elevated-privileges=" + addpipe = False + if args.nolsm: + if addpipe: + elevatedprivs+="|" + elevatedprivs+="LSM" + addpipe = True + if args.allcaps: + if addpipe: + elevatedprivs+="|" + elevatedprivs+="CAP" + addpipe = True + if args.nocgroup: + if addpipe: + elevatedprivs+="|" + elevatedprivs+="CGROUP" + addpipe = True + command.append(elevatedprivs) + if args.context!=None and not args.nolsm: + command.append("--context="+args.context) command.append("--") if args.COMMAND: command.extend(args.COMMAND) else: command.append("/system/bin/sh") - subprocess.run(command) + + try: + subprocess.run(command) + except KeyboardInterrupt: + pass + if state == "FROZEN": freeze(args) def logcat(args): args.COMMAND = ["/system/bin/logcat"] + args.uid = None + args.gid = None + args.nolsm = None + args.allcaps = None + args.nocgroup = None + args.context = None shell(args)