private/android_filesystem_config.h

   1 /*
   2  * Copyright (C) 2007 The Android Open Source Project
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at
   7  *
   8  *      http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16
  17 /* This file is used to define the properties of the filesystem
  18 ** images generated by build tools (mkbootfs and mkyaffs2image) and
  19 ** by the device side of adb.
  20 */
  21
  22 #ifndef _ANDROID_FILESYSTEM_CONFIG_H_
  23 #define _ANDROID_FILESYSTEM_CONFIG_H_
  24
  25 #include <string.h>
  26 #include <sys/stat.h>
  27 #include <sys/types.h>
  28
  29 /* This is the master Users and Groups config for the platform.
  30 ** DO NOT EVER RENUMBER.
  31 */
  32
  33 #define AID_ROOT             0  /* traditional unix root user */
  34
  35 #define AID_SYSTEM        1000  /* system server */
  36
  37 #define AID_RADIO         1001  /* telephony subsystem, RIL */
  38 #define AID_BLUETOOTH     1002  /* bluetooth subsystem */
  39 #define AID_GRAPHICS      1003  /* graphics devices */
  40 #define AID_INPUT         1004  /* input devices */
  41 #define AID_AUDIO         1005  /* audio devices */
  42 #define AID_CAMERA        1006  /* camera devices */
  43 #define AID_LOG           1007  /* log devices */
  44 #define AID_COMPASS       1008  /* compass device */
  45 #define AID_MOUNT         1009  /* mountd socket */
  46 #define AID_WIFI          1010  /* wifi subsystem */
  47 #define AID_ADB           1011  /* android debug bridge (adbd) */
  48 #define AID_INSTALL       1012  /* group for installing packages */
  49 #define AID_MEDIA         1013  /* mediaserver process */
  50 #define AID_DHCP          1014  /* dhcp client */
  51 #define AID_SDCARD_RW     1015  /* external storage write access */
  52 #define AID_VPN           1016  /* vpn system */
  53 #define AID_KEYSTORE      1017  /* keystore subsystem */
  54 #define AID_USB           1018  /* USB devices */
  55 #define AID_DRM           1019  /* DRM server */
  56 #define AID_MDNSR         1020  /* MulticastDNSResponder (service discovery) */
  57 #define AID_GPS           1021  /* GPS daemon */
  58 #define AID_UNUSED1       1022  /* deprecated, DO NOT USE */
  59 #define AID_MEDIA_RW      1023  /* internal media storage write access */
  60 #define AID_MTP           1024  /* MTP USB driver access */
  61 #define AID_UNUSED2       1025  /* deprecated, DO NOT USE */
  62 #define AID_DRMRPC        1026  /* group for drm rpc */
  63 #define AID_NFC           1027  /* nfc subsystem */
  64 #define AID_SDCARD_R      1028  /* external storage read access */
  65
  66 #define AID_SHELL         2000  /* adb and debug shell user */
  67 #define AID_CACHE         2001  /* cache access */
  68 #define AID_DIAG          2002  /* access to diagnostic resources */
  69
  70 /* The 3000 series are intended for use as supplemental group id's only.
  71  * They indicate special Android capabilities that the kernel is aware of. */
  72 #define AID_NET_BT_ADMIN  3001  /* bluetooth: create any socket */
  73 #define AID_NET_BT        3002  /* bluetooth: create sco, rfcomm or l2cap sockets */
  74 #define AID_INET          3003  /* can create AF_INET and AF_INET6 sockets */
  75 #define AID_NET_RAW       3004  /* can create raw INET sockets */
  76 #define AID_NET_ADMIN     3005  /* can configure interfaces and routing tables. */
  77 #define AID_NET_BW_STATS  3006  /* read bandwidth statistics */
  78 #define AID_NET_BW_ACCT   3007  /* change bandwidth statistics accounting */
  79 #define AID_NET_BT_STACK  3008  /* bluetooth: access config files */
  80 #define AID_QCOM_ONCRPC   3009  /* can read/write /dev/oncrpc files */
  81 #define AID_QCOM_DIAG     3010  /* can read/write /dev/diag */
  82
  83 #if defined(MOTOROLA_UIDS)
  84 #define AID_MOT_OSH       5000  /* OSH */
  85 #define AID_MOT_ACCY      9000  /* access to accessory */
  86 #define AID_MOT_PWRIC     9001  /* power IC */
  87 #define AID_MOT_USB       9002  /* mot usb */
  88 #define AID_MOT_DRM       9003  /* can access DRM resource. */
  89 #define AID_MOT_TCMD      9004  /* mot_tcmd */
  90 #define AID_MOT_SEC_RTC   9005  /* mot cpcap rtc */
  91 #define AID_MOT_TOMBSTONE 9006
  92 #define AID_MOT_TPAPI     9007  /* mot_tpapi */
  93 #define AID_MOT_SECCLKD   9008  /* mot_secclkd */
  94 #define AID_MOT_WHISPER   9009  /* Whisper Protocol access */
  95 #define AID_MOT_CAIF      9010  /* can create CAIF sockets */
  96 #define AID_MOT_DLNA      9011  /* DLNA native */
  97 #endif // MOTOROLA_UIDS
  98
  99 #define AID_MISC          9998  /* access to misc storage */
 100 #define AID_NOBODY        9999
 101
 102 #define AID_APP          10000  /* first app user */
 103
 104 #define AID_ISOLATED_START 99000 /* start of uids for fully isolated sandboxed processes */
 105 #define AID_ISOLATED_END   99999 /* end of uids for fully isolated sandboxed processes */
 106
 107 #define AID_USER        100000  /* offset for uid ranges for each user */
 108
 109 #define AID_SHARED_GID_START 50000 /* start of gids for apps in each user to share */
 110 #define AID_SHARED_GID_END   59999 /* start of gids for apps in each user to share */
 111
 112 #if !defined(EXCLUDE_FS_CONFIG_STRUCTURES)
 113 struct android_id_info {
 114     const char *name;
 115     unsigned aid;
 116 };
 117
 118 static const struct android_id_info android_ids[] = {
 119     { "root",      AID_ROOT, },
 120     { "system",    AID_SYSTEM, },
 121     { "radio",     AID_RADIO, },
 122     { "bluetooth", AID_BLUETOOTH, },
 123     { "graphics",  AID_GRAPHICS, },
 124     { "input",     AID_INPUT, },
 125     { "audio",     AID_AUDIO, },
 126     { "camera",    AID_CAMERA, },
 127     { "log",       AID_LOG, },
 128     { "compass",   AID_COMPASS, },
 129     { "mount",     AID_MOUNT, },
 130     { "wifi",      AID_WIFI, },
 131     { "dhcp",      AID_DHCP, },
 132     { "adb",       AID_ADB, },
 133     { "install",   AID_INSTALL, },
 134     { "media",     AID_MEDIA, },
 135     { "drm",       AID_DRM, },
 136     { "mdnsr",     AID_MDNSR, },
 137     { "nfc",       AID_NFC, },
 138     { "drmrpc",    AID_DRMRPC, },
 139     { "shell",     AID_SHELL, },
 140     { "cache",     AID_CACHE, },
 141     { "diag",      AID_DIAG, },
 142     { "net_bt_admin", AID_NET_BT_ADMIN, },
 143     { "net_bt",    AID_NET_BT, },
 144     { "net_bt_stack",    AID_NET_BT_STACK, },
 145     { "sdcard_r",  AID_SDCARD_R, },
 146     { "sdcard_rw", AID_SDCARD_RW, },
 147     { "media_rw",  AID_MEDIA_RW, },
 148     { "vpn",       AID_VPN, },
 149     { "keystore",  AID_KEYSTORE, },
 150     { "usb",       AID_USB, },
 151     { "mtp",       AID_MTP, },
 152     { "gps",       AID_GPS, },
 153     { "inet",      AID_INET, },
 154     { "net_raw",   AID_NET_RAW, },
 155     { "net_admin", AID_NET_ADMIN, },
 156     { "net_bw_stats", AID_NET_BW_STATS, },
 157     { "net_bw_acct", AID_NET_BW_ACCT, },
 158     { "qcom_oncrpc", AID_QCOM_ONCRPC, },
 159     { "qcom_diag", AID_QCOM_DIAG, },
 160 #if defined(MOTOROLA_UIDS)
 161     { "mot_osh",   AID_MOT_OSH, },
 162     { "mot_accy",  AID_MOT_ACCY, },
 163     { "mot_pwric", AID_MOT_PWRIC, },
 164     { "mot_usb",   AID_MOT_USB, },
 165     { "mot_drm",   AID_MOT_DRM, },
 166     { "mot_tcmd",  AID_MOT_TCMD, },
 167     { "mot_sec_rtc",   AID_MOT_SEC_RTC, },
 168     { "mot_tombstone", AID_MOT_TOMBSTONE, },
 169     { "mot_tpapi",     AID_MOT_TPAPI, },
 170     { "mot_secclkd",   AID_MOT_SECCLKD, },
 171     { "mot_whisper",   AID_MOT_WHISPER, },
 172     { "mot_caif",  AID_MOT_CAIF, },
 173     { "mot_dlna",  AID_MOT_DLNA, },
 174 #endif
 175     { "misc",      AID_MISC, },
 176     { "nobody",    AID_NOBODY, },
 177 };
 178
 179 #define android_id_count \
 180     (sizeof(android_ids) / sizeof(android_ids[0]))
 181
 182 struct fs_path_config {
 183     unsigned mode;
 184     unsigned uid;
 185     unsigned gid;
 186     const char *prefix;
 187 };
 188
 189 /* Rules for directories.
 190 ** These rules are applied based on "first match", so they
 191 ** should start with the most specific path and work their
 192 ** way up to the root.
 193 */
 194
 195 static struct fs_path_config android_dirs[] = {
 196     { 00770, AID_SYSTEM, AID_CACHE,  "cache" },
 197     { 00771, AID_SYSTEM, AID_SYSTEM, "data/app" },
 198     { 00771, AID_SYSTEM, AID_SYSTEM, "data/app-private" },
 199     { 00771, AID_SYSTEM, AID_SYSTEM, "data/dalvik-cache" },
 200     { 00771, AID_SYSTEM, AID_SYSTEM, "data/data" },
 201     { 00771, AID_SHELL,  AID_SHELL,  "data/local/tmp" },
 202     { 00771, AID_SHELL,  AID_SHELL,  "data/local" },
 203     { 01771, AID_SYSTEM, AID_MISC,   "data/misc" },
 204     { 00770, AID_DHCP,   AID_DHCP,   "data/misc/dhcp" },
 205     { 00775, AID_MEDIA_RW, AID_MEDIA_RW, "data/media" },
 206     { 00775, AID_MEDIA_RW, AID_MEDIA_RW, "data/media/Music" },
 207     { 00771, AID_SYSTEM, AID_SYSTEM, "data" },
 208     { 00750, AID_ROOT,   AID_SHELL,  "sbin" },
 209     { 00755, AID_ROOT,   AID_ROOT,   "system/addon.d" },
 210     { 00755, AID_ROOT,   AID_SHELL,  "system/bin" },
 211     { 00755, AID_ROOT,   AID_SHELL,  "system/vendor" },
 212     { 00755, AID_ROOT,   AID_SHELL,  "system/xbin" },
 213     { 00755, AID_ROOT,   AID_ROOT,   "system/etc/ppp" },
 214     { 00777, AID_ROOT,   AID_ROOT,   "sdcard" },
 215     { 00755, AID_ROOT,   AID_ROOT,   0 },
 216 };
 217
 218 /* Rules for files.
 219 ** These rules are applied based on "first match", so they
 220 ** should start with the most specific path and work their
 221 ** way up to the root. Prefixes ending in * denotes wildcard
 222 ** and will allow partial matches.
 223 */
 224 static struct fs_path_config android_files[] = {
 225     { 00440, AID_ROOT,      AID_SHELL,     "system/etc/init.goldfish.rc" },
 226     { 00550, AID_ROOT,      AID_SHELL,     "system/etc/init.goldfish.sh" },
 227     { 00440, AID_ROOT,      AID_SHELL,     "system/etc/init.trout.rc" },
 228     { 00550, AID_ROOT,      AID_SHELL,     "system/etc/init.ril" },
 229     { 00550, AID_ROOT,      AID_SHELL,     "system/etc/init.testmenu" },
 230     { 00550, AID_DHCP,      AID_SHELL,     "system/etc/dhcpcd/dhcpcd-run-hooks" },
 231     { 00440, AID_BLUETOOTH, AID_BLUETOOTH, "system/etc/dbus.conf" },
 232     { 00444, AID_RADIO,     AID_AUDIO,     "system/etc/AudioPara4.csv" },
 233     { 00555, AID_ROOT,      AID_ROOT,      "system/etc/ppp/*" },
 234     { 00555, AID_ROOT,      AID_ROOT,      "system/etc/rc.*" },
 235     { 00755, AID_ROOT,      AID_ROOT,      "system/addon.d/*" },
 236     { 00644, AID_SYSTEM,    AID_SYSTEM,    "data/app/*" },
 237     { 00644, AID_MEDIA_RW,  AID_MEDIA_RW,  "data/media/*" },
 238     { 00644, AID_SYSTEM,    AID_SYSTEM,    "data/app-private/*" },
 239     { 00644, AID_APP,       AID_APP,       "data/data/*" },
 240         /* the following two files are INTENTIONALLY set-gid and not set-uid.
 241          * Do not change. */
 242     { 02755, AID_ROOT,      AID_NET_RAW,   "system/bin/ping" },
 243     { 02750, AID_ROOT,      AID_INET,      "system/bin/netcfg" },
 244         /* the following five files are INTENTIONALLY set-uid, but they
 245          * are NOT included on user builds. */
 246     { 06755, AID_ROOT,      AID_ROOT,      "system/xbin/su" },
 247     { 06755, AID_ROOT,      AID_ROOT,      "system/xbin/librank" },
 248     { 06755, AID_ROOT,      AID_ROOT,      "system/xbin/procrank" },
 249     { 06755, AID_ROOT,      AID_ROOT,      "system/xbin/procmem" },
 250     { 06755, AID_ROOT,      AID_ROOT,      "system/xbin/tcpdump" },
 251     { 04770, AID_ROOT,      AID_RADIO,     "system/bin/pppd-ril" },
 252                 /* the following file is INTENTIONALLY set-uid, and IS included
 253                  * in user builds. */
 254     { 06750, AID_ROOT,      AID_SHELL,     "system/bin/run-as" },
 255     { 06750, AID_ROOT,      AID_SYSTEM,    "system/bin/rebootcmd" },
 256     { 00755, AID_ROOT,      AID_SHELL,     "system/bin/*" },
 257     { 00755, AID_ROOT,      AID_ROOT,      "system/lib/valgrind/*" },
 258     { 00755, AID_ROOT,      AID_SHELL,     "system/xbin/*" },
 259     { 00755, AID_ROOT,      AID_SHELL,     "system/vendor/bin/*" },
 260     { 00750, AID_ROOT,      AID_SHELL,     "sbin/*" },
 261     { 00755, AID_ROOT,      AID_ROOT,      "bin/*" },
 262     { 00750, AID_ROOT,      AID_SHELL,     "init*" },
 263     { 00750, AID_ROOT,      AID_SHELL,     "charger*" },
 264     { 00750, AID_ROOT,      AID_SHELL,     "sbin/fs_mgr" },
 265     { 00640, AID_ROOT,      AID_SHELL,     "fstab.*" },
 266     { 00755, AID_ROOT,      AID_SHELL,     "system/etc/init.d/*" },
 267     { 00644, AID_ROOT,      AID_ROOT,       0 },
 268 };
 269
 270 static inline void fs_config(const char *path, int dir,
 271                              unsigned *uid, unsigned *gid, unsigned *mode)
 272 {
 273     struct fs_path_config *pc;
 274     int plen;
 275
 276     pc = dir ? android_dirs : android_files;
 277     plen = strlen(path);
 278     for(; pc->prefix; pc++){
 279         int len = strlen(pc->prefix);
 280         if (dir) {
 281             if(plen < len) continue;
 282             if(!strncmp(pc->prefix, path, len)) break;
 283             continue;
 284         }
 285         /* If name ends in * then allow partial matches. */
 286         if (pc->prefix[len -1] == '*') {
 287             if(!strncmp(pc->prefix, path, len - 1)) break;
 288         } else if (plen == len){
 289             if(!strncmp(pc->prefix, path, len)) break;
 290         }
 291     }
 292     *uid = pc->uid;
 293     *gid = pc->gid;
 294     *mode = (*mode & (~07777)) | pc->mode;
 295
 296 #if 0
 297     fprintf(stderr,"< '%s' '%s' %d %d %o >\n",
 298             path, pc->prefix ? pc->prefix : "", *uid, *gid, *mode);
 299 #endif
 300 }
 301 #endif
 302 #endif