, linux
, , . , . , . ?
. , , ! , - linux, android, . linux, - , , , . , . . android?
,
[1]. . , . , - ,
. , , .
. , , , , Android view . , . , linux?
, , android accessibility service . Android. . ! , . , .
, . , , .
, . , . , ? android
:
mPointerLocationView ,
, ,
registerPointerEventListener WindowManagerService.
WindowManager . ,
WindowManager, , , . : Android
Binder IPC, WindowManager ,
AIDL . , AIDL , . , , , android ,
. . , , . .
, , , , . , Android linux, , linux . , , userspace ,
/dev/input/, . , : , , , . , : Android root, , input. Android , .
.
.
. , , . root, , . linux.
CVE-20165195 akaDirtyCOW
.
11 , . 2016 , , . 11- 0-day. , , 2.6.22! android. android
2016, , , . Nexus 5, , , android .
dirtyCOW? , , . , ( android /system, ). , , . . : read-only , : , , .
, , , , . , , , ! , android , , .
, . , , UID=0 (root) input ( android GID=1004).
, ,
/system/bin/ping. android-, . , SUID-. SUID (
Set owner
User
ID up on execution UID ) Linux. , . SUID , UID GID. , ping root, root. , ? ping dirtyCOW , root ! , , , , .
SELinux
, android 4.2. , 5.0 . SELinux (Security-Enhanced Linux) , . , . , , , , , . , . , , .
untrusted_app. , .
/system/bin/ping system_file, , SELinux system_file untrusted_app. ping android 5.0+ , SUID-.
, SELinux , , ping u:object_r:system_file:s0, u:r:untrusted_app:s0. , .
, SUID-, . - , root? android , . , - . , .
, init.rc
, android , . , root. android 6.0.1 vold, healthd, debuggerd, installd, zygote . ,
/system/bin/app_process, zygote, !
zygote,
.
/system/bin/app_process payload zygote, android app_process root.
, zygote. , -. ,
/system/bin/app_process payload- zygote . , . , app_process , .
mmap
Linux . : , , , . .
, , , . , linux . memory-mapped file, , . , , . , . (, dirtyCOW, ).
, . , . . , . , , . , , - select(), read() waitpid(). . , , linux .
, ( ) . , . , ( samsung, , zygote . , ).
zygote. , - ? Zygote , android-. clash of clans, zygote fork(), . . zygote, android- . . ? , .
-, android- , zygote? linux , init. , zygote , . android-, -, . , . , . zygote android-.
, . . app_process , payload, ? . payload app_process?
, ! setsid(). . , \. daemon() fork() setsid(), -, , .
C daemon() . . zygote, app_process payload, , app_process .
: payload, , app_process. ? , . . ?
Execve()
execve()
, , .
man.
, linux fork()+execve().
, payload. daemon() execve() , exec_payload. app_process , exec_payload .
, root. , , , root . . SELinux? , - .
SELinux[2]
, exec_payload SELinux . zygote zygote. Exec_payload .
/dev/input : input_device. , , SELinux zygote input_device. , SELinux?
. , . , zygote android-? , zygote untrusted_app ( platform_app , isolated_app ), , zygote selinux-. , . : shell.
Shell ( ), , android-
ADB (Android debug bridge). , root init kernel, , android-. , shell . zygote shell input, exec_payload - .
shell zygote#ifdef __aarch64__
void * selinux = dlopen("/system/lib64/libselinux.so", RTLD_LAZY);
#else
void* selinux = dlopen("/system/lib/libselinux.so", RTLD_LAZY);
#endif
if (selinux)
{
void* getcon = dlsym(selinux, "getcon");
const char* error = dlerror();
if (!error)
{
getcon_t* getcon_p = (getcon_t*) getcon;
char* secontext;
int ret = (*getcon_p)(&secontext);
void* setcon = dlsym(selinux, "setcon");
const char* error = dlerror();
if (!error)
{
setcon_t* setcon_p = (setcon_t*) setcon;
if ((*setcon_p)("u:r:shell:s0") != 0)
{
LOGV("Unable to set context: %s!", strerror(errno));
}
(*getcon_p)(&secontext);
LOGV("Current context: %s", secontext);
}
}
dlclose(selinux);
}
else
{
LOGV("SELinux not found.");
}
, , . ( ) ,
/dev/input/event[X]? . , (UNIX socket, FIFO) ( SELinux!). SD- . , . , intent am ( , Activity Manager). , , .
. , Android. - . zygote app_process. , SELinux zygote shell payload. , .
, , , 100% . , . exec_payload adb
/data/local/tmp ( shell ), , . , UID (2000 0), . - ( ) , .
DirtyCOW Android
, ( ) , . , , , DirtyCOW, . , root, . , . : ( - ). : am pm. . Am activity, . , . , dirtyCOW, , , , .
: . mediaserver, netd, debuggerd , .
, , . , , , - - .
. Android libcutils.so. . ELF ,
.init .init_array. , , . ,
.init_array /system/lib/libcutils.so, .
__attribute__((constructor)) void say_hello()
{
payload_main();
}
constructor
.init_array .
? , Android , . , libcutils . , , , . , , . , , .
DT_SONAME -> DT_NEEDED
ELF , . . , ,
objdump -p:
:
[.....]
STRTAB 0x00001660
STRSZ 0x000014ec
GNU_HASH 0x00002b4c
NEEDED liblog.so
NEEDED libc++.so
NEEDED libdl.so
NEEDED libc.so
NEEDED libm.so
SONAME libcutils.so
FINI_ARRAY 0x0000fbf0
[.....]
libcutils.so. NEEDED , , libcutils. SONAME, . , , . ELF- ? - ? : ( libcutils, , , libc). , : libmtp.so. ( ), , USB MTP. 2 . . ELF , , DT_SONAME (0xE) DT_NEEDED (0x1), libmtp.so. ! libcutils.so :
:
[.....]
STRTAB 0x00001660
STRSZ 0x000014ec
GNU_HASH 0x00002b4c
NEEDED liblog.so
NEEDED libc++.so
NEEDED libdl.so
NEEDED libc.so
NEEDED libm.so
NEEDED libmtp.so
FINI_ARRAY 0x0000fbf0
[.....]
: libmtp.so , . , , zygote, android-, .
Android.Loki.28.origin, .
, Android , , . Android , SELinux, 4.3, 5.0. , , , , , . , , , , Android . , - .
https://habrahabr.ru/post/332916/
