[QCM6125][Android13] user版本默认允许root
文章目录
-
- 开发平台基本信息
- 问题描述
- 解决方法
开发平台基本信息
芯片: QCM6125
版本: Android 13
kernel: msm-4.14
问题描述
智能硬件设备，客户应用往往都是有系统签名的高权限应用，甚至有时候要求有root跟su；而我们内部为了调试方便，一般非金融产品也都会选择user版本允许adb root跟apk root。
解决方法
--- a/QSSI.13/build/make/core/main.mk
+++ b/QSSI.13/build/make/core/main.mk
@@ -365,7 +365,7 @@ enable_target_debugging := true
tags_to_install :=
ifneq (,$(user_variant))
# Target is secure in user builds.
- ADDITIONAL_SYSTEM_PROPERTIES += ro.secure=1
+ ADDITIONAL_SYSTEM_PROPERTIES += ro.secure=0
ADDITIONAL_SYSTEM_PROPERTIES += security.perf_harden=1
ifeq ($(user_variant),user)
@@ -377,7 +377,7 @@ ifneq (,$(user_variant))
tags_to_install += debug
else
# Disable debugging in plain user builds.
- enable_target_debugging :=
+ # enable_target_debugging :=
endif
# Disallow mock locations by default for user builds
@@ -399,7 +399,7 @@ ifeq (true,$(strip $(enable_target_debugging)))
ADDITIONAL_SYSTEM_PROPERTIES += dalvik.vm.lockprof.threshold=500
else # !enable_target_debugging
# Target is less debuggable and adbd is off by default
- ADDITIONAL_SYSTEM_PROPERTIES += ro.debuggable=0
+ ADDITIONAL_SYSTEM_PROPERTIES += ro.debuggable=1
endif # !enable_target_debugging
## eng ##
--- a/QSSI.13/device/qcom/qssi/base.mk
+++ b/QSSI.13/device/qcom/qssi/base.mk
@@ -845,10 +845,10 @@ ifneq ($(BOARD_AVB_ENABLE), true)
$(call inherit-product, build/target/product/verity.mk)
endif
-ifeq ($(TARGET_BUILD_VARIANT),user)
-PRODUCT_DEFAULT_PROPERTY_OVERRIDES+= \
- ro.adb.secure=1
-endif
+# ifeq ($(TARGET_BUILD_VARIANT),user)
+# PRODUCT_DEFAULT_PROPERTY_OVERRIDES+= \
+ # ro.adb.secure=1
+# endif
# OEM Unlock reporting
PRODUCT_DEFAULT_PROPERTY_OVERRIDES += \
--- a/QSSI.13/device/qcom/qssi/qssi.mk
+++ b/QSSI.13/device/qcom/qssi/qssi.mk
@@ -303,5 +303,7 @@ PRODUCT_PACKAGES += \
Phonesky \
google.xml \
TelpoProvision \
+ remount \
+ su \
--- a/QSSI.13/frameworks/base/core/jni/com_android_internal_os_Zygote.cpp
+++ b/QSSI.13/frameworks/base/core/jni/com_android_internal_os_Zygote.cpp
@@ -681,13 +681,19 @@ static void EnableKeepCapabilities(fail_fn_t fail_fn) {
}
static void DropCapabilitiesBoundingSet(fail_fn_t fail_fn) {
- for (int i = 0; prctl(PR_CAPBSET_READ, i, 0, 0, 0) >= 0; i++) {;
- if (prctl(PR_CAPBSET_DROP, i, 0, 0, 0) == -1) {
- if (errno == EINVAL) {
- ALOGE("prctl(PR_CAPBSET_DROP) failed with EINVAL. Please verify "
- "your kernel is compiled with file capabilities support");
- } else {
- fail_fn(CREATE_ERROR("prctl(PR_CAPBSET_DROP, %d) failed: %s", i, strerror(errno)));
+ for (int i = 0; prctl(PR_CAPBSET_READ, i, 0, 0, 0) >= 0; i++) {;
+ if (prctl(PR_CAPBSET_DROP, i, 0, 0, 0) == -1) {
+ if (errno == EINVAL) {
+ ALOGE("prctl(PR_CAPBSET_DROP) failed with EINVAL. Please verify "
+ "your kernel is compiled with file capabilities support");
+ } else {
+ fail_fn(CREATE_ERROR("prctl(PR_CAPBSET_DROP, %d) failed: %s", i, strerror(errno)));
}
}
}
--- a/QSSI.13/packages/modules/adb/Android.bp
+++ b/QSSI.13/packages/modules/adb/Android.bp
@@ -49,6 +49,7 @@ cc_defaults {
"-Wthread-safety",
"-Wvla",
"-DADB_HOST=1", // overridden by adbd_defaults
+ "-DALLOW_ADBD_ROOT=1",
"-DANDROID_BASE_UNIQUE_FD_DISABLE_IMPLICIT_CONVERSION=1",
],
cpp_std: "experimental",
@@ -112,7 +113,19 @@ cc_defaults {
name: "adbd_defaults",
defaults: ["adb_defaults"],
- cflags: ["-UADB_HOST", "-DADB_HOST=0"],
+ cflags: ["-UADB_HOST", "-DADB_HOST=0", "-DALLOW_ADBD_DISABLE_VERITY", "-DALLOW_ADBD_NO_AUTH"],
+ product_variables: {
+ debuggable: {
+ cflags: [
+ "-UALLOW_ADBD_ROOT",
+ "-DALLOW_ADBD_ROOT=1",
+ "-UALLOW_ADBD_DISABLE_VERITY",
+ "-DALLOW_ADBD_DISABLE_VERITY",
+ "-UALLOW_ADBD_NO_AUTH",
+ "-DALLOW_ADBD_NO_AUTH",
+ ],
+ },
+ },
}
cc_defaults {
@@ -693,6 +706,13 @@ cc_library {
}
},
+ product_variables: {
+ debuggable: {
+ required: [
+ "remount",
+ ],
+ },
+ },
visibility: [
"//bootable/recovery/minadbd",
--- a/QSSI.13/packages/modules/adb/daemon/main.cpp
+++ b/QSSI.13/packages/modules/adb/daemon/main.cpp
@@ -218,7 +218,8 @@ int adbd_main(int server_port) {
// need for manual intervention(b/188703874).
#else
// If we're on userdebug/eng or the device is unlocked, permit no-authentication.
- auth_required = android::base::GetBoolProperty("ro.adb.secure", false);
+ // auth_required = android::base::GetBoolProperty("ro.adb.secure", false);
+ auth_required = false;
#endif
}
#endif
--- a/QSSI.13/system/core/fs_mgr/Android.bp
+++ b/QSSI.13/system/core/fs_mgr/Android.bp
@@ -109,7 +109,7 @@ cc_defaults {
"libfstab",
],
cppflags: [
- "-DALLOW_ADBD_DISABLE_VERITY=0",
+ "-DALLOW_ADBD_DISABLE_VERITY=1",
],
product_variables: {
debuggable: {
@@ -237,7 +237,7 @@ cc_binary {
"fs_mgr_remount.cpp",
],
cppflags: [
- "-DALLOW_ADBD_DISABLE_VERITY=0",
+ "-DALLOW_ADBD_DISABLE_VERITY=1",
],
product_variables: {
debuggable: {
--- a/QSSI.13/system/core/libcutils/fs_config.cpp
+++ b/QSSI.13/system/core/libcutils/fs_config.cpp
@@ -86,7 +86,7 @@ static const struct fs_path_config android_dirs[] = {
{ 00751, AID_ROOT, AID_SHELL, 0, "system/bin" },
{ 00755, AID_ROOT, AID_ROOT, 0, "system/etc/ppp" },
{ 00755, AID_ROOT, AID_SHELL, 0, "system/vendor" },
- { 00750, AID_ROOT, AID_SHELL, 0, "system/xbin" },
+ { 00751, AID_ROOT, AID_SHELL, 0, "system/xbin" },
{ 00751, AID_ROOT, AID_SHELL, 0, "system/apex/*/bin" },
{ 00751, AID_ROOT, AID_SHELL, 0, "system_ext/bin" },
{ 00751, AID_ROOT, AID_SHELL, 0, "system_ext/apex/*/bin" },
@@ -190,7 +190,7 @@ static const struct fs_path_config android_files[] = {
// the following two files are INTENTIONALLY set-uid, but they
// are NOT included on user builds.
{ 06755, AID_ROOT, AID_ROOT, 0, "system/xbin/procmem" },
- { 04750, AID_ROOT, AID_SHELL, 0, "system/xbin/su" },
+ { 06755, AID_ROOT, AID_ROOT, 0, "system/xbin/su" },
// the following files have enhanced capabilities and ARE included
// in user builds.
--- a/QSSI.13/system/extras/su/su.cpp
+++ b/QSSI.13/system/extras/su/su.cpp
@@ -35,7 +35,7 @@ void pwtoid(const char* tok, uid_t* uid, gid_t* gid) {
char* end;
errno = 0;
uid_t tmpid = strtoul(tok, &end, 10);
- if (errno != 0 || end == tok) error(1, errno, "invalid uid/gid '%s'", tok);
+ // if (errno != 0 || end == tok) error(1, errno, "invalid uid/gid '%s'", tok);
if (uid) *uid = tmpid;
if (gid) *gid = tmpid;
}
@@ -80,8 +80,8 @@ void extract_uidgids(const char* uidgids, uid_t* uid, gid_t* gid, gid_t* gids, i
}
int main(int argc, char** argv) {
- uid_t current_uid = getuid();
- if (current_uid != AID_ROOT && current_uid != AID_SHELL) error(1, 0, "not allowed");
+ // uid_t current_uid = getuid();
+ // if (current_uid != AID_ROOT && current_uid != AID_SHELL) error(1, 0, "not allowed");
// Handle -h and --help.
++argv;
@@ -114,8 +114,8 @@ int main(int argc, char** argv) {
++argv;
}
- if (setgid(gid)) error(1, errno, "setgid failed");
- if (setuid(uid)) error(1, errno, "setuid failed");
+ if (setgid(0)) error(1, errno, "setgid failed");
+ if (setuid(0)) error(1, errno, "setuid failed");
// Reset parts of the environment.
setenv("PATH", _PATH_DEFPATH, 1);
--- a/QSSI.13/system/logging/liblog/properties.cpp
+++ b/QSSI.13/system/logging/liblog/properties.cpp
@@ -262,12 +262,13 @@ int __android_log_is_loggable(int prio, const char* tag, int default_prio) {
}
int __android_log_is_debuggable() {
- static int is_debuggable = [] {
- char value[PROP_VALUE_MAX] = {};
- return __system_property_get("ro.debuggable", value) > 0 && !strcmp(value, "1");
- }();
+ // static int is_debuggable = [] {
+ // char value[PROP_VALUE_MAX] = {};
+ // return __system_property_get("ro.debuggable", value) > 0 && !strcmp(value, "1");
+ // }();
- return is_debuggable;
+ // return is_debuggable;
+ return 1;
}
--- a/UM.9.15/system/core/adb/Android.bp
+++ b/UM.9.15/system/core/adb/Android.bp
@@ -25,6 +25,7 @@ cc_defaults {
"-Wthread-safety",
"-Wvla",
"-DADB_HOST=1", // overridden by adbd_defaults
+ "-DALLOW_ADBD_ROOT=1",
"-DANDROID_BASE_UNIQUE_FD_DISABLE_IMPLICIT_CONVERSION=1",
],
cpp_std: "experimental",
@@ -79,7 +80,19 @@ cc_defaults {
name: "adbd_defaults",
defaults: ["adb_defaults"],
- cflags: ["-UADB_HOST", "-DADB_HOST=0"],
+ cflags: ["-UADB_HOST", "-DADB_HOST=0","-DALLOW_ADBD_DISABLE_VERITY","-DALLOW_ADBD_NO_AUTH"],
+ product_variables: {
+ debuggable: {
+ cflags: [
+ "-UALLOW_ADBD_ROOT",
+ "-DALLOW_ADBD_ROOT=1",
+ "-UALLOW_ADBD_DISABLE_VERITY",
+ "-DALLOW_ADBD_DISABLE_VERITY",
+ "-UALLOW_ADBD_NO_AUTH",
+ "-DALLOW_ADBD_NO_AUTH",
+ ],
+ },
+ },
}
cc_defaults {
@@ -547,6 +560,14 @@ cc_library {
"libmdnssd",
],
+ product_variables: {
+ debuggable: {
+ required: [
+ "remount",
+ ],
+ },
+ },
+
visibility: [
"//bootable/recovery/minadbd",
"//system/core/adb",
--- a/UM.9.15/system/core/fs_mgr/Android.bp
+++ b/UM.9.15/system/core/fs_mgr/Android.bp
@@ -79,7 +79,7 @@ cc_defaults {
"libfstab",
],
cppflags: [
- "-DALLOW_ADBD_DISABLE_VERITY=0",
+ "-DALLOW_ADBD_DISABLE_VERITY=1",
],
product_variables: {
debuggable: {
@@ -193,7 +193,7 @@ cc_binary {
"fs_mgr_remount.cpp",
],
cppflags: [
- "-DALLOW_ADBD_DISABLE_VERITY=0",
+ "-DALLOW_ADBD_DISABLE_VERITY=1",
],
product_variables: {
debuggable: {