Android Framework 常见解决方案（26）user版本可root方案
1 原理说明
User版本默认是没有root权限和remount功能的，一般该方法用于调试性能相关问题。如果使用debug版本对照，差异过大，因此就有了这样的需求。
修改的核心原理就是调整adbd及相关属性中的一些判定，即user和debug版本的区别点入手。另外就是user版本中本身是没有remount的，需要单独添加才行。同时也需要修改should_drop_privileges的返回值以防止降低adbd进程的权限等限制。
2 修改方案（Android S）
2.1 在packages/modules下的修改
在packages/modules/adb/Android.bp文件中修改：
//...
cc_binary {
name: "adbd",
defaults: ["adbd_defaults", "host_adbd_supported", "libadbd_binary_dependencies"],
recovery_available: true,
apex_available: ["com.android.adbd"],
srcs: [
"daemon/main.cpp",
],
cflags: [
"-D_GNU_SOURCE",
"-Wno-deprecated-declarations",
],
strip: {
keep_symbols: true,
},
static_libs: [
"libadbd",
"libadbd_services",
"libasyncio",
"libcap",
"liblz4",
"libminijail",
"libssl",
],
shared_libs: [
"libadb_protos",
"libadbd_auth",
],
target: {
recovery: {
exclude_shared_libs: [
"libadb_pairing_auth",
"libadb_pairing_connection",
],
}
},
+ required: [
+ "libadbd_auth",
+ "libadbd_fs",
+ "remount",
+ ],
}
//...在packages/modules/adb/daemon/main.cpp文件中修改：
//...
//should_drop_privileges直接返回false，目的是防止因此降低adbd进程的权限
static bool should_drop_privileges() {
+ return false;
//...
}
//...
int adbd_main(int server_port) {
umask(0);
signal(SIGPIPE, SIG_IGN);
#if defined(__BIONIC__)
auto fdsan_level = android_fdsan_get_error_level();
if (fdsan_level == ANDROID_FDSAN_ERROR_LEVEL_DISABLED) {
android_fdsan_set_error_level(ANDROID_FDSAN_ERROR_LEVEL_WARN_ONCE);
}
#endif
init_transport_registration();
// We need to call this even if auth isn't enabled because the file
// descriptor will always be open.
adbd_cloexec_auth_socket();
#if defined(__ANDROID__)
// If we're on userdebug/eng or the device is unlocked, permit no-authentication.
- bool device_unlocked = "orange" == android::base::GetProperty("ro.boot.verifiedbootstate", "");
+ bool device_unlocked = true;
if (__android_log_is_debuggable() || device_unlocked) {
- auth_required = android::base::GetBoolProperty("ro.adb.secure", false);
+ auth_required = false;
}
#endif
//...至此，package下的修改就结束了。接下来是system部分的修改。
2.2 system下的修改
在system/core/fs_mgr/Android.bp文件中修改：
//...
cc_defaults {
name: "libfs_mgr_defaults",
defaults: ["fs_mgr_defaults"],
export_include_dirs: ["include"],
include_dirs: ["system/vold"],
cflags: [
"-D_FILE_OFFSET_BITS=64",
],
srcs: [
"blockdev.cpp",
"file_wait.cpp",
"fs_mgr.cpp",
"fs_mgr_format.cpp",
"fs_mgr_verity.cpp",
"fs_mgr_dm_linear.cpp",
"fs_mgr_overlayfs.cpp",
"fs_mgr_roots.cpp",
"fs_mgr_vendor_overlay.cpp",
":libfiemap_srcs",
],
shared_libs: [
"libbase",
"libcrypto",
"libcrypto_utils",
"libcutils",
"libext4_utils",
"libfec",
"liblog",
"liblp",
"libselinux",
],
static_libs: [
"libavb",
"libfs_avb",
"libfstab",
"libdm",
"libgsi",
],
export_static_lib_headers: [
"libfs_avb",
"libfstab",
"libdm",
],
export_shared_lib_headers: [
"liblp",
],
whole_static_libs: [
"liblogwrap",
"libdm",
"libext2_uuid",
"libfscrypt",
"libfstab",
],
cppflags: [
- "-DALLOW_ADBD_DISABLE_VERITY=0",
+ "-UALLOW_ADBD_DISABLE_VERITY",
+ "-DALLOW_ADBD_DISABLE_VERITY=1",
],
- product_variables: {
- debuggable: {
- cppflags: [
- "-UALLOW_ADBD_DISABLE_VERITY",
- "-DALLOW_ADBD_DISABLE_VERITY=1",
- ],
- },
- },
header_libs: [
"libfiemap_headers",
"libstorage_literals_headers",
],
export_header_lib_headers: [
"libfiemap_headers",
],
required: [
"e2freefrag",
"e2fsdroid",
],
//...
cc_binary {
name: "remount",
defaults: ["fs_mgr_defaults"],
static_libs: [
"libavb_user",
"libgsid",
"libutils",
"libvold_binder",
],
shared_libs: [
"libbootloader_message",
"libbase",
"libbinder",
"libcutils",
"libcrypto",
"libext4_utils",
"libfec",
"libfs_mgr_binder",
"liblog",
"liblp",
"libselinux",
],
header_libs: [
"libcutils_headers",
],
srcs: [
"fs_mgr_remount.cpp",
],
cppflags: [
- "-DALLOW_ADBD_DISABLE_VERITY=0",
+ "-UALLOW_ADBD_DISABLE_VERITY",
+ "-DALLOW_ADBD_DISABLE_VERITY=1",
],
- product_variables: {
- debuggable: {
- cppflags: [
- "-UALLOW_ADBD_DISABLE_VERITY",
- "-DALLOW_ADBD_DISABLE_VERITY=1",
- ],
- },
- },
required: [
"clean_scratch_files",
],
}
//...这里-DALLOW_ADBD_DISABLE_VERITY=1的含义是允许adbd进程关闭Verity检查。
在system/core/fs_mgr/fs_mgr_remount.cpp文件中修改：
//...
static int do_remount(int argc, char* argv[]) {
RemountStatus retval = REMOUNT_SUCCESS;
// If somehow this executable is delivered on a "user" build, it can
// not function, so providing a clear message to the caller rather than
// letting if fall through and provide a lot of confusing failure messages.
- if (!ALLOW_ADBD_DISABLE_VERITY || (android::base::GetProperty("ro.debuggable", "0") != "1")) {
+ if (!ALLOW_ADBD_DISABLE_VERITY) {
LOG(ERROR) << "only functions on userdebug or eng builds";
return NOT_USERDEBUG;
}
const char* fstab_file = nullptr;
auto can_reboot = false;
//...
}
//...在core/init/property_service.cpp文件中修改：
//...
static void update_sys_usb_config() {
- bool is_debuggable = android::base::GetBoolProperty("ro.debuggable", false);
+ bool is_debuggable = true;
std::string config = android::base::GetProperty("persist.sys.usb.config", "");
// b/150130503, add (config == "none") condition here to prevent appending
// ",adb" if "none" is explicitly defined in default prop.
//...
}在system/core/set-verity-state/set-verity-state.cpp文件中修改：
static bool overlayfs_setup(bool enable) {
auto change = false;
+#if 0
errno = 0;
if (enable ? fs_mgr_overlayfs_teardown(nullptr, &change)
: fs_mgr_overlayfs_setup(nullptr, nullptr, &change)) {
if (change) {
printf("%s overlayfs\n", enable ? "disabling" : "using");
}
} else if (errno) {
printf("Overlayfs %s failed with error %s\n", enable ? "teardown" : "setup", strerror(errno));
suggest_run_adb_root();
}
+#endif
+ printf("overlayfs_setup(%d)",enable); //fix build error
return change;
}至此，system部分的修改也结束了。