What has the <extension> done ?

[w296488320]

I m trying to learn this code but I don t understand what is do in the 《extension 》directory ？
The good thing is processing some callback information ?
The fake_id0, f i x _ symlink _ s i z e... I don't know what they can do。

[michalbednarski]

Extensions are optional features of proot that are mostly contained within their directory (such as extension/fake_id0, though there are still hooks for them outside their directory), each of them is compiled into proot and enabled through command-line switch.

While I've got no proper documentation, you might find some information in following places:

What particular extensions do is described in command-line switches used for enabling them:

proot/src/cli/proot.h

Lines 193 to 277 in d4e4a07

	{ .class = "Extension options",
	.arguments = {
	{ .name = "-k", .separator = ' ', .value = "string" },
	{ .name = "--kernel-release", .separator = '=', .value = "string" },
	{ .name = NULL, .separator = '\0', .value = NULL } },
	.handler = handle_option_k,
	.description = "Make current kernel appear as kernel release *string*.",
	.detail = "\tIf a program is run on a kernel older than the one expected by its\n\
	\tGNU C library, the following error is reported: \"FATAL: kernel too\n\
	\told\". To be able to run such programs, PRoot can emulate some of\n\
	\tthe features that are available in the kernel release specified by\n\
	\t*string* but that are missing in the current kernel.",
	},
	{ .class = "Extension options",
	.arguments = {
	{ .name = "-0", .separator = '\0', .value = NULL },
	{ .name = "--root-id", .separator = '\0', .value = NULL },
	{ .name = NULL, .separator = '\0', .value = NULL } },
	.handler = handle_option_0,
	.description = "Make current user appear as \"root\" and fake its privileges.",
	.detail = "\tSome programs will refuse to work if they are not run with \"root\"\n\
	\tprivileges, even if there is no technical reason for that. This\n\
	\tis typically the case with package managers. This option allows\n\
	\tusers to bypass this kind of limitation by faking the user/group\n\
	\tidentity, and by faking the success of some operations like\n\
	\tchanging the ownership of files, changing the root directory to\n\
	\t/, ... Note that this option is quite limited compared to\n\
	\tfakeroot.",
	},
	{ .class = "Extension options",
	.arguments = {
	{ .name = "-i", .separator = ' ', .value = "string" },
	{ .name = "--change-id", .separator = '=', .value = "string" },
	{ .name = NULL, .separator = '\0', .value = NULL } },
	.handler = handle_option_i,
	.description = "Make current user and group appear as *string* \"uid:gid\".",
	.detail = "\tThis option makes the current user and group appear as uid and\n\
	\tgid. Likewise, files actually owned by the current user and\n\
	\tgroup appear as if they were owned by uid and gid instead.\n\
	\tNote that the -0 option is the same as -i 0:0.",
	},
	{ .class = "Extension options",
	.arguments = {
	{ .name = "--link2symlink", .separator = '\0', .value = NULL },
	{ .name = "-l", .separator = '\0', .value = NULL },
	{ .name = NULL, .separator = '\0', .value = NULL } },
	.handler = handle_option_link2symlink,
	.description = "Replace hard links with symlinks, pretending they are really hardlinks",
	.detail = "\tEmulates hard links with symbolic links when SELinux policies\n\
	\tdo not allow hard links.",
	},
	{ .class = "Extension options",
	.arguments = {
	{ .name = "--sysvipc", .separator = '\0', .value = NULL },
	{ .name = NULL, .separator = '\0', .value = NULL } },
	.handler = handle_option_sysvipc,
	.description = "Handle System V IPC syscalls in proot",
	.detail = "\tHandles System V IPC syscalls (shmget, semget, msgget, etc.)\n\
	\tsyscalls inside proot. IPC is handled inside proot and launching 2 proot instances\n\
	\twill lead to 2 different IPC Namespaces",
	},
	{ .class = "Extension options",
	.arguments = {
	{ .name = "-H", .separator = '\0', .value = NULL },
	{ .name = NULL, .separator = '\0', .value = NULL } },
	.handler = handle_option_H,
	.description = "Hide files and directories starting with '.proot.' .",
	.detail = "",
	},
	{ .class = "Extension options",
	.arguments = {
	{ .name = "-p", .separator = '\0', .value = NULL },
	{ .name = NULL, .separator = '\0', .value = NULL } },
	.handler = handle_option_p,
	.description = "Modify bindings to protected ports to use a higher port number.",
	.detail = "",
	},
	{ .class = "Extension options",
	.arguments = {
	{ .name = "-L", .separator = '\0', .value = NULL },
	{ .name = NULL, .separator = '\0', .value = NULL } },
	.handler = handle_option_L,
	.description = "Correct the size returned from lstat for symbolic links.",
	.detail = "",
	},

List of events on which extensions can react to is in ExtensionEvent enum:

proot/src/extension/extension.h

Lines 33 to 150 in d4e4a07

	typedef enum {
	/* A guest path passed as an argument of the current syscall
	* is about to be translated: "(char *) data1" is the base for
	* "(char *) data2" -- the guest path -- if this latter is
	* relative. If the extension returns > 0, then PRoot skips
	* its own handling. If the extension returns < 0, then PRoot
	* reports this errno as-is. */
	GUEST_PATH,
	/* A canonicalized host path is being accessed during the
	* translation of a guest path: "(char *) data1" is the
	* canonicalized host path and "(bool) data2" is true if it is
	* the last iteration. Note that several host paths are accessed
	* for a given guest path since PRoot has to walk along all
	* parent directories and symlinks in order to translate it.
	* If the extension returns < 0, then PRoot reports this errno
	* as-is. */
	HOST_PATH,
	/* The canonicalization succeed: "(char *) data1" is the
	* translated path from the host point-of-view. It can be
	* substituted by the extension. If the extension returns <
	* 0, then PRoot reports this errno as-is. */
	TRANSLATED_PATH,
	/* The tracee enters a syscall, and PRoot hasn't do anything
	* yet. If the extension returns > 0, then PRoot skips its
	* own handling. If the extension returns < 0, then PRoot
	* cancels the syscall and reports this errno to the
	* tracee. */
	SYSCALL_ENTER_START,
	/* The tracee enters a syscall, and PRoot has already handled
	* it: "(int) data1" is the current status, it is < 0 when
	* something went wrong. If the extension returns < 0, then
	* PRoot cancels the syscall and reports this errno to the
	* tracee. */
	SYSCALL_ENTER_END,
	/* The tracee exits a syscall, and PRoot hasn't do anything
	* yet. If the extension returns > 0, then PRoot skips its
	* own handling. If the extension returns < 0, then PRoot
	* reports this errno to the tracee. */
	SYSCALL_EXIT_START,
	/* The tracee exits a syscall, and PRoot has already handled
	* it. If the extension returns < 0, then PRoot reports this
	* errno to the tracee. */
	SYSCALL_EXIT_END,
	/* The tracee is stopped either because of a syscall or a
	* signal: "(int) data1" is its new status as reported by
	* waitpid(2). If the extension returns != 0, then PRoot
	* skips its own handling. */
	NEW_STATUS,
	/* Ask how this extension is inheritable: "(Tracee *) data1"
	* is the child tracee and "(bool) data2" is the clone(2)
	* flags (CLONE_RECONF for sub-reconfiguration). The meaning
	* of the returned value is:
	*
	* < 0 : not inheritable
	* == 0 : inheritable + shared configuration.
	* > 0 : inheritable + call INHERIT_CHILD. */
	INHERIT_PARENT,
	/* Control the inheritance: "(Extension *) data1" is the
	* extension of the parent and "(word_t) data2" is the clone(2)
	* flags (CLONE_RECONF for sub-reconfiguration). For instance
	* the extension for the child could use a configuration
	* different from the parent's configuration. */
	INHERIT_CHILD,
	/* The tracee enters a "chained" syscall, that is, an
	* unrequested syscall inserted by PRoot after an actual
	* syscall. If the extension returns < 0, then PRoot cancels
	* the syscall and reports this errno to the tracee. */
	SYSCALL_CHAINED_ENTER,
	/* The tracee exists a "chained" syscall, that is, an
	* unrequested syscall inserted by PRoot after an actual
	* syscall. */
	SYSCALL_CHAINED_EXIT,
	/* Initialize the extension: "(const char *) data1" is its
	* argument that was passed to the command-line interface. If
	* the extension returns < 0, then PRoot removed it. */
	INITIALIZATION,
	/* The extension is not attached to its tracee anymore
	* (destructor). */
	REMOVED,
	/* Print the current configuration of the extension. See
	* print_config() as an example. */
	PRINT_CONFIG,
	/* Print the usage of the extension: "(bool) data1" is true
	* for a detailed usage. See print_usage() as an example. */
	PRINT_USAGE,
	/* A SIGSYS has occurred and we are going to see if any of the extensions wants to handle it for us*/
	SIGSYS_OCC,
	/* link2symlink notifies other extensions when it is moving
	* a file */
	LINK2SYMLINK_RENAME,
	/* link2symlink notifies other extensions when it is unlinking
	* a file */
	LINK2SYMLINK_UNLINK,
	/* statx() syscall was used by tracee and is being replaced by proot
	* data1 argument contains pointer to statx_syscall_state struct
	* defined in tracee/statx.h
	* */
	STATX_SYSCALL,
	} ExtensionEvent;

To find when particular event is executed search for notify_extensions calls

[w296488320]

I ve tried to develop demo using proot
But oddly enough my seccomp filtered callback doesn t seem to be executed
（case SIGTRAP | PTRACE_EVENT_SECCOMP2 and case SIGTRAP | PTRACE_EVENT_SECCOMP）

I have set up the HAVE_SECCOMP_FILTER

My code is as follows ↓ ↓ ↓ ↓ ↓ ↓ ↓

 
                switch (tracee->seccomp) {
                    
                    case tracer::ENABLED:
                        LOGI("SIGTRAP | 0x80 (tracer::ENABLED)")

                        if (IS_IN_SYSENTER(tracee)) {
                           
                            tracee->restart_how = PTRACE_SYSCALL;
                           
                        } else {
                           
                            tracee->restart_how = PTRACE_CONT;
                            //tracee->sysexit_pending = false;
                        }
                    case tracer::DISABLED:
                        LOGI("SIGTRAP | 0x80 (tracer::DISABLED)")

                        
                        if (!tracee->seccomp_already_handled_enter) {
                            
                            bool was_sysenter = IS_IN_SYSENTER(tracee);

                            translate_syscall(tracee);
....

Log log always SIGTRAP | 0x80 (tracer:: DISABLED)

I wonder why not executed
（case SIGTRAP | PTRACE_EVENT_SECCOMP2
case SIGTRAP | PTRACE_EVENT_SECCOMP
）

[michalbednarski]

Looks like you didn't call enable_syscall_filtering, so seccomp filters were not installed. Note that this filter installation has to happen in tracee process and affects only single thread. (PTRACE_ATTACH also affects only single thread)

I'm not sure what your actual goal is but chances are that something like PLTHook will be more appropriate for you than proot or ptrace

[w296488320]

I think I'm already on it.I get a process A via fork () to go to (ptrace (PTRACE_ATTACH, pid, NULL, NULL);) main process).
Then turn on (enable_syscall_filtering)
I invited you to enter my (proot hello word) project
Am I honored to invite you to help me review my code?

[w296488320]

 case SIGSYS: {
                ALOGI(">>>>>case SIGSYS: ")
               siginfo_t siginfo = {};
               ptrace(PTRACE_GETSIGINFO, tracee->pid, NULL, &siginfo);
               if (siginfo.si_code == SYS_SECCOMP) {

This case was never executed causing me to return the result via seccomp mode modification.I m wondering how the proot goes down in seccomp mode where the modification returns the results.

Always print log when case SIGTRAP | PTRACE_EVENT_SECCOMP starts (skipping PTRACE_EVENT_SECCOMP for already handled sysenter)

I don't know that I didn't express clearly what I want to say, and I really hope that you can clone a copy of my proot hello word

[michalbednarski]

There are two seccomp polices:

1. One is installed by proot in order to avoid using ptrace(PTRACE_SYSCALL) for every syscall, instead proot can send list of syscalls to kernel and handle them. This is handled through case SIGTRAP | PTRACE_EVENT_SECCOMP. I'd recommend omitting this filter installation until you have proot working but being too much overhead, proot will work without it.
2. Other is installed by Android. This one is handled in case SIGSYS: and in case of normal Android application it won't be triggered

In case of your test application fopen("/proc/self/abc", "r"); is already redirected, but races against proot startup, if you wait before calling fopen it'll succeed

[w296488320]

2022-04-30 12:47:41.203 19404-19404/? A/DEBUG: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
2022-04-30 12:47:41.203 19404-19404/? A/DEBUG: Build fingerprint: 'Redmi/alioth/alioth:11/RKQ1.200826.002/V12.5.19.0.RKHCNXM:user/release-keys'
2022-04-30 12:47:41.203 19404-19404/? A/DEBUG: Revision: '0'
2022-04-30 12:47:41.203 19404-19404/? A/DEBUG: ABI: 'arm'
2022-04-30 12:47:41.203 19404-19404/? A/DEBUG: Timestamp: 2022-04-30 12:47:41+0800
2022-04-30 12:47:41.203 19404-19404/? A/DEBUG: pid: 19399, tid: 19399, name: example.jnihook  >>> com.example.jnihook <<<
2022-04-30 12:47:41.203 19404-19404/? A/DEBUG: uid: 10407
2022-04-30 12:47:41.203 19404-19404/? A/DEBUG: signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
2022-04-30 12:47:41.203 19404-19404/? A/DEBUG:     r0  00000000  r1  00004bc7  r2  00000006  r3  ffa171b0
2022-04-30 12:47:41.203 19404-19404/? A/DEBUG:     r4  ffa171c4  r5  ffa171a8  r6  00004bc7  r7  0000016b
2022-04-30 12:47:41.203 19404-19404/? A/DEBUG:     r8  ffa171b0  r9  ffa171c0  r10 ffa171e0  r11 ffa171d0
2022-04-30 12:47:41.203 19404-19404/? A/DEBUG:     ip  00004bc7  sp  ffa17180  lr  f46fa6ed  pc  f46fa700
2022-04-30 12:47:41.341 19404-19404/? A/DEBUG: backtrace:
2022-04-30 12:47:41.341 19404-19404/? A/DEBUG:       #00 pc 00062700  /apex/com.android.runtime/lib/bionic/libc.so!libc.so (offset 0x61000) (abort+172) (BuildId: edc23b5a08cb25fcac190e6392a4d537)
2022-04-30 12:47:41.341 19404-19404/? A/DEBUG:       #01 pc 000714e7  /data/app/~~3SEksvUnlzRRZpfTUpODAg==/com.example.jnihook-QG30dvAOV5XZBY5UyXtUHg==/lib/arm/libcamelnative.so (BuildId: 3f156414c65658b00d8ab5041aec3d696da4e6b4)
2022-04-30 12:47:41.341 19404-19404/? A/DEBUG:       #02 pc 000714b1  /data/app/~~3SEksvUnlzRRZpfTUpODAg==/com.example.jnihook-QG30dvAOV5XZBY5UyXtUHg==/lib/arm/libcamelnative.so (BuildId: 3f156414c65658b00d8ab5041aec3d696da4e6b4)
2022-04-30 12:47:41.341 19404-19404/? A/DEBUG:       #03 pc 0006e31b  /data/app/~~3SEksvUnlzRRZpfTUpODAg==/com.example.jnihook-QG30dvAOV5XZBY5UyXtUHg==/lib/arm/libcamelnative.so (BuildId: 3f156414c65658b00d8ab5041aec3d696da4e6b4)
2022-04-30 12:47:41.341 19404-19404/? A/DEBUG:       #04 pc 0006e401  /data/app/~~3SEksvUnlzRRZpfTUpODAg==/com.example.jnihook-QG30dvAOV5XZBY5UyXtUHg==/lib/arm/libcamelnative.so (_talloc_reference_loc+44) (BuildId: 3f156414c65658b00d8ab5041aec3d696da4e6b4)
2022-04-30 12:47:41.341 19404-19404/? A/DEBUG:       #05 pc 0006da33  /data/app/~~3SEksvUnlzRRZpfTUpODAg==/com.example.jnihook-QG30dvAOV5XZBY5UyXtUHg==/lib/arm/libcamelnative.so (new_child+942) (BuildId: 3f156414c65658b00d8ab5041aec3d696da4e6b4)
2022-04-30 12:47:41.341 19404-19404/? A/DEBUG:       #06 pc 0006bec3  /data/app/~~3SEksvUnlzRRZpfTUpODAg==/com.example.jnihook-QG30dvAOV5XZBY5UyXtUHg==/lib/arm/libcamelnative.so (handle_tracee_event+1590) (BuildId: 3f156414c65658b00d8ab5041aec3d696da4e6b4)
....

I found a BUG that doesn t know what caused it as if it was a talloc problem.Have you ever encountered this problem?
I think it should be wrong with my writing method and I want to fork out a process and go to the attch main process.Because the (enable_syscall_filtering) method parameter needs to wear a tracer。

So I
(Tracer * first = get_tracee (NULL, 0, true);)

Initialize in the master process.My code is as follows

void trace_current_process() {
    prctl(PR_SET_DUMPABLE, 1, 0, 0, 0);
    pid_t mainPid = getpid();
    pid_t child = fork();
    if (child < 0) {
        ALOGE("ptrace svc  fork() error ")
        return;
    }
    /* Pre-create the first first (pid == 0).  */
    Tracer *first = get_tracee(NULL, mainPid, true);
    if (first == NULL) {
        ALOGE(">>>>>>>>> error: create first first error   ")
        return;
    }
    if (child == 0) {
        // attach main process
        int status = ptrace(PTRACE_ATTACH, mainPid, NULL, NULL);
        if (status != 0) {
            //attch fail
            ALOGE(">>>>>>>>> error: attach target process %d ", status);
            return;
        }

        ALOGE("ptrace main process %d ", child)
        first->wait_sigcont = true;
        first->exe = strdup("zygote");

        upDataForkPid(getpid());

        ALOGE("ptrace attch main sucess ! main pid -> %d  tracer fork pid -> %d", mainPid, getpid())

        exit(event_loop());
    } else {
        //ALOGE("ptrace main process %d ", child)
        //add seccomp by main process
        enable_syscall_filtering(first);
    }
    LOGE("trace_current_process init finsh ")

}

I don't know if I have a problem writing that 。
I wonder if this reason caused the error above