summaryrefslogtreecommitdiff
path: root/libnativeloader/library_namespaces.cpp
diff options
context:
space:
mode:
Diffstat (limited to 'libnativeloader/library_namespaces.cpp')
-rw-r--r--libnativeloader/library_namespaces.cpp185
1 files changed, 129 insertions, 56 deletions
diff --git a/libnativeloader/library_namespaces.cpp b/libnativeloader/library_namespaces.cpp
index 9e41c2f4c1..59369eee43 100644
--- a/libnativeloader/library_namespaces.cpp
+++ b/libnativeloader/library_namespaces.cpp
@@ -13,6 +13,9 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
+
+#if defined(ART_TARGET_ANDROID)
+
#include "library_namespaces.h"
#include <dirent.h>
@@ -26,6 +29,7 @@
#include <android-base/logging.h>
#include <android-base/macros.h>
#include <android-base/properties.h>
+#include <android-base/result.h>
#include <android-base/strings.h>
#include <nativehelper/scoped_utf_chars.h>
@@ -36,6 +40,9 @@
namespace android::nativeloader {
namespace {
+
+constexpr const char* kApexPath = "/apex/";
+
// The device may be configured to have the vendor libraries loaded to a separate namespace.
// For historical reasons this namespace was named sphal but effectively it is intended
// to use to load vendor libraries to separate namespace with controlled interface between
@@ -43,9 +50,6 @@ namespace {
constexpr const char* kVendorNamespaceName = "sphal";
constexpr const char* kVndkNamespaceName = "vndk";
constexpr const char* kVndkProductNamespaceName = "vndk_product";
-constexpr const char* kArtNamespaceName = "com_android_art";
-constexpr const char* kNeuralNetworksNamespaceName = "com_android_neuralnetworks";
-constexpr const char* kStatsdNamespaceName = "com_android_os_statsd";
// classloader-namespace is a linker namespace that is created for the loaded
// app. To be specific, it is created for the app classloader. When
@@ -93,23 +97,17 @@ jobject GetParentClassLoader(JNIEnv* env, jobject class_loader) {
return env->CallObjectMethod(class_loader, get_parent);
}
-ApkOrigin GetApkOriginFromDexPath(JNIEnv* env, jstring dex_path) {
+ApkOrigin GetApkOriginFromDexPath(const std::string& dex_path) {
ApkOrigin apk_origin = APK_ORIGIN_DEFAULT;
+ if (std::regex_search(dex_path, kVendorDexPathRegex)) {
+ apk_origin = APK_ORIGIN_VENDOR;
+ }
+ if (std::regex_search(dex_path, kProductDexPathRegex)) {
+ LOG_ALWAYS_FATAL_IF(apk_origin == APK_ORIGIN_VENDOR,
+ "Dex path contains both vendor and product partition : %s",
+ dex_path.c_str());
- if (dex_path != nullptr) {
- ScopedUtfChars dex_path_utf_chars(env, dex_path);
-
- if (std::regex_search(dex_path_utf_chars.c_str(), kVendorDexPathRegex)) {
- apk_origin = APK_ORIGIN_VENDOR;
- }
-
- if (std::regex_search(dex_path_utf_chars.c_str(), kProductDexPathRegex)) {
- LOG_ALWAYS_FATAL_IF(apk_origin == APK_ORIGIN_VENDOR,
- "Dex path contains both vendor and product partition : %s",
- dex_path_utf_chars.c_str());
-
- apk_origin = APK_ORIGIN_PRODUCT;
- }
+ apk_origin = APK_ORIGIN_PRODUCT;
}
return apk_origin;
}
@@ -124,33 +122,89 @@ void LibraryNamespaces::Initialize() {
return;
}
- // android_init_namespaces() expects all the public libraries
- // to be loaded so that they can be found by soname alone.
+ // Load the preloadable public libraries. Since libnativeloader is in the
+ // com_android_art namespace, use OpenSystemLibrary rather than dlopen to
+ // ensure the libraries are loaded in the system namespace.
//
// TODO(dimitry): this is a bit misleading since we do not know
// if the vendor public library is going to be opened from /vendor/lib
// we might as well end up loading them from /system/lib or /product/lib
// For now we rely on CTS test to catch things like this but
// it should probably be addressed in the future.
- for (const auto& soname : android::base::Split(preloadable_public_libraries(), ":")) {
- LOG_ALWAYS_FATAL_IF(dlopen(soname.c_str(), RTLD_NOW | RTLD_NODELETE) == nullptr,
+ for (const std::string& soname : android::base::Split(preloadable_public_libraries(), ":")) {
+ void* handle = OpenSystemLibrary(soname.c_str(), RTLD_NOW | RTLD_NODELETE);
+ LOG_ALWAYS_FATAL_IF(handle == nullptr,
"Error preloading public library %s: %s", soname.c_str(), dlerror());
}
}
+// "ALL" is a magic name that allows all public libraries even when the
+// target SDK is > 30. Currently this is used for (Java) shared libraries
+// which don't use <uses-native-library>
+// TODO(b/142191088) remove this hack
+static constexpr const char LIBRARY_ALL[] = "ALL";
+
+// Returns the colon-separated list of library names by filtering uses_libraries from
+// public_libraries. The returned names will actually be available to the app. If the app is pre-S
+// (<= 30), the filtering is not done; the entire public_libraries are provided.
+static const std::string filter_public_libraries(
+ uint32_t target_sdk_version, const std::vector<std::string>& uses_libraries,
+ const std::string& public_libraries) {
+ // Apps targeting Android 11 or earlier gets all public libraries
+ if (target_sdk_version <= 30) {
+ return public_libraries;
+ }
+ if (std::find(uses_libraries.begin(), uses_libraries.end(), LIBRARY_ALL) !=
+ uses_libraries.end()) {
+ return public_libraries;
+ }
+ std::vector<std::string> filtered;
+ std::vector<std::string> orig = android::base::Split(public_libraries, ":");
+ for (const auto& lib : uses_libraries) {
+ if (std::find(orig.begin(), orig.end(), lib) != orig.end()) {
+ filtered.emplace_back(lib);
+ }
+ }
+ return android::base::Join(filtered, ":");
+}
+
Result<NativeLoaderNamespace*> LibraryNamespaces::Create(JNIEnv* env, uint32_t target_sdk_version,
jobject class_loader, bool is_shared,
- jstring dex_path,
+ jstring dex_path_j,
jstring java_library_path,
- jstring java_permitted_path) {
+ jstring java_permitted_path,
+ jstring uses_library_list) {
std::string library_path; // empty string by default.
+ std::string dex_path;
if (java_library_path != nullptr) {
ScopedUtfChars library_path_utf_chars(env, java_library_path);
library_path = library_path_utf_chars.c_str();
}
- ApkOrigin apk_origin = GetApkOriginFromDexPath(env, dex_path);
+ if (dex_path_j != nullptr) {
+ ScopedUtfChars dex_path_chars(env, dex_path_j);
+ dex_path = dex_path_chars.c_str();
+ }
+
+ std::vector<std::string> uses_libraries;
+ if (uses_library_list != nullptr) {
+ ScopedUtfChars names(env, uses_library_list);
+ uses_libraries = android::base::Split(names.c_str(), ":");
+ } else {
+ // uses_library_list could be nullptr when System.loadLibrary is called from a
+ // custom classloader. In that case, we don't know the list of public
+ // libraries because we don't know which apk the classloader is for. Only
+ // choices we can have are 1) allowing all public libs (as before), or 2)
+ // not allowing all but NDK libs. Here we take #1 because #2 would surprise
+ // developers unnecessarily.
+ // TODO(b/142191088) finalize the policy here. We could either 1) allow all
+ // public libs, 2) disallow any lib, or 3) use the libs that were granted to
+ // the first (i.e. app main) classloader.
+ uses_libraries.emplace_back(LIBRARY_ALL);
+ }
+
+ ApkOrigin apk_origin = GetApkOriginFromDexPath(dex_path);
// (http://b/27588281) This is a workaround for apps using custom
// classloaders and calling System.load() with an absolute path which
@@ -212,10 +266,12 @@ Result<NativeLoaderNamespace*> LibraryNamespaces::Create(JNIEnv* env, uint32_t t
ALOGD("classloader namespace configured for unbundled %s apk. library_path=%s",
origin_partition, library_path.c_str());
} else {
+ auto libs = filter_public_libraries(target_sdk_version, uses_libraries,
+ extended_public_libraries());
// extended public libraries are NOT available to vendor apks, otherwise it
// would be system->vendor violation.
- if (!extended_public_libraries().empty()) {
- system_exposed_libraries = system_exposed_libraries + ':' + extended_public_libraries();
+ if (!libs.empty()) {
+ system_exposed_libraries = system_exposed_libraries + ':' + libs;
}
}
@@ -239,7 +295,7 @@ Result<NativeLoaderNamespace*> LibraryNamespaces::Create(JNIEnv* env, uint32_t t
// racing here.
auto app_ns = NativeLoaderNamespace::Create(
namespace_name, library_path, permitted_path, parent_ns, is_shared,
- target_sdk_version < 24 /* is_greylist_enabled */, also_used_as_anonymous);
+ target_sdk_version < 24 /* is_exempt_list_enabled */, also_used_as_anonymous);
if (!app_ns.ok()) {
return app_ns.error();
}
@@ -251,27 +307,19 @@ Result<NativeLoaderNamespace*> LibraryNamespaces::Create(JNIEnv* env, uint32_t t
return system_ns.error();
}
- auto linked = app_ns->Link(*system_ns, system_exposed_libraries);
+ auto linked = app_ns->Link(&system_ns.value(), system_exposed_libraries);
if (!linked.ok()) {
return linked.error();
}
- auto art_ns = NativeLoaderNamespace::GetExportedNamespace(kArtNamespaceName, is_bridged);
- // ART APEX does not exist on host, and under certain build conditions.
- if (art_ns.ok()) {
- linked = app_ns->Link(*art_ns, art_public_libraries());
- if (!linked.ok()) {
- return linked.error();
- }
- }
-
- // Give access to NNAPI libraries (apex-updated LLNDK library).
- auto nnapi_ns =
- NativeLoaderNamespace::GetExportedNamespace(kNeuralNetworksNamespaceName, is_bridged);
- if (nnapi_ns.ok()) {
- linked = app_ns->Link(*nnapi_ns, neuralnetworks_public_libraries());
- if (!linked.ok()) {
- return linked.error();
+ for (const auto&[apex_ns_name, public_libs] : apex_public_libraries()) {
+ auto ns = NativeLoaderNamespace::GetExportedNamespace(apex_ns_name, is_bridged);
+ // Even if APEX namespace is visible, it may not be available to bridged.
+ if (ns.ok()) {
+ linked = app_ns->Link(&ns.value(), public_libs);
+ if (!linked.ok()) {
+ return linked.error();
+ }
}
}
@@ -279,7 +327,7 @@ Result<NativeLoaderNamespace*> LibraryNamespaces::Create(JNIEnv* env, uint32_t t
if (unbundled_app_origin == APK_ORIGIN_VENDOR && !vndksp_libraries_vendor().empty()) {
auto vndk_ns = NativeLoaderNamespace::GetExportedNamespace(kVndkNamespaceName, is_bridged);
if (vndk_ns.ok()) {
- linked = app_ns->Link(*vndk_ns, vndksp_libraries_vendor());
+ linked = app_ns->Link(&vndk_ns.value(), vndksp_libraries_vendor());
if (!linked.ok()) {
return linked.error();
}
@@ -290,29 +338,35 @@ Result<NativeLoaderNamespace*> LibraryNamespaces::Create(JNIEnv* env, uint32_t t
if (unbundled_app_origin == APK_ORIGIN_PRODUCT && !vndksp_libraries_product().empty()) {
auto vndk_ns = NativeLoaderNamespace::GetExportedNamespace(kVndkProductNamespaceName, is_bridged);
if (vndk_ns.ok()) {
- linked = app_ns->Link(*vndk_ns, vndksp_libraries_product());
+ linked = app_ns->Link(&vndk_ns.value(), vndksp_libraries_product());
if (!linked.ok()) {
return linked.error();
}
}
}
- // Give access to StatsdAPI libraries
- auto statsd_ns =
- NativeLoaderNamespace::GetExportedNamespace(kStatsdNamespaceName, is_bridged);
- if (statsd_ns.ok()) {
- linked = app_ns->Link(*statsd_ns, statsd_public_libraries());
- if (!linked.ok()) {
- return linked.error();
+ auto apex_ns_name = FindApexNamespaceName(dex_path);
+ if (apex_ns_name.ok()) {
+ const auto& jni_libs = apex_jni_libraries(*apex_ns_name);
+ if (jni_libs != "") {
+ auto apex_ns = NativeLoaderNamespace::GetExportedNamespace(*apex_ns_name, is_bridged);
+ if (apex_ns.ok()) {
+ linked = app_ns->Link(&apex_ns.value(), jni_libs);
+ if (!linked.ok()) {
+ return linked.error();
+ }
+ }
}
}
- if (!vendor_public_libraries().empty()) {
+ auto vendor_libs = filter_public_libraries(target_sdk_version, uses_libraries,
+ vendor_public_libraries());
+ if (!vendor_libs.empty()) {
auto vendor_ns = NativeLoaderNamespace::GetExportedNamespace(kVendorNamespaceName, is_bridged);
// when vendor_ns is not configured, link to the system namespace
auto target_ns = vendor_ns.ok() ? vendor_ns : system_ns;
if (target_ns.ok()) {
- linked = app_ns->Link(*target_ns, vendor_public_libraries());
+ linked = app_ns->Link(&target_ns.value(), vendor_libs);
if (!linked.ok()) {
return linked.error();
}
@@ -356,4 +410,23 @@ NativeLoaderNamespace* LibraryNamespaces::FindParentNamespaceByClassLoader(JNIEn
return nullptr;
}
+base::Result<std::string> FindApexNamespaceName(const std::string& location) {
+ // Lots of implicit assumptions here: we expect `location` to be of the form:
+ // /apex/modulename/...
+ //
+ // And we extract from it 'modulename', and then apply mangling rule to get namespace name for it.
+ if (android::base::StartsWith(location, kApexPath)) {
+ size_t start_index = strlen(kApexPath);
+ size_t slash_index = location.find_first_of('/', start_index);
+ LOG_ALWAYS_FATAL_IF((slash_index == std::string::npos),
+ "Error finding namespace of apex: no slash in path %s", location.c_str());
+ std::string name = location.substr(start_index, slash_index - start_index);
+ std::replace(name.begin(), name.end(), '.', '_');
+ return name;
+ }
+ return base::Error();
+}
+
} // namespace android::nativeloader
+
+#endif // defined(ART_TARGET_ANDROID)
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-03 18:59:08 +0000