oxmc
f6176009b1
Stages TWRP's GUI engine and standalone tooling as PawletOS-owned modules instead of a bootable/recovery fork, per the plugin-architecture finding in NOTES-ota-recovery-ab.md: stock recovery_main.cpp already dlopen()s librecovery_ui_ext.so and dlsym()s make_device() from it at runtime, so the UI layer doesn't require touching stock bootable/recovery at all. Confirmed via source grep that recovery.cpp/install.cpp have zero references into the partition manager/backup engine/GUI code and vice versa. recovery_ui/: TWRP's gui/, minuitwrp/, libpixelflinger/ (copied verbatim, GPL-3.0), plus a new device/ providing PawletTwrpUI (a ScreenRecoveryUI subclass) and make_device() — written from scratch against stock's RecoveryUI/ScreenRecoveryUI virtual-method contract, since TWRP's own fork never ships a make_device() (every real TWRP device provides its own, and no reference device tree was available to copy from). Top-level Android.bp defines librecovery_ui_pawlet_twrp, the module TARGET_RECOVERY_UI_LIB should point at. gui/Android.bp and minuitwrp/Android.bp had their include_dirs rewritten for the new paths. recovery_toolkit/: partition manager, backup engine (tar/digest/adbbu/apex), filesystem/format support (exfat/dosfstools/gpt/fuse/mtp/crypto), scripting (openrecoveryscript/orscmd/twrpinstall), shared helpers. Source only, no Android.bp yet for any of it. Known gap blocking recovery_ui from actually linking: gui/'s libguitwrp depends on libaosprecovery, built from recovery_toolkit/helpers/twrp.cpp via a Go Soong plugin (libaosprecovery_defaults.go) not yet ported. Neither repo has been build-tested — no local AOSP build environment available in this workspace. See each directory's README.md for a precise done/not-done breakdown.
111 lines
2.6 KiB
C
111 lines
2.6 KiB
C
/*
|
|
* Security checks of environment
|
|
* Added from shadow-utils package
|
|
* by Arkadiusz Miśkiewicz <misiek@pld.ORG.PL>
|
|
*
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#ifdef HAVE_SYS_PRCTL_H
|
|
#include <sys/prctl.h>
|
|
#else
|
|
#define PR_GET_DUMPABLE 3
|
|
#endif
|
|
#if (!defined(HAVE_PRCTL) && defined(linux))
|
|
#include <sys/syscall.h>
|
|
#endif
|
|
#include <unistd.h>
|
|
#include <sys/types.h>
|
|
|
|
#include "env.h"
|
|
|
|
#ifndef HAVE_ENVIRON_DECL
|
|
extern char **environ;
|
|
#endif
|
|
|
|
static char * const forbid[] = {
|
|
"_RLD_=",
|
|
"BASH_ENV=", /* GNU creeping featurism strikes again... */
|
|
"ENV=",
|
|
"HOME=",
|
|
"IFS=",
|
|
"KRB_CONF=",
|
|
"LD_", /* anything with the LD_ prefix */
|
|
"LIBPATH=",
|
|
"MAIL=",
|
|
"NLSPATH=",
|
|
"PATH=",
|
|
"SHELL=",
|
|
"SHLIB_PATH=",
|
|
(char *) 0
|
|
};
|
|
|
|
/* these are allowed, but with no slashes inside
|
|
(to work around security problems in GNU gettext) */
|
|
static char * const noslash[] = {
|
|
"LANG=",
|
|
"LANGUAGE=",
|
|
"LC_", /* anything with the LC_ prefix */
|
|
(char *) 0
|
|
};
|
|
|
|
void
|
|
sanitize_env(void)
|
|
{
|
|
char **envp = environ;
|
|
char * const *bad;
|
|
char **cur;
|
|
char **move;
|
|
|
|
for (cur = envp; *cur; cur++) {
|
|
for (bad = forbid; *bad; bad++) {
|
|
if (strncmp(*cur, *bad, strlen(*bad)) == 0) {
|
|
for (move = cur; *move; move++)
|
|
*move = *(move + 1);
|
|
cur--;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
for (cur = envp; *cur; cur++) {
|
|
for (bad = noslash; *bad; bad++) {
|
|
if (strncmp(*cur, *bad, strlen(*bad)) != 0)
|
|
continue;
|
|
if (!strchr(*cur, '/'))
|
|
continue; /* OK */
|
|
for (move = cur; *move; move++)
|
|
*move = *(move + 1);
|
|
cur--;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
char *safe_getenv(const char *arg)
|
|
{
|
|
uid_t ruid = getuid();
|
|
|
|
if (ruid != 0 || (ruid != geteuid()) || (getgid() != getegid()))
|
|
return NULL;
|
|
#ifdef HAVE_PRCTL
|
|
if (prctl(PR_GET_DUMPABLE, 0, 0, 0, 0) == 0)
|
|
return NULL;
|
|
#else
|
|
#if (defined(linux) && defined(SYS_prctl))
|
|
if (syscall(SYS_prctl, PR_GET_DUMPABLE, 0, 0, 0, 0) == 0)
|
|
return NULL;
|
|
#endif
|
|
#endif
|
|
#ifdef HAVE_SECURE_GETENV
|
|
return secure_getenv(arg);
|
|
#elif HAVE___SECURE_GETENV
|
|
return __secure_getenv(arg);
|
|
#else
|
|
return getenv(arg);
|
|
#endif
|
|
}
|