1.首先取消su只限定ROOT,SHELL用户使用的限制
code/system/extras/su/su.c
int main(int argc, char** argv) {
//uid_t current_uid = getuid();
//if (current_uid != AID_ROOT && current_uid != AID_SHELL) error(1, 0, “not allowed”);
// Handle -h and --help.
++argv;
2.APP通过socket 与su服务建立连接
suserver.c
/*
* Copyright (C) 2008 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the “License”);
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an “AS IS” BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
include
include
include
include
include
include
include
include
include
include
include
include
include
include
include
include
include
include
include
include
include
define MAXFILE 65535 // 最大的文件描述符
char* result;
long lenght = 8192;
void executeCMD(const char *cmd) {
char buf_ps[8192];
char ps[8192] = { 0 };
int i = 1;
//char *result2 = NULL;
FILE *ptr = NULL;
strcpy(ps, cmd);
if ((ptr = popen(ps, “r”)) != NULL) {
result = (char ) malloc(lenght sizeof(char));
char result2 = (char ) malloc(lenght * sizeof(char));
while (fgets(buf_ps, 8192, ptr) != NULL) {
result = (char *) malloc(lenght * i * sizeof(char));
if (result2 != NULL)
strcpy(result, result2);
strcat(result, buf_ps);
i++;
result2 = (char *) malloc(lenght * (i - 1) * sizeof(char));
strcpy(result2, result);
}
pclose(ptr);
ptr = NULL;
} else {
printf("popen %s error\n", ps);
}
}
int main() {
//pid_t pc;
//int i, fd;
int i;
/*
pc = fork();
if (pc < 0) {
printf("error fork/n");
exit(1);
} else if (pc > 0)
exit(0); // 父进程退出 , 这个子进程变成孤儿进程 , 由 init 进程接管 ,
*/
setsid(); // 变为后台程序
chdir("/");
umask(0); // 对所有的权限开放
for (i = 0; i < MAXFILE; i++)
close(i); // 关闭所有的不需要的文件描述符
int server_sockfd; //服务器端套接字
int client_sockfd; //客户端套接字
int len;
struct sockaddr_in my_addr; //服务器网络地址结构体
struct sockaddr_in remote_addr; //客户端网络地址结构体
int sin_size;
char buf[8192]; //数据传送的缓冲区
memset(&my_addr, 0, sizeof(my_addr)); //数据初始化--清零
my_addr.sin_family = AF_INET; //设置为IP通信
my_addr.sin_addr.s_addr = INADDR_ANY; //服务器IP地址--允许连接到所有本地地址上
my_addr.sin_port = htons(40000); //服务器端口号
/*创建服务器端套接字--IPv4协议,面向连接通信,TCP协议*/
if ((server_sockfd = socket(PF_INET, SOCK_STREAM, 0)) < 0) {
perror("socket");
return 1;
}
/*将套接字绑定到服务器的网络地址上*/
if (bind(server_sockfd, (struct sockaddr *) &my_addr,
sizeof(struct sockaddr)) < 0) {
perror("bind");
return 1;
}
/*监听连接请求--监听队列长度为5*/
listen(server_sockfd, 5);
sin_size = sizeof(struct sockaddr_in);
while (1) // 守护进程实现的服务
{
//printf("等待连接...\n");
if ((client_sockfd = accept(server_sockfd,
(struct sockaddr *) &remote_addr, (socklen_t *)&sin_size)) < 0) {
perror("accept");
//return 1;
}
//printf("接受到一个连接:%s \r\n", inet_ntoa(remote_addr.sin_addr));
if ((len = recv(client_sockfd, buf, 8192, 0)) > 0) {
buf[len] = '\0';
//printf("%s\n", buf);
executeCMD(buf);
if (strlen(result) == 0) {
strcpy(result, "Returing is null!");
}
if (send(client_sockfd, result, strlen(result), 0) < 0) {
perror("write");
//return 1;
}
}
close(client_sockfd);
}
close(server_sockfd);
return 0;
}
3.suserver security 相关
code/device/qcom/sepolicy/common/file_contexts
/system/xbin/suserver u:object_r:suserver_exec:s0
code/device/qcom/sepolicy/common/suserver.te
type suserver, domain;
type suserver_exec, exec_type, file_type;
init_daemon_domain(suserver)
4.启动服务
code/device/qcom/xxx/init.target.rc
service suserver /system/xbin/suserver
class main
user root
group root wifi
oneshot
on boot
start suserver
5.APP调用方法例子
try{
Process suProcess = Runtime.getRuntime().exec(“suclient”);//root权限
DataOutputStream os = new DataOutputStream(suProcess.getOutputStream());
os.writeBytes(“ifconfig eth0 192.168.1.99 broadcast 192.168.1.255 netmask 255.255.255.0\n”);
os.writeBytes(“exit\n”);
os.flush();
}catch (IOException e) {
e.printStackTrace();
} catch (Exception e) {
e.printStackTrace();
}