1、user版本打开uart口日志输出
1.1 修改lk
mediatek\proprietary\bootable\bootloader\lk\app\mt_boot\mt_boot.c
****************************************************************************/
我们系统使用的是设备树，所以调用的是boot_linux_fdt
int boot_linux_fdt(void *kernel, unsigned *tags,
unsigned machtype,
void *ramdisk, unsigned ramdisk_sz)
{
void *fdt = tags;
int ret = 0;
int offset;
char tmpbuf[TMPBUF_SIZE];
dt_dram_info mem_reg_property[128];
....................................
if (!has_set_p2u) {
switch (eBuildType) {
case BUILD_TYPE_USER:
if ((g_boot_mode == META_BOOT) && is_meta_log_disable &&
(is_meta_log_disable() == 0))
cmdline_append("printk.disable_uart=0");
else
//cmdline_append("printk.disable_uart=1"); //修改
cmdline_append("printk.disable_uart=0");
#ifdef ATC_AOSP_ENHANCEMENT
//cmdline_append("loglevel=0"); //关闭串口打印 修改成日志级别是4
cmdline_append("loglevel=4");
#endif
break;
case BUILD_TYPE_USERDEBUG:
.........................................
}
其它部分不需要修改，否则就达不到user编译的目的。
1.2 修改内核：
kernel-3.18\kernel\printk\printk.c
#ifdef CONFIG_MT_PRINTK_UART_CONSOLE
void mt_disable_uart(void)
{
if (mt_need_uart_console == 0)
//printk_disable_uart = 1; //将printk_disable_uart = 1修改成printk_disable_uart = 0
printk_disable_uart = 0;
}
void mt_enable_uart(void)
{
if (mt_need_uart_console == 1) {
if (printk_disable_uart == 0)
return;
printk_disable_uart = 0;
}
}
#endif
1.3 修改init.rc
system\core\rootdir\init.rc
system\core\rootdir\init.rc
service console /system/bin/sh
class core
console
#disabled //注释掉这行，确保任何条件下控制台启动
#user shell //控制台具有root权限
user root
group shell log readproc
seclabel u:r:shell:s0
on property:ro.debuggable=1
# Give writes to anyone for the trace folder on debug builds.
# The folder is used to store method traces.
chmod 0773 /data/misc/trace
start console
2、user版本具有root权限
2.1 修改ro.adb.secure和ro.secure属性
build\core\main.mk
ifneq (,$(user_variant))
# Target is secure in user builds.
#ADDITIONAL_DEFAULT_PROPERTIES += ro.secure=1 //修改
ADDITIONAL_DEFAULT_PROPERTIES += ro.secure=0
ADDITIONAL_DEFAULT_PROPERTIES += security.perf_harden=1
ifeq ($(user_variant),user)
#ADDITIONAL_DEFAULT_PROPERTIES += ro.adb.secure=1 //修改
ADDITIONAL_DEFAULT_PROPERTIES += ro.adb.secure=0
endif
ifeq ($(user_variant),userdebug)
# Pick up some extra useful tools
tags_to_install += debug
else
# Disable debugging in plain user builds.
#enable_target_debugging := //去这行
endif
2.2 修改selinux
Android8.x:
system\core\init\init.cpp
static bool selinux_is_enforcing(void)
{
return false; //直接返回
if (ALLOW_PERMISSIVE_SELINUX) {
return selinux_status_from_cmdline() == SELINUX_ENFORCING;
}
return true;
}
android9.x:
system/core/init/selinux.cpp
bool IsEnforcing() {
return false; //直接返回
if (ALLOW_PERMISSIVE_SELINUX) {
return StatusFromCmdline() == SELINUX_ENFORCING;
}
return true;
}
2.3 修改adb的android.mk文件
system\core\adb\Android.mk
LOCAL_CFLAGS := \
$(ADB_COMMON_CFLAGS) \
$(ADB_COMMON_linux_CFLAGS) \
-DADB_HOST=0 \
-D_GNU_SOURCE \
-Wno-deprecated-declarations \
#LOCAL_CFLAGS += -DALLOW_ADBD_NO_AUTH=$(if $(filter userdebug eng,$(TARGET_BUILD_VARIANT)),1,0) //修改
LOCAL_CFLAGS += -DALLOW_ADBD_NO_AUTH=$(if $(filter user userdebug eng,$(TARGET_BUILD_VARIANT)),1,0)
#ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT))) //修改
ifneq (,$(filter user userdebug eng,$(TARGET_BUILD_VARIANT)))
LOCAL_CFLAGS += -DALLOW_ADBD_DISABLE_VERITY=1
LOCAL_CFLAGS += -DALLOW_ADBD_ROOT=1
endif
3、另外一种user adb root打开的修改方法(不用授权adb key)如下：
先参考：https://blog.csdn.net/kc58236582/article/details/53502177
system\core\adb\daemon\main.cpp
int adbd_main(int server_port) {
umask(0);
signal(SIGPIPE, SIG_IGN);
init_transport_registration();
// We need to call this even if auth isn't enabled because the file
// descriptor will always be open.
adbd_cloexec_auth_socket();
// Respect ro.adb.secure in userdebug/eng builds (ALLOW_ADBD_NO_AUTH), or when the
// device is unlocked.
if ((ALLOW_ADBD_NO_AUTH || is_device_unlocked()) &&
!android::base::GetBoolProperty("ro.adb.secure", false)) {
auth_required = false;
}
auth_required = false; //添加这行
然后就是处理adb root的service，我们将版本不是debuggable的处理去除。
system\core\adb\services.cpp
void restart_root_service(int fd, void *cookie) {
if (getuid() == 0) {
WriteFdExactly(fd, "adbd is already running as root\n");
adb_close(fd);
} else {
/*if (!__android_log_is_debuggable()) { //去掉这个代码
WriteFdExactly(fd, "adbd cannot run as root in production builds\n");
adb_close(fd);
return;
}*/
android::base::SetProperty("service.adb.root", "1");
WriteFdExactly(fd, "restarting adbd as root\n");
adb_close(fd);
}
}
接着我们来看drop_privileges函数，这个函数如果adb不用root权限会给她降级到shell。而就是通过should_drop_privileges这个函数来判断是否要降级，返回false就是使用root权限。
system\core\adb\daemon\main.cpp
static void drop_privileges(int server_port) {
ScopedMinijail jail(minijail_new());
// Add extra groups:
// AID_ADB to access the USB driver
// AID_LOG to read system logs (adb logcat)
// AID_INPUT to diagnose input issues (getevent)
// AID_INET to diagnose network issues (ping)
// AID_NET_BT and AID_NET_BT_ADMIN to diagnose bluetooth (hcidump)
// AID_SDCARD_R to allow reading from the SD card
// AID_SDCARD_RW to allow writing to the SD card
// AID_NET_BW_STATS to read out qtaguid statistics
// AID_READPROC for reading /proc entries across UID boundaries
// AID_UHID for using 'hid' command to read/write to /dev/uhid
gid_t groups[] = {AID_ADB, AID_LOG, AID_INPUT, AID_INET,
AID_NET_BT, AID_NET_BT_ADMIN, AID_SDCARD_R, AID_SDCARD_RW,
AID_NET_BW_STATS, AID_READPROC, AID_UHID};
minijail_set_supplementary_gids(jail.get(), arraysize(groups), groups);
// Don't listen on a port (default 5037) if running in secure mode.
// Don't run as root if running in secure mode.
if (should_drop_privileges()) { //通过这里进行降级
drop_capabilities_bounding_set_if_needed(jail.get());
minijail_change_gid(jail.get(), AID_SHELL);
minijail_change_uid(jail.get(), AID_SHELL);
// minijail_enter() will abort if any priv-dropping step fails.
minijail_enter(jail.get());
D("Local port disabled");
} else {
// minijail_enter() will abort if any priv-dropping step fails.
minijail_enter(jail.get());
if (root_seclabel != nullptr) {
if (selinux_android_setcon(root_seclabel) < 0) {
LOG(FATAL) << "Could not set SELinux context";
}
}
std::string error;
std::string local_name =
android::base::StringPrintf("tcp:%d", server_port);
if (install_listener(local_name, "*smartsocket*", nullptr, 0, nullptr, &error)) {
LOG(FATAL) << "Could not install *smartsocket* listener: " << error;
}
}
}
因此我们在should_drop_privileges函数最上面直接判断处理，当service.adb.root（adb root会设置这个权限）是1就返回false
system\core\adb\daemon\main.cpp
static bool should_drop_privileges() {
#if defined(ALLOW_ADBD_ROOT)
// The properties that affect `adb root` and `adb unroot` are ro.secure and
// ro.debuggable. In this context the names don't make the expected behavior
// particularly obvious.
//
// ro.debuggable:
// Allowed to become root, but not necessarily the default. Set to 1 on
// eng and userdebug builds.
//
// ro.secure:
// Drop privileges by default. Set to 1 on userdebug and user builds.
bool ro_secure = android::base::GetBoolProperty("ro.secure", true);
bool ro_debuggable = __android_log_is_debuggable();
// Drop privileges if ro.secure is set...
bool drop = ro_secure;
// ... except "adb root" lets you keep privileges in a debuggable build.
std::string prop = android::base::GetProperty("service.adb.root", "");
bool adb_root = (prop == "1");
bool adb_unroot = (prop == "0");
if (ro_debuggable && adb_root) {
drop = false;
}
// ... and "adb unroot" lets you explicitly drop privileges.
if (adb_unroot) {
drop = true;
}
return drop;
#else
//return true; // "adb root" not allowed, always drop privileges.
//添加
std::string prop1 = android::base::GetProperty("service.adb.root", "");
if (prop1 == "1") {
return false;
//结束添加
return true;
#endif // ALLOW_ADBD_ROOT
}
这样adbd的流程就差不多处理完了，但是发现adbd在输入adb root的时候会crash最后定位到是selinux问题。
这里我们提供一个在init中关闭selinux的简单方法。init初始化的时候会调用selinux_initialize函数，这个函数又会调用selinux_is_enforcing函数，我们确保这个函数返回false就可以了。
system\core\init\init.cpp
static selinux_enforcing_status selinux_status_from_cmdline() {
//移除以下代码
/*selinux_enforcing_status status = SELINUX_ENFORCING;
import_kernel_cmdline(false, [&](const std::string& key, const std::string& value, bool in_qemu) {
if (key == "androidboot.selinux" && value == "permissive") {
status = SELINUX_PERMISSIVE;
}
});*/ //结束移除
return status;
}
static bool selinux_is_enforcing(void)
{
if (ALLOW_PERMISSIVE_SELINUX) {
return selinux_status_from_cmdline() == SELINUX_ENFORCING;
}
//return true;
return false; //修改为返回false
}
这样adb root以及不用授权问题在user版本上就实现
862
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
