引言
公司某行招标软件版本是userdebug，需要关闭adb root功能，保留安装应用等功能
刚开始修改系统属性值ro.secure=1，没有效果，只得去撸源码，最后修改成功，特此记录源码分析过程
“解决方案”
这个需求，不是很简单嘛，就是一个系统属性值的问题
diff --git a/build/make/core/main.mk b/build/make/core/main.mk
index fedddff3df..c2e0a82f04 100755
--- a/build/make/core/main.mk
+++ b/build/make/core/main.mk
@@ -294,7 +294,7 @@ else # !user_variant
# Turn on checkjni for non-user builds.
ADDITIONAL_BUILD_PROPERTIES += ro.kernel.android.checkjni=1
# Set device insecure for non-user builds.
- ADDITIONAL_DEFAULT_PROPERTIES += ro.secure=0
+ ADDITIONAL_DEFAULT_PROPERTIES += ro.secure=1
# Allow mock locations by default for non user builds
ADDITIONAL_DEFAULT_PROPERTIES += ro.allow.mock.location=1
endif # !user_variant
编译，烧机，adb connect，adb root，adb remount
C:\Users\lc\Desktop
$ adb remount
remount succeeded
纳尼！！居然root成功了
分析源码过程
没办法，撸adb源码吧，源码见真章
/system/core/adb/daemon/main.cpp
int main(int argc, char** argv) {
240 while (true) {
241 static struct option opts[] = {
242 {"root_seclabel", required_argument, nullptr, 's'},
243 {"device_banner", required_argument, nullptr, 'b'},
244 {"version", no_argument, nullptr, 'v'},
245 };
246
247 int option_index = 0;
//解析命令行参数
248 int c = getopt_long(argc, argv, "", opts, &option_index);
249 if (c == -1) {
250 break;
251 }
253 switch (c) {
254 case 's':
//安全标签,adbd的权限说明
255 root_seclabel = optarg;
256 break;
257 case 'b':
//设备类型：android设备，主机
258 adb_device_banner = optarg;
259 break;
260 case 'v':
261 printf("Android Debug Bridge Daemon version %d.%d.%d\n", ADB_VERSION_MAJOR,
262 ADB_VERSION_MINOR, ADB_SERVER_VERSION);
263 return 0;
264 default:
265 // getopt already prints "adbd: invalid option -- %c" for us.
266 return 1;
267 }
268 }
269 //关闭标准输入
//指向标准输出文件描述结构体的STDIN_FILENO指向标准输出文件"/dev/null"
270 close_stdin();
271 //程序异常退出诊断
272 debuggerd_init(nullptr);
//获取系统属性persist.adb.trace_mask，调用setup_trace_mask()设置为trace掩码
273 adb_trace_init(argv);
274
275 D("Handling main()");
//adbd默认通信端口：5037
276 return adbd_main(DEFAULT_ADB_PORT);
277}
着重看下adbd_main()方法
int adbd_main(int server_port) {
//设置新建文件的默认值
//这个与chmod相反,这里相当于新建文件后的权限为666
176 umask(0);
177 //SIG_IGN，表示忽略SIGPIPE信号
178 signal(SIGPIPE, SIG_IGN);
179 //初始化adbd的传输连接
180 init_transport_registration();
182 //保证文件操作安全
184 adbd_cloexec_auth_socket();
185
186 if (ALLOW_ADBD_NO_AUTH && !android::base::GetBoolProperty("ro.adb.secure", false)) {
187 auth_required = false;
188 }
189 //adbd授权初始化
190 adbd_auth_init();
191
192 // Our external storage path may be different than apps, since
193 // we aren't able to bind mount after dropping root.
194 const char* adb_external_storage = getenv("ADB_EXTERNAL_STORAGE");
195 if (adb_external_storage != nullptr) {
196 setenv("EXTERNAL_STORAGE", adb_external_storage, 1);
197 } else {
198 D("Warning: ADB_EXTERNAL_STORAGE is not set. Leaving EXTERNAL_STORAGE"
199 " unchanged.\n");
200 }
201 //降低特权
202 drop_privileges(server_port);
203
204 bool is_usb = false;
205 if (access(USB_FFS_ADB_EP0, F_OK) == 0) {
206 // Listen on USB.
207 usb_init();
208 is_usb = true;
209 }
210
211 // If one of these properties is set, also listen on that port.
212 // If one of the properties isn't set and we couldn't listen on usb, listen
213 // on the default port.
214 std::string prop_port = android::base::GetProperty("service.adb.tcp.port", "");
215 if (prop_port.empty()) {
216 prop_port = android::base::GetProperty("persist.adb.tcp.port", "");
217 }
218
219 int port;
220 if (sscanf(prop_port.c_str(), "%d", &port) == 1 && port > 0) {
221 D("using port=%d", port);
222 // Listen on TCP port specified by service.adb.tcp.port property.
223 setup_port(port);
224 } else if (!is_usb) {
225 // Listen on default port.
226 setup_port(DEFAULT_ADB_LOCAL_TRANSPORT_PORT);
227 }
228
229 D("adbd_main(): pre init_jdwp()");
230 init_jdwp();
231 D("adbd_main(): post init_jdwp()");
232
233 D("Event loop starting");
234 fdevent_loop();
235
236 return 0;
237}
ro.adb.secure
主要来看下这段代码，分析一下ro.adb.secure属性值的作用
186 if (ALLOW_ADBD_NO_AUTH && !android::base::GetBoolProperty("ro.adb.secure", false)) {
187 auth_required = false;
188 }
用grep命令查一下ALLOW_ADBD_NO_AUTH 在哪里初始化
****@****:~/work/mt8788_9$ grep -inr "ALLOW_ADBD_NO_AUTH" system/core/adb/
system/core/adb/Android.mk:347:LOCAL_CFLAGS += -DALLOW_ADBD_NO_AUTH=$(if $(filter userdebug eng,$(TARGET_BUILD_VARIANT)),1,0)
获取当前编译环境中的编译版本属性TARGET_BUILD_VARIANT，
如果是userdebug或eng的话，ALLOW_ADBD_NO_AUTH为1，否者为0。
继续查一下auth_required初始化之后在哪里用到
/system/core/adb/adb.cpp
static void handle_new_connection(atransport* t, apacket* p) {
320 if (t->GetConnectionState() != kCsOffline) {
321 t->SetConnectionState(kCsOffline);
322 handle_offline(t);
323 }
324
325 t->update_version(p->msg.arg0, p->msg.arg1);
326 parse_banner(p->payload, t);
327
328#if ADB_HOST
329 handle_online(t);
330#else
331 if (!auth_required) {
332 handle_online(t);
333 send_connect(t);
334 } else {
335 send_auth_request(t);
336 }
337#endif
338
339 update_transports();
340}
当auth_required=true时，设置online标志位为1，调用send_connect()去连接，往下走流程
当auth_required=false时，输出需要认证的消息到终端
在这里做个测试，设置ro.adb.secure=false，然后执行adb命令
C:\Users\lc\Desktop
$ adb root
adb: unable to connect for root: device unauthorized.
This adb server's $ADB_VENDOR_KEYS is not set
Try 'adb kill-server' if that seems wrong.
Otherwise check for a confirmation dialog on your device.
C:\Users\lc\Desktop
$ adb devices
List of devices attached
10.12.200.186:5555 unauthorized
此时设备处入未认证的状态，adb install失效，不符合我们的需求。
drop_privileges()
看drop_privileges函数名，知道它是用来降低权限的，对调用者权限从root到shell的控制
static void drop_privileges(int server_port) {
99 ScopedMinijail jail(minijail_new());
100
101 // Add extra groups:
102 // AID_ADB to access the USB driver
103 // AID_LOG to read system logs (adb logcat)
104 // AID_INPUT to diagnose input issues (getevent)
105 // AID_INET to diagnose network issues (ping)
106 // AID_NET_BT and AID_NET_BT_ADMIN to diagnose bluetooth (hcidump)
107 // AID_SDCARD_R to allow reading from the SD card
108 // AID_SDCARD_RW to allow writing to the SD card
109 // AID_NET_BW_STATS to read out qtaguid statistics
110 // AID_READPROC for reading /proc entries across UID boundaries
111 // AID_UHID for using 'hid' command to read/write to /dev/uhid
112 gid_t groups[] = {AID_ADB, AID_LOG, AID_INPUT, AID_INET,
113 AID_NET_BT, AID_NET_BT_ADMIN, AID_SDCARD_R, AID_SDCARD_RW,
114 AID_NET_BW_STATS, AID_READPROC, AID_UHID};
115 minijail_set_supplementary_gids(jail.get(), arraysize(groups), groups);
116
117 //安全模式下，不监听端口（默认为5037），以非root用户身份运行
119 if (should_drop_privileges()) {
120 const bool should_drop_caps = should_drop_capabilities_bounding_set();
121
122 if (should_drop_caps) {
123 minijail_use_caps(jail.get(), CAP_TO_MASK(CAP_SETUID) | CAP_TO_MASK(CAP_SETGID));
124 }
125 //更改群组为AID_SHELL
126 minijail_change_gid(jail.get(), AID_SHELL);
//更改用户为AID_SHELL
127 minijail_change_uid(jail.get(), AID_SHELL);
128 // minijail_enter() will abort if any priv-dropping step fails.
129 minijail_enter(jail.get());
130
131 //清除clearing the inheritable, effective, and permitted sets.
135 using ScopedCaps =
136 std::unique_ptr<std::remove_pointer<cap_t>::type, std::function<void(cap_t)>>;
137 ScopedCaps caps(cap_get_proc(), &cap_free);
138 if (cap_clear_flag(caps.get(), CAP_INHERITABLE) == -1) {
139 PLOG(FATAL) << "cap_clear_flag(INHERITABLE) failed";
140 }
141 if (cap_clear_flag(caps.get(), CAP_EFFECTIVE) == -1) {
142 PLOG(FATAL) << "cap_clear_flag(PEMITTED) failed";
143 }
144 if (cap_clear_flag(caps.get(), CAP_PERMITTED) == -1) {
145 PLOG(FATAL) << "cap_clear_flag(PEMITTED) failed";
146 }
147 if (cap_set_proc(caps.get()) != 0) {
148 PLOG(FATAL) << "cap_set_proc() failed";
149 }
150
151 D("Local port disabled");
152 } else {
153 // minijail_enter() will abort if any priv-dropping step fails.
154 minijail_enter(jail.get());
155
156 if (root_seclabel != nullptr) {
157 if (selinux_android_setcon(root_seclabel) < 0) {
158 LOG(FATAL) << "Could not set SELinux context";
159 }
160 }
161 std::string error;
162 std::string local_name =
163 android::base::StringPrintf("tcp:%d", server_port);
164 if (install_listener(local_name, "*smartsocket*", nullptr, 0, nullptr, &error)) {
165 LOG(FATAL) << "Could not install *smartsocket* listener: " << error;
166 }
167 }
168}
通过should_drop_privileges()函数来判断是否需要降低权限
static bool should_drop_privileges() {
63#if defined(ALLOW_ADBD_ROOT)
64 // The properties that affect `adb root` and `adb unroot` are ro.secure and
65 // ro.debuggable. In this context the names don't make the expected behavior
66 // particularly obvious.
67 //
68 // ro.debuggable:
69 // Allowed to become root, but not necessarily the default. Set to 1 on
70 // eng and userdebug builds.
71 //
72 // ro.secure:
73 // Drop privileges by default. Set to 1 on userdebug and user builds.
74 bool ro_secure = android::base::GetBoolProperty("ro.secure", true);
75 bool ro_debuggable = __android_log_is_debuggable();
76
77 // Drop privileges if ro.secure is set...
78 bool drop = ro_secure;
79
80 // ... except "adb root" lets you keep privileges in a debuggable build.
81 std::string prop = android::base::GetProperty("service.adb.root", "");
82 bool adb_root = (prop == "1");
83 bool adb_unroot = (prop == "0");
84 if (ro_debuggable && adb_root) {
85 drop = false;
86 }
87 // ... and "adb unroot" lets you explicitly drop privileges.
88 if (adb_unroot) {
89 drop = true;
90 }
91
92 return drop;
93#else
94 return true; // "adb root" not allowed, always drop privileges.
95#endif // ALLOW_ADBD_ROOT
96}
看了这里的逻辑才恍然大悟，难怪只是设置ro.secure的值没用，真的需要判断的条件是__android_log_is_debuggable()和service.adb.root属性值。
真丶解决方案
/system/core/liblog/properties.c
280LIBLOG_ABI_PUBLIC int __android_log_is_debuggable() {
281 static uint32_t serial;
282 static struct cache_char tag_cache;
283 static const char key[] = "ro.debuggable";
284 int ret;
285
286 if (tag_cache.c) { /* ro property does not change after set */
287 ret = tag_cache.c == '1';
288 } else if (lock()) {
289 struct cache_char temp_cache = { { NULL, -1 }, '\0' };
290 refresh_cache(&temp_cache, key);
291 ret = temp_cache.c == '1';
292 } else {
293 int change_detected = check_cache(&tag_cache.cache);
294 uint32_t current_serial = __system_property_area_serial();
295 if (current_serial != serial) {
296 change_detected = 1;
297 }
298 if (change_detected) {
299 refresh_cache(&tag_cache, key);
300 serial = current_serial;
301 }
302 ret = tag_cache.c == '1';
303
304 unlock();
305 }
306
307 return ret;
308}
然后查一下service.adb.root属性值的初始化
****@****:~/work/mt8788_9$ grep -inr "service.adb.root" system/core/adb/
system/core/adb/daemon/main.cpp:81: std::string prop = android::base::GetProperty("service.adb.root", "");
system/core/adb/services.cpp:87: android::base::SetProperty("service.adb.root", "1");
system/core/adb/services.cpp:98: android::base::SetProperty("service.adb.root", "0");
/system/core/adb/services.cpp
void restart_root_service(int fd, void *cookie) {
if (getuid() == 0) {
WriteFdExactly(fd, "adbd is already running as root\n");
adb_close(fd);
} else {
if (!__android_log_is_debuggable()) {
WriteFdExactly(fd, "adbd cannot run as root in production builds\n");
adb_close(fd);
return;
}
android::base::SetProperty("service.adb.root", "1");
WriteFdExactly(fd, "restarting adbd as root\n");
adb_close(fd);
}
}
void restart_unroot_service(int fd, void *cookie) {
if (getuid() != 0) {
WriteFdExactly(fd, "adbd not running as root\n");
adb_close(fd);
} else {
android::base::SetProperty("service.adb.root", "0");
WriteFdExactly(fd, "restarting adbd as non root\n");
adb_close(fd);
}
}
可以看到service.adb.root的属性值是动态设置的，判断条件也是__android_log_is_debuggable()方法
修改ro.debuggable的值
diff --git a/build/make/core/main.mk b/build/make/core/main.mk
index c2e0a82f04..14ca69b4a4 100755
--- a/build/make/core/main.mk
+++ b/build/make/core/main.mk
@@ -301,7 +301,7 @@ endif # !user_variant
ifeq (true,$(strip $(enable_target_debugging)))
# Target is more debuggable and adbd is on by default
- ADDITIONAL_DEFAULT_PROPERTIES += ro.debuggable=1
+ ADDITIONAL_DEFAULT_PROPERTIES += ro.debuggable=0
# Enable Dalvik lock contention logging.
ADDITIONAL_BUILD_PROPERTIES += dalvik.vm.lockprof.threshold=500
# Include the debugging/testing OTA keys in this build.
编译，烧机之后，验证功能
C:\Users\lc\Desktop
$ adb disconnect & adb connect 10.12.200.27:5555 & adb root & adb remount
disconnected everything
connected to 10.12.200.27:5555
Not running as root. Try "adb root" first.
C:\Users\lc\Desktop
$ adb install -r antutu_v8.4.8.apk
Performing Streamed Install
adb: failed to install antutu_v8.4.8.apk: Failure [-9999: **** signature error for com.antutu.ABenchMark]
注：-9999是增加的第三方验签功能，这里无关紧要。
root功能失效，应用安装功能等保留，问题解决。
总结
遇事多看看源码，看源码之前，看看大佬的博客，有助于我们阅读源码
ADB(二)_ADBD_main()函数代码梳理
ADB(三)_ADBD_adbd_main()函数代码梳理
ADB(四)_host端的启动流程代码梳理
版权声明：本文为qq_15347925原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。