Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(dalvikvm): bypass W^X restriction #138

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Conversation

twaik
Copy link
Member

@twaik twaik commented Oct 22, 2024

@agnostic-apollo
Copy link
Member

  1. Assuming this is actually working, random paths outside of Termux rootfs MUST NOT be automatically assumed to be safe and returned as non-writable, especially ones on sd card.

    int access_syscall(const char *path, int mode);
    
    __attribute__((visibility("default")))
    int access(const char *path, int mode) {
        if (mode == W_OK && path != null) {
            char canonical_path[PATH_MAX];
            if (canonicalize((char *)path, canonical_path, PATH_MAX) < 0) {
                //strerror error out with "Bad pathname"
                return -1;
            }
    
            if (string_ends_with(canonical_path, ".apk") || string_ends_with(canonical_path, ".dex")) {
                int is_file_under_termux_rootfs_dir = is_path_in_dir_path("termux_rootfs_dir", canonical_path, TERMUX_BASE_DIR, true);
                if (is_file_under_termux_rootfs_dir < 0) {
                    return -1;
                }
    
                if (is_file_under_termux_rootfs_dir == 0) {
                    return 1;
                }
            }
        }
    
        // Call the original access function for other cases.
        return access_syscall(path, mode);
    }
    
    int access_syscall(const char *path, int mode) {
        return syscall(SYS_access, path, mode);
    }

    You can get called functions from following links. Can replace logger calls with manual print calls if required.

    Should likely be able to use syscall instead of dlsym as termux-exec does.

  2. Compile library with -fvisibility=hidden and add __attribute__((visibility("default"))) manually to any functions that should be exported, like access().

  3. Rename library to libtermux-dexfile.

  4. Add -DTERMUX_BASE_DIR to Makefile, ideally should be read dynamically as termux-exec pull, but can be done later.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

ecj error: dalvikvm: Abort
2 participants