宣告

• 其實很好奇Android系統中的一些關鍵守護程序服務的作用；
• 暫且大概分析下它們的作用，這樣有助於理解整個系統的工作過程；
• ADB本身也是個複雜的系統，最近在處理ADB相關的修改工作，後續相關adbd的會再新增進來；

0 寫在前面的

• 只要是作業系統，不用說的就是其中肯定會執行著一些很多守護程序（daemon）來完成很多雜亂的工作。通過系統中的init.rc檔案也可以看出來，其中每個service中就包含著系統後臺服務程序。
• 而這些服務被分為：core類服務（adbd/servicemanager/healthd/lmkd/logd/vold）和main類服務；
• main類服務又分為：網路類服務（netd/mdnsd/mtpd/rild）、圖形及媒體類服務（surfaceflinger/bootanimation/mediaserver/dnnserver）、其他類服務（installd/keystore/debuggerd/sdcard/Zygote）

1 adbd的作用

        

    adbd是Android系統特有的ADB功能中執行在手機/平板端的守護程序，其在/init.usb.rc中的啟動配置為：

# adbd is controlled via property triggers in init.<platform>.usb.rc
service adbd /sbin/adbd --root_seclabel=u:r:su:s0
    class core
    socket adbd stream 660 system system
    disabled
    seclabel u:r:adbd:s0

    除錯者可以直接在PC上使用adb命令對裝置進行除錯，也可以通過ddms命令間接除錯。在除錯之前，要在系統開發者模式中開啟“USB除錯”的開關，其在底層其實是通過修改系統屬性sys.usb.config的值為adb時開啟的。

    在預設情況下，adbd是以uid root的許可權啟動的。不過它確實還會通過函式drop_privileges()主動把自己降到uid shell : shell，和幾個GID許可權，所在原始碼目錄為：~/LineageOS/system/core/adb/daemon/main.cpp

static void drop_privileges(int server_port) {
    std::unique_ptr<minijail, void (*)(minijail*)> jail(minijail_new(),
                                                        &minijail_destroy);

    // Add extra groups:
    // AID_ADB to access the USB driver
    // AID_LOG to read system logs (adb logcat)
    // AID_INPUT to diagnose input issues (getevent)
    // AID_INET to diagnose network issues (ping)
    // AID_NET_BT and AID_NET_BT_ADMIN to diagnose bluetooth (hcidump)
    // AID_SDCARD_R to allow reading from the SD card
    // AID_SDCARD_RW to allow writing to the SD card
    // AID_NET_BW_STATS to read out qtaguid statistics
    // AID_READPROC for reading /proc entries across UID boundaries
    gid_t groups[] = {AID_ADB,      AID_LOG,       AID_INPUT,
                      AID_INET,     AID_NET_BT,    AID_NET_BT_ADMIN,
                      AID_SDCARD_R, AID_SDCARD_RW, AID_NET_BW_STATS,
                      AID_READPROC};
    minijail_set_supplementary_gids(jail.get(),
                                    sizeof(groups) / sizeof(groups[0]),
                                    groups);

    // Don't listen on a port (default 5037) if running in secure mode.
    // Don't run as root if running in secure mode.
    if (should_drop_privileges()) {
        drop_capabilities_bounding_set_if_needed();

        minijail_change_gid(jail.get(), AID_SHELL);
        minijail_change_uid(jail.get(), AID_SHELL);
        // minijail_enter() will abort if any priv-dropping step fails.
        minijail_enter(jail.get());

        D("Local port disabled");
    } else {
        // minijail_enter() will abort if any priv-dropping step fails.
        minijail_enter(jail.get());

        if (root_seclabel != nullptr) {
            if (selinux_android_setcon(root_seclabel) < 0) {
                LOG(FATAL) << "Could not set SELinux context";
            }
        }
        std::string error;
        std::string local_name =
            android::base::StringPrintf("tcp:%d", server_port);
        if (install_listener(local_name, "*smartsocket*", nullptr, 0,
                             &error)) {
            LOG(FATAL) << "Could not install *smartsocket* listener: "
                       << error;
        }
    }
}
 

    在user-debug版本的系統中(系統屬性為ro.debuggable=0)，還可以通過adb root命令讓adbd恢復root許可權（通過修改系統屬性service.adb.root=1）。adb作用不用多說，檢視他的help即可：

C:\Users\Administrator\Desktop\platform-tools>adb.exe --help
Android Debug Bridge version 1.0.40
Version 4986621
Installed as C:\Users\Administrator\Desktop\platform-tools\adb.exe

global options:
 -a         listen on all network interfaces, not just localhost
 -d         use USB device (error if multiple devices connected)
 -e         use TCP/IP device (error if multiple TCP/IP devices available)
 -s SERIAL  use device with given serial (overrides $ANDROID_SERIAL)
 -t ID      use device with given transport id
 -H         name of adb server host [default=localhost]
 -P         port of adb server [default=5037]
 -L SOCKET  listen on given socket for adb server [default=tcp:localhost:5037]

general commands:
 devices [-l]             list connected devices (-l for long output)
 help                     show this help message
 version                  show version num

networking:
 connect HOST[:PORT]      connect to a device via TCP/IP [default port=5555]
 disconnect [HOST[:PORT]]
     disconnect from given TCP/IP device [default port=5555], or all
 forward --list           list all forward socket connections
 forward [--no-rebind] LOCAL REMOTE
     forward socket connection using:
       tcp:<port> (<local> may be "tcp:0" to pick any open port)
       localabstract:<unix domain socket name>
       localreserved:<unix domain socket name>
       localfilesystem:<unix domain socket name>
       dev:<character device name>
       jdwp:<process pid> (remote only)
 forward --remove LOCAL   remove specific forward socket connection
 forward --remove-all     remove all forward socket connections
 ppp TTY [PARAMETER...]   run PPP over USB
 reverse --list           list all reverse socket connections from device
 reverse [--no-rebind] REMOTE LOCAL
     reverse socket connection using:
       tcp:<port> (<remote> may be "tcp:0" to pick any open port)
       localabstract:<unix domain socket name>
       localreserved:<unix domain socket name>
       localfilesystem:<unix domain socket name>
 reverse --remove REMOTE  remove specific reverse socket connection
 reverse --remove-all     remove all reverse socket connections from device

file transfer:
 push [--sync] LOCAL... REMOTE
     copy local files/directories to device
     --sync: only push files that are newer on the host than the device
 pull [-a] REMOTE... LOCAL
     copy files/dirs from device
     -a: preserve file timestamp and mode
 sync [all|data|odm|oem|product|system|vendor]
     sync a local build from $ANDROID_PRODUCT_OUT to the device (default all)
     -l: list but don't copy

shell:
 shell [-e ESCAPE] [-n] [-Tt] [-x] [COMMAND...]
     run remote shell command (interactive shell if no command given)
     -e: choose escape character, or "none"; default '~'
     -n: don't read from stdin
     -T: disable PTY allocation
     -t: force PTY allocation
     -x: disable remote exit codes and stdout/stderr separation
 emu COMMAND              run emulator console command

app installation:
 install [-lrtsdg] [--instant] PACKAGE
 install-multiple [-lrtsdpg] [--instant] PACKAGE...
     push package(s) to the device and install them
     -l: forward lock application
     -r: replace existing application
     -t: allow test packages
     -s: install application on sdcard
     -d: allow version code downgrade (debuggable packages only)
     -p: partial application install (install-multiple only)
     -g: grant all runtime permissions
     --instant: cause the app to be installed as an ephemeral install app
 uninstall [-k] PACKAGE
     remove this app package from the device
     '-k': keep the data and cache directories

backup/restore:
   to show usage run "adb shell bu help"

debugging:
 bugreport [PATH]
     write bugreport to given PATH [default=bugreport.zip];
     if PATH is a directory, the bug report is saved in that directory.
     devices that don't support zipped bug reports output to stdout.
 jdwp                     list pids of processes hosting a JDWP transport
 logcat                   show device log (logcat --help for more)

security:
 disable-verity           disable dm-verity checking on userdebug builds
 enable-verity            re-enable dm-verity checking on userdebug builds
 keygen FILE
     generate adb public/private key; private key stored in FILE,
     public key stored in FILE.pub (existing files overwritten)

scripting:
 wait-for[-TRANSPORT]-STATE
     wait for device to be in the given state
     State: device, recovery, sideload, or bootloader
     Transport: usb, local, or any [default=any]
 get-state                print offline | bootloader | device
 get-serialno             print <serial-number>
 get-devpath              print <device-path>
 remount                  remount partitions read-write
 reboot [bootloader|recovery|sideload|sideload-auto-reboot]
     reboot the device; defaults to booting system image but
     supports bootloader and recovery too. sideload reboots
     into recovery and automatically starts sideload mode,
     sideload-auto-reboot is the same but reboots after sideloading.
 sideload OTAPACKAGE      sideload the given full OTA package
 root                     restart adbd with root permissions
 unroot                   restart adbd without root permissions
 usb                      restart adb server listening on USB
 tcpip PORT               restart adb server listening on TCP on PORT

internal debugging:
 start-server             ensure that there is a server running
 kill-server              kill the server if it is running
 reconnect                kick connection from host side to force reconnect
 reconnect device         kick connection from device side to force reconnect
 reconnect offline        reset offline/unauthorized devices to force reconnect

environment variables:
 $ADB_TRACE
     comma-separated list of debug info to log:
     all,adb,sockets,packets,rwx,usb,sync,sysdeps,transport,jdwp
 $ADB_VENDOR_KEYS         colon-separated list of keys (files or directories)
 $ANDROID_SERIAL          serial number to connect to (see -s)
 $ANDROID_LOG_TAGS        tags to be used by logcat (see logcat --help)

2 ADB的安全認證

    由於ADB這個介面具有功能非常強大的除錯和跟蹤功能，儘管它是以shell這個uid的身份執行，但由於shell這個uid是好幾個組（log、graphic等）的成員，這也使得它具有很強的能力。使用ADB可以訪問到使用者的個人資料，也能把任意APP、Native層可執行檔案上傳到裝置中。因此，在Android 4.3 以後的Android系統中引入了公鑰認證機制（前提是ro.adb.secure=1時），把ADB的安全性進一步提升。

    AUTH訊息將作為對OPEN訊息的響應，傳送到電腦端，要求在其執行任何命令之前，先完成認證。AUTH訊息的引數總是一個TOKEN，它是由移動裝置中的隨機數發生器(/dev/urandom）生成的一個大小為20個位元組的隨機數陣列。移動裝置端將等待電腦端用自己的私鑰（該私鑰應該己經生成，並存放在$HOME/.android/adbkey這個檔案中）對這個TOKEN 進行簽名，然後回覆一個AUTH SIGNATURE訊息，把用私鑰簽名過的隨機數陣列放在這個訊息裡返回給移動裝置端。如果移動裝置知道相應的公鑰，那麼驗證就能繼續，而且如過驗證通過了，該會話就會切換到online狀態上去。

    因為所有這一切都依賴於公鑰，這就產生了一個先有雞還是先有蛋的問題：怎麼讓移動端事先就知道這個公鑰，並將其用於驗證呢？解決方案是允許電腦端響應一個AUTHRSAPUBLICKEY訊息。因為此時這個公鑰是不可信的，ADB將把這個公鑰通過/dev/socket/adbd這個UDS傳遞給system_server（特別是由com.android.server.usb.UsbDeviceManager啟動的UsbDebuggingManager ），然後，system_server將會彈出一個對話方塊(com.android.server.usb.UsbDebuggingActivity），要求使用者確認該公鑰的指紋（MD5 Hash）。如果使用者選擇信任該公鑰，這個公鑰就會被新增到adb的key store（位於／data/misc/adb/adb_key)中去。作為廠商的話可以重新編譯adbd，刪掉這一功能（相關程式碼位於adb_auth_client.c中的adb_auth_confirm_key()函式中），所在原始碼目錄：~/LineageOS/system/core/adb/adb_auth_client.cpp

void adb_auth_confirm_key(unsigned char *key, size_t len, atransport *t)
{
    char msg[MAX_PAYLOAD_V1];
    int ret;

    if (!usb_transport) {
        usb_transport = t;
        t->AddDisconnect(&usb_disconnect);
    }

    if (framework_fd < 0) {
        D("Client not connected");
        needs_retry = true;
        return;
    }

    if (key[len - 1] != '\0') {
        D("Key must be a null-terminated string");
        return;
    }

    ret = snprintf(msg, sizeof(msg), "PK%s", key);
    if (ret >= (signed)sizeof(msg)) {
        D("Key too long. ret=%d", ret);
        return;
    }
    D("Sending '%s'", msg);

    ret = unix_write(framework_fd, msg, ret);
    if (ret < 0) {
        D("Failed to write PK, errno=%d", errno);
        return;
    }
}

    輸入dumpsys usb命令，你就能看到當前的USB除錯狀態以及當前使用的adb_keys，如下圖所示：

        

相關推薦