Restore the INET group patch on the manager's original gid array - #795
Open
JingMatrix wants to merge 1 commit into
Open
Restore the INET group patch on the manager's original gid array#795JingMatrix wants to merge 1 commit into
JingMatrix wants to merge 1 commit into
Conversation
The parasitic manager lives inside com.android.shell, and uid 2000 has
no INTERNET permission before Android 12, so we grant it ourselves: the
zygisk module appends the INET group to the gid array in
preAppSpecialize.
That is enough for setgroups(), but not for everything. As soon as
nativeForkAndSpecialize returns, Zygote#forkAndSpecialize runs
NetworkUtils.setAllowNetworkingForProcess(containsInetGid(gids));
against the array it passed in, which is not the one we substituted, so
it concludes that we have no network access. The flag it sets lives in
libnetd_client and gates the process from the inside: with it off,
dns_open_proxy() and socket() return EPERM whatever groups we really
belong to. getaddrinfo then falls back to local resolution, fails as
EAI_NODATA with errno EPERM, and libcore turns that into "Permission
denied (missing INTERNET permission?)". The unchecked SecurityException
kills the OkHttp dispatcher thread and the manager with it.
LSPosed patched the caller's array too, ever since the commit that
introduced the parasitic manager, and I dropped that one line while
rewriting the module for the new zygisk architecture. Nothing broke on
Android 12 and later because com.android.shell gained INTERNET there,
so the gid array already carries the group and our patching is
redundant. On Android 11 and below it is the only thing that works.
Fixes #636
Owner
Author
|
The history of this line, for the record:
The line never carried a comment saying what it was for, which is probably why it looked redundant to me at the time. It has one now. |
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The manager runs inside
com.android.shell, which has no INTERNET permission before Android 12, so we add the INET group ourselves during zygote specialization. We were patching only the gid array that the native specialization uses; the array Java keeps holding is the oneZygote#forkAndSpecializereads a moment later to decide whether the process is allowed to use the network. It still said no, so every socket and DNS query inside the manager failed withEPERM, which surfaces asSecurityException: Permission denied (missing INTERNET permission?).LSPosed patched both arrays ever since the parasitic manager was introduced, and I dropped that line while rewriting the module for the new zygisk architecture. Android 12 and later were never affected, because
com.android.shelldeclares INTERNET there and the gid array already carries the group.This is still a hypothesis until it is confirmed on a device. If it holds, it should also explain the empty Repository tab: the manager simply had no network at all.
Fixes #636