AndroidのLinuxレイヤの調査ログ

Pixel 3 XL + Android 9でのログ。

## apkが実機上でどう展開されるか

```
crosshatch:/ $ su -
crosshatch:/ # uname -a
Linux localhost 4.9.148-g695fa5606dab-ab5636409 #0 SMP PREEMPT Wed Jun 5 22:19:52 UTC 2019 aarch64
crosshatch:/ # ls -laR /data/app/com.facebook.katana-oPfDPj_DOJvWbtaBHf6sLg==
/data/app/com.facebook.katana-oPfDPj_DOJvWbtaBHf6sLg==:
total 60105
drwxr-xr-x  4 system system      3488 2019-10-10 19:13 .
drwxrwx--x 48 system system      8192 2019-10-16 22:51 ..
-rw-r--r--  1 system system  61465069 2019-10-10 19:13 base.apk
drwxr-xr-x  3 system system      3488 2019-10-10 19:13 lib
drwxrwx--x  3 system install     3488 2019-10-10 19:13 oat

/data/app/com.facebook.katana-oPfDPj_DOJvWbtaBHf6sLg==/lib:
total 9
drwxr-xr-x 3 system system 3488 2019-10-10 19:13 .
drwxr-xr-x 4 system system 3488 2019-10-10 19:13 ..
drwxr-xr-x 2 system system 3488 2019-10-10 19:13 arm64

/data/app/com.facebook.katana-oPfDPj_DOJvWbtaBHf6sLg==/lib/arm64:
total 1510
drwxr-xr-x 2 system system    3488 2019-10-10 19:13 .
drwxr-xr-x 3 system system    3488 2019-10-10 19:13 ..
-rwxr-xr-x 1 system system   14424 1981-02-02 06:42 libbreakpad_cpp_helper.so
-rwxr-xr-x 1 system system   68584 1981-02-02 06:42 libdistract.so
-rwxr-xr-x 1 system system   68040 1981-02-02 06:42 libfb_xzdecoder.so
-rwxr-xr-x 1 system system   67928 1981-02-02 06:42 libforce_dlopen.so
-rwxr-xr-x 1 system system 1104416 1981-02-02 06:42 libgnustl_shared.so
-rwxr-xr-x 1 system system   69056 1981-02-02 06:42 libsigmux.so
-rwxr-xr-x 1 system system   68048 1981-02-02 06:42 libterminate_handler_manager.so
-rwxr-xr-x 1 system system   68904 1981-02-02 06:42 libtorque.so

/data/app/com.facebook.katana-oPfDPj_DOJvWbtaBHf6sLg==/oat:
total 9
drwxrwx--x 3 system install 3488 2019-10-10 19:13 .
drwxr-xr-x 4 system system  3488 2019-10-10 19:13 ..
drwxrwx--x 2 system install 3488 2019-10-10 19:13 arm64

/data/app/com.facebook.katana-oPfDPj_DOJvWbtaBHf6sLg==/oat/arm64:
total 81186
drwxrwx--x 2 system install      3488 2019-10-10 19:13 .
drwxrwx--x 3 system install      3488 2019-10-10 19:13 ..
-rw-r--r-- 1 system all_a150   237568 2019-10-10 19:14 base.art
-rw-r--r-- 1 system all_a150  2038680 2019-10-10 19:13 base.odex
-rw-r--r-- 1 system all_a150 80767452 2019-10-10 19:14 base.vdex
crosshatch:/ #
```

大昔と比べると `*.apk` が置かれるパスの形式が変わったかも？ハッシュ値かランダム値かわからないけど、セキュリティ対策だろうか。

`*.so` が `lib/[arch]/` 以下に置かれるのはAndroid4あたりから変わっていない。

`oat/` 以下のファイルはART絡みだろうけど、Dalvik VMの頃の `*.dex` に当たるファイルが `*.odex` `*.vdex` なのだろうか？あとで調べる。

## ファイルシステム

```
crosshatch:/ # mount
/dev/root on / type ext4 (ro,seclabel,relatime,block_validity,delalloc,barrier,user_xattr)
tmpfs on /sbin type tmpfs (rw,seclabel,relatime,size=1797420k,nr_inodes=449355,mode=755)
/sbin/.magisk/block/system_root on /sbin/.magisk/mirror/system_root type ext4 (ro,seclabel,relatime,block_validity,delalloc,barrier,user_xattr)
/sbin/.magisk/block/system_root on /sbin/charger type ext4 (ro,seclabel,relatime,block_validity,delalloc,barrier,user_xattr)
tmpfs on /dev type tmpfs (rw,seclabel,nosuid,relatime,size=1797420k,nr_inodes=449355,mode=755)
devpts on /dev/pts type devpts (rw,seclabel,relatime,mode=600,ptmxmode=000)
proc on /proc type proc (rw,relatime,gid=3009,hidepid=2)
sysfs on /sys type sysfs (rw,seclabel,relatime)
selinuxfs on /sys/fs/selinux type selinuxfs (rw,relatime)
tmpfs on /mnt type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,size=1797420k,nr_inodes=449355,mode=755,gid=1000)
/dev/block/dm-0 on /product type ext4 (ro,seclabel,relatime,block_validity,delalloc,barrier,user_xattr)
/dev/block/dm-1 on /vendor type ext4 (ro,seclabel,relatime,block_validity,discard,delalloc,barrier,user_xattr)
none on /acct type cgroup (rw,nosuid,nodev,noexec,relatime,cpuacct)
none on /dev/memcg type cgroup (rw,nosuid,nodev,noexec,relatime,memory)
debugfs on /sys/kernel/debug type debugfs (rw,seclabel,relatime)
/dev/block/sdf2 on /mnt/vendor/persist type ext4 (rw,seclabel,nosuid,nodev,noatime,data=ordered)
none on /dev/stune type cgroup (rw,nosuid,nodev,noexec,relatime,schedtune)
none on /config type configfs (rw,nosuid,nodev,noexec,relatime)
none on /dev/cpuctl type cgroup (rw,nosuid,nodev,noexec,relatime,cpu)
none on /dev/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset,noprefix,release_agent=/sbin/cpuset_release_agent)
cg2_bpf on /dev/cg2_bpf type cgroup2 (rw,nosuid,nodev,noexec,relatime)
bpf on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,relatime)
tracefs on /sys/kernel/debug/tracing type tracefs (rw,seclabel,relatime)
/dev/block/sda20 on /metadata type ext4 (rw,seclabel,nosuid,nodev,noatime,discard,data=ordered)
/dev/block/sda13 on /vendor/firmware_mnt type vfat (ro,context=u:object_r:firmware_file:s0,relatime,uid=1000,gid=1000,fmask=0337,dmask=0227,codepage=437,iocharset=iso8859-1,shortname=lower,errors=remount-ro)
tmpfs on /storage type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,size=1797420k,nr_inodes=449355,mode=755,gid=1000)
/dev/block/dm-2 on /data type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,alloc_mode=default)
/sbin/.magisk/block/product on /sbin/.magisk/mirror/product type ext4 (ro,seclabel,relatime,block_validity,delalloc,barrier,user_xattr)
/sbin/.magisk/block/vendor on /sbin/.magisk/mirror/vendor type ext4 (ro,seclabel,relatime,block_validity,discard,delalloc,barrier,user_xattr)
/sbin/.magisk/block/data on /sbin/.magisk/mirror/data type f2fs (rw,lazytime,seclabel,relatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,alloc_mode=default)
/sbin/.magisk/block/data on /sbin/.magisk/modules type f2fs (rw,lazytime,seclabel,relatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,alloc_mode=default)
adb on /dev/usb-ffs/adb type functionfs (rw,relatime)
mtp on /dev/usb-ffs/mtp type functionfs (rw,relatime)
ptp on /dev/usb-ffs/ptp type functionfs (rw,relatime)
/data/media on /mnt/runtime/default/emulated type sdcardfs (rw,nosuid,nodev,noexec,noatime,fsuid=1023,fsgid=1023,gid=1015,multiuser,mask=6,derive_gid,default_normal)
/data/media on /storage/emulated type sdcardfs (rw,nosuid,nodev,noexec,noatime,fsuid=1023,fsgid=1023,gid=1015,multiuser,mask=6,derive_gid,default_normal)
/data/media on /mnt/runtime/read/emulated type sdcardfs (rw,nosuid,nodev,noexec,noatime,fsuid=1023,fsgid=1023,gid=9997,multiuser,mask=23,derive_gid,default_normal)
/data/media on /mnt/runtime/write/emulated type sdcardfs (rw,nosuid,nodev,noexec,noatime,fsuid=1023,fsgid=1023,gid=9997,multiuser,mask=7,derive_gid,default_normal)
pstore on /sys/fs/pstore type pstore (rw,seclabel,relatime)
crosshatch:/ # df
Filesystem                      1K-blocks    Used Available Use% Mounted on
tmpfs                             1797420    6256   1791164   1% /sbin
/sbin/.magisk/block/system_root   2836724 2211392    625332  78% /sbin/.magisk/mirror/system_root
tmpfs                             1797420     600   1796820   1% /dev
tmpfs                             1797420       0   1797420   0% /mnt
/dev/block/sdf2                     35568   15728     19840  45% /mnt/vendor/persist
/dev/block/sda20                    11760      80     11680   1% /metadata
/dev/block/sda13                    81872   71088     10784  87% /vendor/firmware_mnt
/sbin/.magisk/block/product        292776  194492     98284  67% /sbin/.magisk/mirror/product
/sbin/.magisk/block/vendor         772828  445068    327760  58% /sbin/.magisk/mirror/vendor
/sbin/.magisk/block/data        116570092 6884504 109685588   6% /sbin/.magisk/mirror/data
/data/media                     116570092 6884504 109685588   6% /mnt/runtime/default/emulated
crosshatch:/ # readlink -f /sdcard
/storage/emulated/0
```

`/sdcard` 以下はsdcardfs。

`/data`以下はext4だが、Magisk (rooted用ツール) がラップしているようで、本来どうなっているかは別の環境で確認した方がよさそう。

## 参考URL

- [「SDカード向け」ではないSDCardFSの正体 \- Gentoo metalog](http://gentoo.hatenablog.com/entry/2017/01/21/051231)