[SuperR Kitchen] Captain_Throwback:
set_metadata problems

[MENTION=5787964]SuperR.[/MENTION]

So some devs and I (@LeeDroid, [MENTION=1186202]baadnewz[/MENTION], [MENTION=2605798]nkk71[/MENTION], [MENTION=4905624]j to the 4n[/MENTION], [MENTION=506238]OMJ[/MENTION]) have been working on figuring out why Advanced Calling isn't working on Kitchen-built ROMs for the HTC 10. After weeks of investigation, we were finally able to determine that this issue is the set_metadata lines that the kitchen is creating. It seems that with Nougat, the SELinux rules are much more strict, and require that the files all have the correct uid, gid, mode, capabilities & context set in order to fucntion properly.

Currently, the Kitchen assigns SELinux context using the file_contexts from the boot.img. I believe this is fine. However one item that seems to be set generic is "capabilities." After much research, we were able to determine that the "getcap" binary can be used to determine the proper capabilities that a binary should be assigned. This seems to work fine if a stock system image is available and can be loop mounted. "getcap -r /system" seems to do the trick for listing any files with additional capabilities that need to be specified. In our case, the important files were related to "ims" for Advanced Calling features. If you could find a way to assign the capabilities automatically, that would be great. The reference I used came from the kernel source for my device, uploaded here. Starting on this line, you can see the capabilities described, along with an integer that should be used to specify them. The tricky part was figuring out how to convert that into the hex value that goes on the "set_metadata" line. [MENTION=3088420]tbalden[/MENTION] was able to figure out that it should be 2 to the power of the integer specified in capability.h, converted to hex. For multiple capabilities, 2 to the power of each integer should be calculated, and then combined and converted to hex. For example:

throwback@QuadCore-SSD-BuildBox:~$ getcap -r '/media/throwback/system'
/media/throwback/system/bin/ims_rtp_daemon = cap_net_bind_service+ep
/media/throwback/system/bin/imsdatadaemon = cap_net_bind_service+ep
/media/throwback/system/bin/pm-service = cap_net_bind_service+ep
/media/throwback/system/bin/run-as = cap_setgid,cap_setuid+ep
/media/throwback/system/bin/wcnss_filter = cap_block_suspend+ep
throwback@QuadCore-SSD-BuildBox:~$

Looking at the first 3 files listed, the capabilities are cap_net_bind_service (the +ep doesn't appear to be relevant/important). According to capability.h, the value for that is 10.

So:

2 to the power of 10 = 1024

1024 converted to hex = 400

Thus the capabilities for these binaries would be "0x400".

For multiple capabilities, such as for run-as, the extra step of combining the amounts is necessary, but the remaining steps are the same:

2^6 = 64, 2^7 = 128; 64 + 128 = 192

192 converted to hex = c0

Thus the capability for run-as would be "0xc0".

Additionally, we determined that the uid and gid weren't being set based on the values from the stock system image. In several cases, the "basic" uid/gid combination of root (0) and shell (2000) were being used, while the actual values should be either system (1000) or something else, like radio (1001) or bluetooth (1002). Performing an "ls -lZa" should give you all of the details needed to apply the proper uid/gid information, as well a the correct permissions (some of these were wrong too).

Here's a link to my pastebin of the corrected set_metadata lines for the HTC 10, running software version 2.38.617.6. The RUU for said version can be found here, if you want to compare what the Kitchen currently applies to the files, and what's working. Thanks again for providing such an awesome tool for all of us to use. We appreciate all your hard work on it, and hope you can help us with this!

EDIT: Here's a link to the capability.h in the latest Android source. That would be the best place to get a current list from, of course :).

EDIT 2: Or better yet, in this folder, the android_filesystem_capability.h lists all of the capabilities, and the android_filesystem_config.h lists all the uid/gid values.