Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
M
Magisk
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
Magisk
Commits
31110b19
Commit
31110b19
authored
Apr 14, 2018
by
topjohnwu
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Major refactor on sepolicy
parent
21a557a1
Show whitespace changes
Inline
Side-by-side
Showing
2 changed files
with
93 additions
and
98 deletions
+93
-98
magiskpolicy.h
magiskpolicy.h
+2
-0
rules.c
rules.c
+91
-98
No files found.
magiskpolicy.h
View file @
31110b19
...
@@ -7,6 +7,8 @@
...
@@ -7,6 +7,8 @@
#include <stdlib.h>
#include <stdlib.h>
#define ALL NULL
#define ALL NULL
#define SEPOL_PROC_DOMAIN "magisk"
#define SEPOL_FILE_DOMAIN "magisk_file"
// policydb functions
// policydb functions
int
load_policydb
(
const
char
*
filename
);
int
load_policydb
(
const
char
*
filename
);
...
...
rules.c
View file @
31110b19
...
@@ -4,72 +4,72 @@
...
@@ -4,72 +4,72 @@
void
allowSuClient
(
char
*
target
)
{
void
allowSuClient
(
char
*
target
)
{
if
(
!
sepol_exists
(
target
))
if
(
!
sepol_exists
(
target
))
return
;
return
;
sepol_allow
(
target
,
"rootfs"
,
"file"
,
ALL
);
sepol_allow
(
target
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"connectto"
);
sepol_allow
(
target
,
"rootfs"
,
"lnk_file"
,
ALL
);
sepol_allow
(
target
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"getopt"
);
sepol_allow
(
target
,
"su"
,
"unix_stream_socket"
,
"connectto"
);
sepol_allow
(
target
,
"su"
,
"unix_stream_socket"
,
"getopt"
);
sepol_allow
(
target
,
"su_file"
,
"sock_file"
,
"read"
);
sepol_allow
(
target
,
"su_file"
,
"sock_file"
,
"write"
);
sepol_allow
(
target
,
"su_file"
,
"file"
,
ALL
);
sepol_allow
(
target
,
"su_file"
,
"dir"
,
ALL
);
sepol_allow
(
target
,
"devpts"
,
"chr_file"
,
"ioctl"
);
sepol_allow
(
target
,
"devpts"
,
"chr_file"
,
"ioctl"
);
sepol_allow
(
"su"
,
target
,
"fd"
,
"use"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
target
,
"fd"
,
"use"
);
sepol_allow
(
"su"
,
target
,
"fifo_file"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
target
,
"fifo_file"
,
ALL
);
// Allow access to magisk files
sepol_allow
(
target
,
SEPOL_FILE_DOMAIN
,
"sock_file"
,
"read"
);
sepol_allow
(
target
,
SEPOL_FILE_DOMAIN
,
"sock_file"
,
"write"
);
sepol_allow
(
target
,
SEPOL_FILE_DOMAIN
,
"file"
,
ALL
);
sepol_allow
(
target
,
SEPOL_FILE_DOMAIN
,
"dir"
,
ALL
);
}
}
void
suRights
()
{
void
suRights
()
{
sepol_allow
(
"servicemanager"
,
"su"
,
"dir"
,
"search"
);
sepol_allow
(
"servicemanager"
,
SEPOL_PROC_DOMAIN
,
"dir"
,
"search"
);
sepol_allow
(
"servicemanager"
,
"su"
,
"dir"
,
"read"
);
sepol_allow
(
"servicemanager"
,
SEPOL_PROC_DOMAIN
,
"dir"
,
"read"
);
sepol_allow
(
"servicemanager"
,
"su"
,
"file"
,
"open"
);
sepol_allow
(
"servicemanager"
,
SEPOL_PROC_DOMAIN
,
"file"
,
"open"
);
sepol_allow
(
"servicemanager"
,
"su"
,
"file"
,
"read"
);
sepol_allow
(
"servicemanager"
,
SEPOL_PROC_DOMAIN
,
"file"
,
"read"
);
sepol_allow
(
"servicemanager"
,
"su"
,
"process"
,
"getattr"
);
sepol_allow
(
"servicemanager"
,
SEPOL_PROC_DOMAIN
,
"process"
,
"getattr"
);
sepol_allow
(
"servicemanager"
,
"su"
,
"binder"
,
"transfer"
);
sepol_allow
(
"servicemanager"
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"transfer"
);
sepol_allow
(
"system_server"
,
"su"
,
"binder"
,
"call"
);
sepol_allow
(
"system_server"
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"call"
);
sepol_allow
(
"system_server"
,
"su"
,
"fd"
,
"use"
);
sepol_allow
(
"system_server"
,
SEPOL_PROC_DOMAIN
,
"fd"
,
"use"
);
sepol_allow
(
"su"
,
"servicemanager"
,
"dir"
,
"search"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"servicemanager"
,
"dir"
,
"search"
);
sepol_allow
(
"su"
,
"servicemanager"
,
"dir"
,
"read"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"servicemanager"
,
"dir"
,
"read"
);
sepol_allow
(
"su"
,
"servicemanager"
,
"file"
,
"open"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"servicemanager"
,
"file"
,
"open"
);
sepol_allow
(
"su"
,
"servicemanager"
,
"file"
,
"read"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"servicemanager"
,
"file"
,
"read"
);
sepol_allow
(
"su"
,
"servicemanager"
,
"process"
,
"getattr"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"servicemanager"
,
"process"
,
"getattr"
);
sepol_allow
(
"su"
,
"servicemanager"
,
"binder"
,
"transfer"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"servicemanager"
,
"binder"
,
"transfer"
);
sepol_allow
(
"su"
,
"servicemanager"
,
"binder"
,
"call"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"servicemanager"
,
"binder"
,
"call"
);
sepol_allow
(
"su"
,
"system_server"
,
"binder"
,
"transfer"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"system_server"
,
"binder"
,
"transfer"
);
sepol_allow
(
"su"
,
"system_server"
,
"binder"
,
"call"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"system_server"
,
"binder"
,
"call"
);
}
}
void
otherToSU
()
{
void
otherToSU
()
{
// allowLog
// allowLog
sepol_allow
(
"logd"
,
"su"
,
"dir"
,
"search"
);
sepol_allow
(
"logd"
,
SEPOL_PROC_DOMAIN
,
"dir"
,
"search"
);
sepol_allow
(
"logd"
,
"su"
,
"file"
,
"read"
);
sepol_allow
(
"logd"
,
SEPOL_PROC_DOMAIN
,
"file"
,
"read"
);
sepol_allow
(
"logd"
,
"su"
,
"file"
,
"open"
);
sepol_allow
(
"logd"
,
SEPOL_PROC_DOMAIN
,
"file"
,
"open"
);
sepol_allow
(
"logd"
,
"su"
,
"file"
,
"getattr"
);
sepol_allow
(
"logd"
,
SEPOL_PROC_DOMAIN
,
"file"
,
"getattr"
);
// suBackL0
// suBackL0
sepol_allow
(
"system_server"
,
"su"
,
"binder"
,
"call"
);
sepol_allow
(
"system_server"
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"call"
);
sepol_allow
(
"system_server"
,
"su"
,
"binder"
,
"transfer"
);
sepol_allow
(
"system_server"
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"transfer"
);
// ES Explorer opens a sokcet
// ES Explorer opens a sokcet
sepol_allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"ioctl"
);
sepol_allow
(
"untrusted_app"
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"ioctl"
);
sepol_allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"read"
);
sepol_allow
(
"untrusted_app"
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"read"
);
sepol_allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"getattr"
);
sepol_allow
(
"untrusted_app"
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"getattr"
);
sepol_allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"write"
);
sepol_allow
(
"untrusted_app"
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"write"
);
sepol_allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"setattr"
);
sepol_allow
(
"untrusted_app"
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"setattr"
);
sepol_allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"lock"
);
sepol_allow
(
"untrusted_app"
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"lock"
);
sepol_allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"append"
);
sepol_allow
(
"untrusted_app"
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"append"
);
sepol_allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"bind"
);
sepol_allow
(
"untrusted_app"
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"bind"
);
sepol_allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"connect"
);
sepol_allow
(
"untrusted_app"
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"connect"
);
sepol_allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"getopt"
);
sepol_allow
(
"untrusted_app"
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"getopt"
);
sepol_allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"setopt"
);
sepol_allow
(
"untrusted_app"
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"setopt"
);
sepol_allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"shutdown"
);
sepol_allow
(
"untrusted_app"
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"shutdown"
);
sepol_allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"connectto"
);
sepol_allow
(
"untrusted_app"
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"connectto"
);
// Any domain is allowed to send su "sigchld"
// Any domain is allowed to send su "sigchld"
sepol_allow
(
ALL
,
"su"
,
"process"
,
"sigchld"
);
sepol_allow
(
ALL
,
SEPOL_PROC_DOMAIN
,
"process"
,
"sigchld"
);
// uNetworkL0
// uNetworkL0
sepol_attradd
(
"su"
,
"netdomain"
);
sepol_attradd
(
SEPOL_PROC_DOMAIN
,
"netdomain"
);
sepol_attradd
(
"su"
,
"bluetoothdomain"
);
sepol_attradd
(
SEPOL_PROC_DOMAIN
,
"bluetoothdomain"
);
// suBackL6
// suBackL6
sepol_allow
(
"surfaceflinger"
,
"app_data_file"
,
"dir"
,
ALL
);
sepol_allow
(
"surfaceflinger"
,
"app_data_file"
,
"dir"
,
ALL
);
...
@@ -82,43 +82,36 @@ void otherToSU() {
...
@@ -82,43 +82,36 @@ void otherToSU() {
sepol_allow
(
"audioserver"
,
"audioserver"
,
"process"
,
"execmem"
);
sepol_allow
(
"audioserver"
,
"audioserver"
,
"process"
,
"execmem"
);
// Liveboot
// Liveboot
sepol_allow
(
"surfaceflinger"
,
"su"
,
"process"
,
"ptrace"
);
sepol_allow
(
"surfaceflinger"
,
SEPOL_PROC_DOMAIN
,
"process"
,
"ptrace"
);
sepol_allow
(
"surfaceflinger"
,
"su"
,
"binder"
,
"transfer"
);
sepol_allow
(
"surfaceflinger"
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"transfer"
);
sepol_allow
(
"surfaceflinger"
,
"su"
,
"binder"
,
"call"
);
sepol_allow
(
"surfaceflinger"
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"call"
);
sepol_allow
(
"surfaceflinger"
,
"su"
,
"fd"
,
"use"
);
sepol_allow
(
"surfaceflinger"
,
SEPOL_PROC_DOMAIN
,
"fd"
,
"use"
);
sepol_allow
(
"debuggerd"
,
"su"
,
"process"
,
"ptrace"
);
sepol_allow
(
"debuggerd"
,
SEPOL_PROC_DOMAIN
,
"process"
,
"ptrace"
);
// dumpsys
// dumpsys
sepol_allow
(
ALL
,
"su"
,
"fd"
,
"use"
);
sepol_allow
(
ALL
,
SEPOL_PROC_DOMAIN
,
"fd"
,
"use"
);
sepol_allow
(
ALL
,
"su"
,
"fifo_file"
,
"write"
);
sepol_allow
(
ALL
,
SEPOL_PROC_DOMAIN
,
"fifo_file"
,
"write"
);
sepol_allow
(
ALL
,
"su"
,
"fifo_file"
,
"read"
);
sepol_allow
(
ALL
,
SEPOL_PROC_DOMAIN
,
"fifo_file"
,
"read"
);
sepol_allow
(
ALL
,
"su"
,
"fifo_file"
,
"open"
);
sepol_allow
(
ALL
,
SEPOL_PROC_DOMAIN
,
"fifo_file"
,
"open"
);
sepol_allow
(
ALL
,
"su"
,
"fifo_file"
,
"getattr"
);
sepol_allow
(
ALL
,
SEPOL_PROC_DOMAIN
,
"fifo_file"
,
"getattr"
);
}
}
void
sepol_magisk_rules
()
{
void
sepol_magisk_rules
()
{
// First prevent anything to change sepolicy except ourselves
// First prevent anything to change sepolicy except ourselves
sepol_deny
(
ALL
,
"kernel"
,
"security"
,
"load_policy"
);
sepol_deny
(
ALL
,
"kernel"
,
"security"
,
"load_policy"
);
if
(
!
sepol_exists
(
"su"
))
if
(
!
sepol_exists
(
SEPOL_PROC_DOMAIN
))
sepol_create
(
"su"
);
sepol_create
(
SEPOL_PROC_DOMAIN
);
if
(
!
sepol_exists
(
"su_file"
))
if
(
!
sepol_exists
(
SEPOL_FILE_DOMAIN
))
sepol_create
(
"su_file"
);
sepol_create
(
SEPOL_FILE_DOMAIN
);
sepol_permissive
(
"su"
);
sepol_permissive
(
SEPOL_PROC_DOMAIN
);
sepol_attradd
(
"su"
,
"mlstrustedsubject"
);
sepol_attradd
(
SEPOL_PROC_DOMAIN
,
"mlstrustedsubject"
);
sepol_attradd
(
"su_file"
,
"mlstrustedobject"
);
sepol_attradd
(
SEPOL_FILE_DOMAIN
,
"mlstrustedobject"
);
// Allow magiskinit daemon to run and run in su context
sepol_allow
(
"kernel"
,
"device"
,
"dir"
,
ALL
);
sepol_allow
(
"kernel"
,
"device"
,
"file"
,
ALL
);
sepol_allow
(
"kernel"
,
"su"
,
"unix_stream_socket"
,
"connectto"
);
sepol_allow
(
"kernel"
,
"kernel"
,
"process"
,
"setcurrent"
);
sepol_allow
(
"kernel"
,
"su"
,
"process"
,
"dyntransition"
);
// Let init run stuffs
// Let init run stuffs
sepol_allow
(
"kernel"
,
"su"
,
"fd"
,
"use"
);
sepol_allow
(
"kernel"
,
SEPOL_PROC_DOMAIN
,
"fd"
,
"use"
);
sepol_allow
(
"init"
,
"su"
,
"process"
,
ALL
);
sepol_allow
(
"init"
,
SEPOL_PROC_DOMAIN
,
"process"
,
ALL
);
sepol_allow
(
"init"
,
"system_file"
,
"dir"
,
ALL
);
sepol_allow
(
"init"
,
"system_file"
,
"dir"
,
ALL
);
sepol_allow
(
"init"
,
"system_file"
,
"lnk_file"
,
ALL
);
sepol_allow
(
"init"
,
"system_file"
,
"lnk_file"
,
ALL
);
sepol_allow
(
"init"
,
"system_file"
,
"file"
,
ALL
);
sepol_allow
(
"init"
,
"system_file"
,
"file"
,
ALL
);
...
@@ -126,18 +119,19 @@ void sepol_magisk_rules() {
...
@@ -126,18 +119,19 @@ void sepol_magisk_rules() {
// Shell, properties, logs
// Shell, properties, logs
if
(
sepol_exists
(
"default_prop"
))
if
(
sepol_exists
(
"default_prop"
))
sepol_allow
(
"su"
,
"default_prop"
,
"property_service"
,
"set"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"default_prop"
,
"property_service"
,
"set"
);
sepol_allow
(
"su"
,
"init"
,
"unix_stream_socket"
,
"connectto"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"init"
,
"unix_stream_socket"
,
"connectto"
);
sepol_allow
(
"su"
,
"rootfs"
,
"filesystem"
,
"remount"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"rootfs"
,
"filesystem"
,
"remount"
);
if
(
sepol_exists
(
"logd"
))
if
(
sepol_exists
(
"logd"
))
sepol_allow
(
"su"
,
"logd"
,
"unix_stream_socket"
,
"connectto"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"logd"
,
"unix_stream_socket"
,
"connectto"
);
sepol_allow
(
"su"
,
"su"
,
ALL
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
SEPOL_PROC_DOMAIN
,
ALL
,
ALL
);
// For sepolicy live patching
// For sepolicy live patching
sepol_allow
(
"su"
,
"kernel"
,
"security"
,
"read_policy"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"kernel"
,
"security"
,
"read_policy"
);
sepol_allow
(
"su"
,
"kernel"
,
"security"
,
"load_policy"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"kernel"
,
"security"
,
"load_policy"
);
// Allow these client to access su
// Allow these client to access su
allowSuClient
(
"init"
);
allowSuClient
(
"shell"
);
allowSuClient
(
"shell"
);
allowSuClient
(
"untrusted_app"
);
allowSuClient
(
"untrusted_app"
);
allowSuClient
(
"system_app"
);
allowSuClient
(
"system_app"
);
...
@@ -151,26 +145,26 @@ void sepol_magisk_rules() {
...
@@ -151,26 +145,26 @@ void sepol_magisk_rules() {
otherToSU
();
otherToSU
();
// For mounting loop devices, mirrors, tmpfs
// For mounting loop devices, mirrors, tmpfs
sepol_allow
(
"su"
,
"kernel"
,
"process"
,
"setsched"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"kernel"
,
"process"
,
"setsched"
);
sepol_allow
(
"su"
,
"labeledfs"
,
"filesystem"
,
"mount"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"labeledfs"
,
"filesystem"
,
"mount"
);
sepol_allow
(
"su"
,
"labeledfs"
,
"filesystem"
,
"unmount"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"labeledfs"
,
"filesystem"
,
"unmount"
);
sepol_allow
(
"su"
,
"tmpfs"
,
"filesystem"
,
"mount"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"tmpfs"
,
"filesystem"
,
"mount"
);
sepol_allow
(
"su"
,
"tmpfs"
,
"filesystem"
,
"unmount"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"tmpfs"
,
"filesystem"
,
"unmount"
);
sepol_allow
(
"kernel"
,
ALL
,
"file"
,
"read"
);
sepol_allow
(
"kernel"
,
ALL
,
"file"
,
"read"
);
// Allow su to do anything to any files/dir/links
// Allow su to do anything to any files/dir/links
sepol_allow
(
"su"
,
ALL
,
"file"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"file"
,
ALL
);
sepol_allow
(
"su"
,
ALL
,
"dir"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"dir"
,
ALL
);
sepol_allow
(
"su"
,
ALL
,
"lnk_file"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"lnk_file"
,
ALL
);
sepol_allow
(
"su"
,
ALL
,
"blk_file"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"blk_file"
,
ALL
);
sepol_allow
(
"su"
,
ALL
,
"sock_file"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"sock_file"
,
ALL
);
sepol_allow
(
"su"
,
ALL
,
"chr_file"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"chr_file"
,
ALL
);
sepol_allow
(
"su"
,
ALL
,
"fifo_file"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"fifo_file"
,
ALL
);
// For changing attributes
// For changing attributes
sepol_allow
(
"rootfs"
,
"tmpfs"
,
"filesystem"
,
"associate"
);
sepol_allow
(
"rootfs"
,
"tmpfs"
,
"filesystem"
,
"associate"
);
sepol_allow
(
"su_file"
,
"labeledfs"
,
"filesystem"
,
"associate"
);
sepol_allow
(
SEPOL_FILE_DOMAIN
,
"labeledfs"
,
"filesystem"
,
"associate"
);
sepol_allow
(
"su_file"
,
"tmpfs"
,
"filesystem"
,
"associate"
);
sepol_allow
(
SEPOL_FILE_DOMAIN
,
"tmpfs"
,
"filesystem"
,
"associate"
);
// Xposed
// Xposed
sepol_allow
(
"untrusted_app"
,
"untrusted_app"
,
"capability"
,
"setgid"
);
sepol_allow
(
"untrusted_app"
,
"untrusted_app"
,
"capability"
,
"setgid"
);
...
@@ -185,4 +179,3 @@ void sepol_magisk_rules() {
...
@@ -185,4 +179,3 @@ void sepol_magisk_rules() {
sepol_allowxperm
(
"domain"
,
"untrusted_app_devpts"
,
"chr_file"
,
"0x5400-0x54FF"
);
sepol_allowxperm
(
"domain"
,
"untrusted_app_devpts"
,
"chr_file"
,
"0x5400-0x54FF"
);
}
}
}
}
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment