Commit 3b071116 authored by topjohnwu's avatar topjohnwu

Update magiskpolicy

- Generalize avtab node extraction and insertion
- Add new supported rules: type_change, type_member
- Update help message with official policy language
parent a9f265a5
...@@ -21,16 +21,6 @@ int sepol_auditdeny(const char *s, const char *t, const char *c, const char *p) ...@@ -21,16 +21,6 @@ int sepol_auditdeny(const char *s, const char *t, const char *c, const char *p)
return add_rule(s, t, c, p, AVTAB_AUDITDENY, 0); return add_rule(s, t, c, p, AVTAB_AUDITDENY, 0);
} }
int sepol_typetrans(const char *s, const char *t, const char *c, const char *d, const char *o) {
if (o == nullptr) {
// printf("add_trans %s %s %s %s\n", s, t, c ,d);
return add_transition(s, t, c, d);
} else {
// printf("add_file_trans %s %s %s %s %s\n", s, t, c ,d, o);
return add_file_transition(s, t, c, d, o);
}
}
int sepol_allowxperm(const char *s, const char *t, const char *c, const char *range) { int sepol_allowxperm(const char *s, const char *t, const char *c, const char *range) {
// printf("allowxperm %s %s %s %s\n", s, t, c, range); // printf("allowxperm %s %s %s %s\n", s, t, c, range);
return add_xperm_rule(s, t, c, range, AVTAB_XPERMS_ALLOWED, 0); return add_xperm_rule(s, t, c, range, AVTAB_XPERMS_ALLOWED, 0);
...@@ -46,6 +36,21 @@ int sepol_dontauditxperm(const char *s, const char *t, const char *c, const char ...@@ -46,6 +36,21 @@ int sepol_dontauditxperm(const char *s, const char *t, const char *c, const char
return add_xperm_rule(s, t, c, range, AVTAB_XPERMS_DONTAUDIT, 0); return add_xperm_rule(s, t, c, range, AVTAB_XPERMS_DONTAUDIT, 0);
} }
int sepol_typetrans(const char *s, const char *t, const char *c, const char *d) {
// printf("type_transition %s %s %s %s\n", s, t, c, d);
return add_type_rule(s, t, c, d, AVTAB_TRANSITION);
}
int sepol_typechange(const char *s, const char *t, const char *c, const char *d) {
// printf("type_change %s %s %s %s\n", s, t, c, d);
return add_type_rule(s, t, c, d, AVTAB_CHANGE);
}
int sepol_typemember(const char *s, const char *t, const char *c, const char *d) {
// printf("type_member %s %s %s %s\n", s, t, c, d);
return add_type_rule(s, t, c, d, AVTAB_MEMBER);
}
int sepol_permissive(const char *s) { int sepol_permissive(const char *s) {
// printf("permissive %s\n", s); // printf("permissive %s\n", s);
return set_domain_state(s, 1); return set_domain_state(s, 1);
......
...@@ -14,18 +14,20 @@ ...@@ -14,18 +14,20 @@
static const char *type_msg_1 = static const char *type_msg_1 =
"Type 1:\n" "Type 1:\n"
"\"<action> source-class target-class permission-class permission\"\n" "\"<rule_name> source_type target_type class perm_set\"\n"
"Action: allow, deny, auditallow, auditdeny\n"; "Rules: allow, deny, auditallow, auditdeny\n";
static const char *type_msg_2 = static const char *type_msg_2 =
"Type 2:\n" "Type 2:\n"
"\"<action> source-class target-class permission-class ioctl range\"\n" "\"<rule_name> source_type target_type class operation xperm_set\"\n"
"Action: allowxperm, auditallowxperm, dontauditxperm\n"; "Rules: allowxperm, auditallowxperm, dontauditxperm\n"
"* The only supported operation is ioctl\n"
"* The only supported xperm_set format is range ([low-high])\n";
static const char *type_msg_3 = static const char *type_msg_3 =
"Type 3:\n" "Type 3:\n"
"\"<action> class\"\n" "\"<rule_name> class\"\n"
"Action: create, permissive, enforcing\n"; "Rules: create, permissive, enforcing\n";
static const char *type_msg_4 = static const char *type_msg_4 =
"Type 4:\n" "Type 4:\n"
...@@ -33,7 +35,12 @@ static const char *type_msg_4 = ...@@ -33,7 +35,12 @@ static const char *type_msg_4 =
static const char *type_msg_5 = static const char *type_msg_5 =
"Type 5:\n" "Type 5:\n"
"\"typetrans source-class target-class permission-class default-class (optional: object-name)\"\n"; "\"<rule_name> source_type target_type class default_type\"\n"
"Rules: type_transition, type_change, type_member\n";
static const char *type_msg_6 =
"Type 6:\n"
"\"name_transition source_type target_type class default_type object_name\"\n";
[[noreturn]] static void statements() { [[noreturn]] static void statements() {
...@@ -42,9 +49,10 @@ static const char *type_msg_5 = ...@@ -42,9 +49,10 @@ static const char *type_msg_5 =
"this means a full policy statement should be enclosed in quotes;\n" "this means a full policy statement should be enclosed in quotes;\n"
"multiple policy statements can be provided in a single command\n" "multiple policy statements can be provided in a single command\n"
"\n" "\n"
"The statements has a format of \"<action> [args...]\"\n" "The statements has a format of \"<rule_name> [args...]\"\n"
"Use '*' in args to represent every possible match.\n" "Multiple types and permissions can be grouped into collections\n"
"Collections wrapped in curly brackets can also be used as args.\n" "wrapped in curly brackets.\n"
"'*' represents a collection containing all valid matches.\n"
"\n" "\n"
"Supported policy statements:\n" "Supported policy statements:\n"
"\n" "\n"
...@@ -53,20 +61,21 @@ static const char *type_msg_5 = ...@@ -53,20 +61,21 @@ static const char *type_msg_5 =
"%s\n" "%s\n"
"%s\n" "%s\n"
"%s\n" "%s\n"
"%s\n"
"Notes:\n" "Notes:\n"
"- typetrans does not support the all match '*' syntax\n" "* Type 4 - 6 does not support collections\n"
"- permission-class cannot be collections\n" "* Object classes cannot be collections\n"
"- source-class and target-class can also be attributes\n" "* source_type and target_type can also be attributes\n"
"\n" "\n"
"Example: allow { source1 source2 } { target1 target2 } permission-class *\n" "Example: allow { s1 s2 } { t1 t2 } class *\n"
"Will be expanded to:\n" "Will be expanded to:\n"
"\n" "\n"
"allow source1 target1 permission-class { all-permissions }\n" "allow s1 t1 class { all permissions }\n"
"allow source1 target2 permission-class { all-permissions }\n" "allow s1 t2 class { all permissions }\n"
"allow source2 target1 permission-class { all-permissions }\n" "allow s2 t1 class { all permissions }\n"
"allow source2 target2 permission-class { all-permissions }\n" "allow s2 t2 class { all permissions }\n"
"\n", "\n",
type_msg_1, type_msg_2, type_msg_3, type_msg_4, type_msg_5); type_msg_1, type_msg_2, type_msg_3, type_msg_4, type_msg_5, type_msg_6);
exit(0); exit(0);
} }
...@@ -207,6 +216,8 @@ static int parse_pattern_2(int action, const char *action_str, char *stmt) { ...@@ -207,6 +216,8 @@ static int parse_pattern_2(int action, const char *action_str, char *stmt) {
break; break;
case 3: case 3:
// Currently only support ioctl // Currently only support ioctl
if (strcmp(cur, "ioctl"))
return 1;
vec = nullptr; vec = nullptr;
break; break;
case 4: case 4:
...@@ -310,11 +321,55 @@ static int parse_pattern_4(int action, const char *action_str, char *stmt) { ...@@ -310,11 +321,55 @@ static int parse_pattern_4(int action, const char *action_str, char *stmt) {
return 0; return 0;
} }
// Pattern 5: action source target class default (filename) // Pattern 5: action source target class default
static int parse_pattern_5(int action, const char *action_str, char *stmt) { static int parse_pattern_5(int action, const char *action_str, char *stmt) {
int (*action_func)(const char*, const char*, const char*, const char*);
switch (action) {
case 0:
action_func = sepol_typetrans;
break;
case 1:
action_func = sepol_typechange;
break;
case 2:
action_func = sepol_typemember;
break;
default:
return 1;
}
int state = 0;
char *cur;
char *source, *target, *cls, *def;
while ((cur = strtok_r(nullptr, " ", &stmt)) != nullptr) {
switch(state) {
case 0:
source = cur;
break;
case 1:
target = cur;
break;
case 2:
cls = cur;
break;
case 3:
def = cur;
break;
default:
return 1;
}
++state;
}
if (state < 4) return 1;
if (action_func(source, target, cls, def))
fprintf(stderr, "Error in: %s %s %s %s %s\n", action_str, source, target, cls, def);
return 0;
}
// Pattern 6: action source target class default filename
static int parse_pattern_6(int action, const char *action_str, char *stmt) {
int state = 0; int state = 0;
char *cur; char *cur;
char *source, *target, *cls, *def, *filename = nullptr; char *source, *target, *cls, *def, *filename;
while ((cur = strtok_r(nullptr, " ", &stmt)) != nullptr) { while ((cur = strtok_r(nullptr, " ", &stmt)) != nullptr) {
switch(state) { switch(state) {
case 0: case 0:
...@@ -338,9 +393,9 @@ static int parse_pattern_5(int action, const char *action_str, char *stmt) { ...@@ -338,9 +393,9 @@ static int parse_pattern_5(int action, const char *action_str, char *stmt) {
++state; ++state;
} }
if (state < 4) return 1; if (state < 4) return 1;
if (sepol_typetrans(source, target, cls, def, filename)) if (sepol_nametrans(source, target, cls, def, filename))
fprintf(stderr, "Error in: %s %s %s %s %s %s\n", fprintf(stderr, "Error in: %s %s %s %s %s %s\n",
action_str, source, target, cls, def, filename ? filename : ""); action_str, source, target, cls, def, filename);
return 0; return 0;
} }
...@@ -371,7 +426,10 @@ static void parse_statement(char *statement) { ...@@ -371,7 +426,10 @@ static void parse_statement(char *statement) {
add_action("permissive", 3, 1) add_action("permissive", 3, 1)
add_action("enforce", 3, 2) add_action("enforce", 3, 2)
add_action("attradd", 4, 0) add_action("attradd", 4, 0)
add_action("typetrans", 5, 0) add_action("type_transition", 5, 0)
add_action("type_change", 5, 1)
add_action("type_member", 5, 2)
add_action("name_transition", 6, 0)
else { fprintf(stderr, "Unknown statement: '%s'\n\n", orig.c_str()); } else { fprintf(stderr, "Unknown statement: '%s'\n\n", orig.c_str()); }
} }
......
...@@ -31,7 +31,10 @@ int sepol_allow(const char *s, const char *t, const char *c, const char *p); ...@@ -31,7 +31,10 @@ int sepol_allow(const char *s, const char *t, const char *c, const char *p);
int sepol_deny(const char *s, const char *t, const char *c, const char *p); int sepol_deny(const char *s, const char *t, const char *c, const char *p);
int sepol_auditallow(const char *s, const char *t, const char *c, const char *p); int sepol_auditallow(const char *s, const char *t, const char *c, const char *p);
int sepol_auditdeny(const char *s, const char *t, const char *c, const char *p); int sepol_auditdeny(const char *s, const char *t, const char *c, const char *p);
int sepol_typetrans(const char *s, const char *t, const char *c, const char *d, const char *o); int sepol_typetrans(const char *s, const char *t, const char *c, const char *d);
int sepol_typechange(const char *s, const char *t, const char *c, const char *d);
int sepol_typemember(const char *s, const char *t, const char *c, const char *d);
int sepol_nametrans(const char *s, const char *t, const char *c, const char *d, const char *o);
int sepol_allowxperm(const char *s, const char *t, const char *c, const char *range); int sepol_allowxperm(const char *s, const char *t, const char *c, const char *range);
int sepol_auditallowxperm(const char *s, const char *t, const char *c, const char *range); int sepol_auditallowxperm(const char *s, const char *t, const char *c, const char *range);
int sepol_dontauditxperm(const char *s, const char *t, const char *c, const char *range); int sepol_dontauditxperm(const char *s, const char *t, const char *c, const char *range);
......
This diff is collapsed.
...@@ -21,12 +21,12 @@ extern policydb_t *policydb; ...@@ -21,12 +21,12 @@ extern policydb_t *policydb;
// sepolicy manipulation functions // sepolicy manipulation functions
int create_domain(const char *d); int create_domain(const char *d);
int set_domain_state(const char *s, int state); int set_domain_state(const char *s, int state);
int add_transition(const char *s, const char *t, const char *c, const char *d);
int add_file_transition(const char *s, const char *t, const char *c, const char *d, int add_file_transition(const char *s, const char *t, const char *c, const char *d,
const char *filename); const char *o);
int add_typeattribute(const char *domainS, const char *attr); int add_typeattribute(const char *domainS, const char *attr);
int add_rule(const char *s, const char *t, const char *c, const char *p, int effect, int n); int add_rule(const char *s, const char *t, const char *c, const char *p, int effect, int n);
int add_xperm_rule(const char *s, const char *t, const char *c, const char *range, int effect, int n); int add_xperm_rule(const char *s, const char *t, const char *c, const char *range, int effect, int n);
int add_type_rule(const char *s, const char *t, const char *c, const char *d, int effect);
#ifdef __cplusplus #ifdef __cplusplus
}; };
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment