Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
M
Magisk
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
Magisk
Commits
4499cebc
Commit
4499cebc
authored
May 25, 2020
by
topjohnwu
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Support new sepolicy rules
Support declare new type with attribute and declare new attributes
parent
cd6eca1d
Hide whitespace changes
Inline
Side-by-side
Showing
4 changed files
with
155 additions
and
90 deletions
+155
-90
magiskpolicy.hpp
native/jni/include/magiskpolicy.hpp
+5
-1
sepolicy.cpp
native/jni/magiskpolicy/sepolicy.cpp
+43
-24
sepolicy.hpp
native/jni/magiskpolicy/sepolicy.hpp
+3
-2
statement.cpp
native/jni/magiskpolicy/statement.cpp
+104
-63
No files found.
native/jni/include/magiskpolicy.hpp
View file @
4499cebc
...
...
@@ -23,7 +23,8 @@ public:
void
load_rule_file
(
c_str
file
);
// Operation on types
bool
create
(
c_str
type
);
bool
type
(
c_str
name
,
c_str
attr
);
bool
attribute
(
c_str
name
);
bool
permissive
(
c_str
type
);
bool
enforce
(
c_str
type
);
bool
typeattribute
(
c_str
type
,
c_str
attr
);
...
...
@@ -51,6 +52,9 @@ public:
// Magisk
void
magisk_rules
();
// Deprecate
bool
create
(
c_str
name
)
{
return
type
(
name
,
"domain"
);
}
protected
:
policydb
*
db
;
};
native/jni/magiskpolicy/sepolicy.cpp
View file @
4499cebc
...
...
@@ -513,7 +513,7 @@ bool sepol_impl::add_genfscon(const char *fs_name, const char *path, const char
return
true
;
}
bool
sepol_impl
::
create_domain
(
const
char
*
type_name
)
{
bool
sepol_impl
::
add_type
(
const
char
*
type_name
,
uint32_t
flavor
)
{
type_datum_t
*
type
=
hashtab_find
(
db
->
p_types
.
table
,
type_name
);
if
(
type
)
{
LOGW
(
"Type %s already exists
\n
"
,
type_name
);
...
...
@@ -523,7 +523,7 @@ bool sepol_impl::create_domain(const char *type_name) {
type
=
auto_cast
(
xmalloc
(
sizeof
(
type_datum_t
)));
type_datum_init
(
type
);
type
->
primary
=
1
;
type
->
flavor
=
TYPE_TYPE
;
type
->
flavor
=
flavor
;
uint32_t
value
=
0
;
if
(
symtab_insert
(
db
,
SYM_TYPES
,
strdup
(
type_name
),
type
,
SCOPE_DECL
,
1
,
&
value
))
...
...
@@ -551,22 +551,21 @@ bool sepol_impl::create_domain(const char *type_name) {
type_set_expand
(
&
db
->
role_val_to_struct
[
i
]
->
types
,
&
db
->
role_val_to_struct
[
i
]
->
cache
,
db
,
0
);
}
set_attr
(
"domain"
,
value
);
return
true
;
}
bool
sepol_impl
::
set_
domain_state
(
const
char
*
s
,
bool
permissive
)
{
bool
sepol_impl
::
set_
type_state
(
const
char
*
type_name
,
bool
permissive
)
{
type_datum_t
*
type
;
if
(
s
==
nullptr
)
{
if
(
type_name
==
nullptr
)
{
hashtab_for_each
(
db
->
p_types
.
table
,
[
&
](
hashtab_ptr_t
node
)
{
type
=
auto_cast
(
node
->
datum
);
if
(
ebitmap_set_bit
(
&
db
->
permissive_map
,
type
->
s
.
value
,
permissive
))
LOGW
(
"Could not set bit in permissive map
\n
"
);
});
}
else
{
type
=
hashtab_find
(
db
->
p_types
.
table
,
s
);
type
=
hashtab_find
(
db
->
p_types
.
table
,
type_name
);
if
(
type
==
nullptr
)
{
LOGW
(
"type %s does not exist
\n
"
,
s
);
LOGW
(
"type %s does not exist
\n
"
,
type_name
);
return
false
;
}
if
(
ebitmap_set_bit
(
&
db
->
permissive_map
,
type
->
s
.
value
,
permissive
))
{
...
...
@@ -577,28 +576,43 @@ bool sepol_impl::set_domain_state(const char *s, bool permissive) {
return
true
;
}
bool
sepol_impl
::
add_typeattribute
(
const
char
*
type
,
const
char
*
attr
)
{
type_datum_t
*
domain
=
hashtab_find
(
db
->
p_types
.
table
,
type
);
if
(
domain
==
nullptr
)
{
LOGW
(
"type %s does not exist
\n
"
,
type
);
return
false
;
}
int
attr_val
=
set_attr
(
attr
,
domain
->
s
.
value
);
if
(
attr_val
<
0
)
return
false
;
void
sepol_impl
::
add_typeattribute
(
type_datum_t
*
type
,
type_datum_t
*
attr
)
{
ebitmap_set_bit
(
&
db
->
type_attr_map
[
type
->
s
.
value
-
1
],
attr
->
s
.
value
-
1
,
1
);
ebitmap_set_bit
(
&
db
->
attr_type_map
[
attr
->
s
.
value
-
1
],
type
->
s
.
value
-
1
,
1
);
hashtab_for_each
(
db
->
p_classes
.
table
,
[
&
](
hashtab_ptr_t
node
){
auto
cls
=
static_cast
<
class_datum_t
*>
(
node
->
datum
);
for
(
constraint_node_t
*
n
=
cls
->
constraints
;
n
;
n
=
n
->
next
)
{
for
(
constraint_expr_t
*
e
=
n
->
expr
;
e
;
e
=
e
->
next
)
{
if
(
e
->
expr_type
==
CEXPR_NAMES
&&
ebitmap_get_bit
(
&
e
->
type_names
->
types
,
attr
_val
-
1
))
{
ebitmap_set_bit
(
&
e
->
names
,
domain
->
s
.
value
-
1
,
1
);
ebitmap_get_bit
(
&
e
->
type_names
->
types
,
attr
->
s
.
value
-
1
))
{
ebitmap_set_bit
(
&
e
->
names
,
type
->
s
.
value
-
1
,
1
);
}
}
}
});
}
bool
sepol_impl
::
add_typeattribute
(
const
char
*
type
,
const
char
*
attr
)
{
type_datum_t
*
type_d
=
hashtab_find
(
db
->
p_types
.
table
,
type
);
if
(
type_d
==
nullptr
)
{
LOGW
(
"type %s does not exist
\n
"
,
type
);
return
false
;
}
else
if
(
type_d
->
flavor
==
TYPE_ATTRIB
)
{
LOGW
(
"type %s is an attribute
\n
"
,
attr
);
return
false
;
}
type_datum
*
attr_d
=
hashtab_find
(
db
->
p_types
.
table
,
attr
);
if
(
attr_d
==
nullptr
)
{
LOGW
(
"attribute %s does not exist
\n
"
,
type
);
return
false
;
}
else
if
(
attr_d
->
flavor
!=
TYPE_ATTRIB
)
{
LOGW
(
"type %s is not an attribute
\n
"
,
attr
);
return
false
;
}
add_typeattribute
(
type_d
,
attr_d
);
return
true
;
}
...
...
@@ -666,17 +680,22 @@ bool sepolicy::type_transition(const char *s, const char *t, const char *c, cons
bool
sepolicy
::
permissive
(
const
char
*
s
)
{
dprint
(
__FUNCTION__
,
s
);
return
impl
->
set_
domain
_state
(
s
,
true
);
return
impl
->
set_
type
_state
(
s
,
true
);
}
bool
sepolicy
::
enforce
(
const
char
*
s
)
{
dprint
(
__FUNCTION__
,
s
);
return
impl
->
set_
domain
_state
(
s
,
false
);
return
impl
->
set_
type
_state
(
s
,
false
);
}
bool
sepolicy
::
create
(
const
char
*
s
)
{
dprint
(
__FUNCTION__
,
s
);
return
impl
->
create_domain
(
s
);
bool
sepolicy
::
type
(
const
char
*
name
,
const
char
*
attr
)
{
dprint
(
__FUNCTION__
,
name
,
attr
);
return
impl
->
add_type
(
name
,
TYPE_TYPE
)
&&
impl
->
add_typeattribute
(
name
,
attr
);
}
bool
sepolicy
::
attribute
(
const
char
*
name
)
{
dprint
(
__FUNCTION__
,
name
);
return
impl
->
add_type
(
name
,
TYPE_ATTRIB
);
}
bool
sepolicy
::
typeattribute
(
const
char
*
type
,
const
char
*
attr
)
{
...
...
native/jni/magiskpolicy/sepolicy.hpp
View file @
4499cebc
...
...
@@ -16,8 +16,9 @@ struct sepol_impl : public sepolicy {
bool
add_type_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
int
effect
);
bool
add_filename_trans
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
);
bool
add_genfscon
(
const
char
*
fs_name
,
const
char
*
path
,
const
char
*
context
);
bool
create_domain
(
const
char
*
type_name
);
bool
set_domain_state
(
const
char
*
s
,
bool
permissive
);
bool
add_type
(
const
char
*
type_name
,
uint32_t
flavor
);
bool
set_type_state
(
const
char
*
type_name
,
bool
permissive
);
void
add_typeattribute
(
type_datum_t
*
type
,
type_datum_t
*
attr
);
bool
add_typeattribute
(
const
char
*
type
,
const
char
*
attr
);
void
strip_dontaudit
();
void
allow_su_client
(
const
char
*
type
);
...
...
native/jni/magiskpolicy/statement.cpp
View file @
4499cebc
...
...
@@ -11,45 +11,52 @@
using
namespace
std
;
static
const
char
*
type_msg_1
=
R"EOF(Type 1:
"<rule_name> ^source_type ^target_type ^class ^perm_set"
Rules: allow, deny, auditallow, dontaudit
R"EOF("allow *source_type *target_type *class *perm_set"
"deny *source_type *target_type *class *perm_set"
"auditallow *source_type *target_type *class *perm_set"
"dontaudit *source_type *target_type *class *perm_set"
)EOF"
;
static
const
char
*
type_msg_2
=
R"EOF(Type 2:
"<rule_name> ^source_type ^target_type ^class operation xperm_set"
Rules: allowxperm, auditallowxperm, dontauditxperm
- The only supported operation is ioctl
- The only supported xperm_set format is range ([low-high])
R"EOF("allowxperm *source_type *target_type *class operation xperm_set"
"auditallowxperm *source_type *target_type *class operation xperm_set"
"dontauditxperm *source_type *target_type *class operation xperm_set"
- The only supported operation is 'ioctl'
- xperm_set format is either 'low-high', 'value', or '*'.
'*' will be treated as '0x0000-0xFFFF'.
All values should be written in hexadecimal.
)EOF"
;
static
const
char
*
type_msg_3
=
R"EOF(Type 3:
"<rule_name> ^type"
Rules: create, permissive, enforcing
R"EOF("permissive ^type"
"enforce ^type"
)EOF"
;
static
const
char
*
type_msg_4
=
R"EOF(Type 4:
"typeattribute ^type ^attribute"
R"EOF("typeattribute ^type ^attribute"
)EOF"
;
static
const
char
*
type_msg_5
=
R"EOF(Type 5:
"<rule_name> source_type target_type class default_type"
Rules: type_change, type_member
R"EOF("type type_name ^(attribute)"
- Argument 'attribute' is optional, default to 'domain'
)EOF"
;
static
const
char
*
type_msg_6
=
R"EOF(Type 6:
"type_transition source_type target_type class default_type (object_name)"
- Entry 'object_name' is optional
R"EOF("attribute attribute_name"
)EOF"
;
static
const
char
*
type_msg_7
=
R"EOF(Type 7:
"genfscon fs_name partial_path fs_context"
R"EOF("type_transition source_type target_type class default_type (object_name)"
- Argument 'object_name' is optional
)EOF"
;
static
const
char
*
type_msg_8
=
R"EOF("type_change source_type target_type class default_type"
"type_member source_type target_type class default_type"
)EOF"
;
static
const
char
*
type_msg_9
=
R"EOF("genfscon fs_name partial_path fs_context"
)EOF"
;
void
statement_help
()
{
...
...
@@ -61,8 +68,8 @@ Multiple policy statements can be provided in a single command.
Statements has a format of "<rule_name> [args...]".
Arguments labeled with (^) can accept one or more entries. Multiple
entries consist of a space separated list enclosed in braces ({}).
For args that support multiple entries, (*) can be used to
represent all valid matches
.
Arguments labeled with (*) are the same as (^), but additionally
support the match-all operator (*)
.
Example: "allow { s1 s2 } { t1 t2 } class *"
Will be expanded to:
...
...
@@ -81,15 +88,20 @@ Supported policy statements:
%s
%s
%s
)EOF"
,
type_msg_1
,
type_msg_2
,
type_msg_3
,
type_msg_4
,
type_msg_5
,
type_msg_6
,
type_msg_7
);
%s
%s
)EOF"
,
type_msg_1
,
type_msg_2
,
type_msg_3
,
type_msg_4
,
type_msg_5
,
type_msg_6
,
type_msg_7
,
type_msg_8
,
type_msg_9
);
exit
(
0
);
}
static
bool
tokenize_string
(
char
*
stmt
,
vector
<
vector
<
char
*>>
&
arr
)
{
using
parsed_tokens
=
vector
<
vector
<
const
char
*>>
;
static
bool
tokenize_string
(
char
*
stmt
,
parsed_tokens
&
arr
)
{
// cur is the pointer to where the top level is parsing
char
*
cur
=
stmt
;
for
(
char
*
tok
;
(
tok
=
strtok_r
(
nullptr
,
" "
,
&
cur
))
!=
nullptr
;)
{
vector
<
char
*>
token
;
vector
<
c
onst
c
har
*>
token
;
if
(
tok
[
0
]
==
'{'
)
{
// cur could point to somewhere in the braces, restore the string
if
(
cur
)
...
...
@@ -116,7 +128,7 @@ static bool tokenize_string(char *stmt, vector<vector<char *>> &arr) {
// Check array size and all args listed in 'ones' have size = 1 (no multiple entries)
template
<
int
size
,
int
...
ones
>
static
bool
check_tokens
(
vector
<
vector
<
char
*>>
&
arr
)
{
static
bool
check_tokens
(
parsed_tokens
&
arr
)
{
if
(
arr
.
size
()
!=
size
)
return
false
;
initializer_list
<
int
>
list
{
ones
...};
...
...
@@ -127,7 +139,7 @@ static bool check_tokens(vector<vector<char *>> &arr) {
}
template
<
int
size
,
int
...
ones
>
static
bool
tokenize_and_check
(
char
*
stmt
,
vector
<
vector
<
char
*>>
&
arr
)
{
static
bool
tokenize_and_check
(
char
*
stmt
,
parsed_tokens
&
arr
)
{
return
tokenize_string
(
stmt
,
arr
)
&&
check_tokens
<
size
,
ones
...
>
(
arr
);
}
...
...
@@ -143,85 +155,112 @@ static void run_and_check(const Func &fn, const char *action, Args ...args) {
#define run_fn(...) run_and_check(fn, action, __VA_ARGS__)
// Pattern 1: a
ction
{ source } { target } { class } { permission }
// Pattern 1: a
llow
{ source } { target } { class } { permission }
template
<
typename
Func
>
static
bool
parse_pattern_1
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
vector
<
vector
<
char
*>>
arr
;
parsed_tokens
arr
;
if
(
!
tokenize_and_check
<
4
>
(
stmt
,
arr
))
return
false
;
for
(
char
*
src
:
arr
[
0
])
for
(
char
*
tgt
:
arr
[
1
])
for
(
char
*
cls
:
arr
[
2
])
for
(
char
*
perm
:
arr
[
3
])
for
(
auto
src
:
arr
[
0
])
for
(
auto
tgt
:
arr
[
1
])
for
(
auto
cls
:
arr
[
2
])
for
(
auto
perm
:
arr
[
3
])
run_fn
(
src
,
tgt
,
cls
,
perm
);
return
true
;
}
// Pattern 2: a
ction
{ source } { target } { class } ioctl range
// Pattern 2: a
llowxperm
{ source } { target } { class } ioctl range
template
<
typename
Func
>
static
bool
parse_pattern_2
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
vector
<
vector
<
char
*>>
arr
;
parsed_tokens
arr
;
if
(
!
tokenize_and_check
<
5
,
3
,
4
>
(
stmt
,
arr
)
||
arr
[
3
][
0
]
!=
"ioctl"
sv
)
return
false
;
char
*
range
=
arr
[
4
][
0
];
for
(
char
*
src
:
arr
[
0
])
for
(
char
*
tgt
:
arr
[
1
])
for
(
char
*
cls
:
arr
[
2
])
auto
range
=
arr
[
4
][
0
];
for
(
auto
src
:
arr
[
0
])
for
(
auto
tgt
:
arr
[
1
])
for
(
auto
cls
:
arr
[
2
])
run_fn
(
src
,
tgt
,
cls
,
range
);
return
true
;
}
// Pattern 3:
action
{ type }
// Pattern 3:
permissive
{ type }
template
<
typename
Func
>
static
bool
parse_pattern_3
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
vector
<
vector
<
char
*>>
arr
;
parsed_tokens
arr
;
if
(
!
tokenize_and_check
<
1
>
(
stmt
,
arr
))
return
false
;
for
(
char
*
type
:
arr
[
0
])
for
(
auto
type
:
arr
[
0
])
run_fn
(
type
);
return
true
;
}
// Pattern 4:
action
{ type } { attribute }
// Pattern 4:
typeattribute
{ type } { attribute }
template
<
typename
Func
>
static
bool
parse_pattern_4
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
vector
<
vector
<
char
*>>
arr
;
parsed_tokens
arr
;
if
(
!
tokenize_and_check
<
2
>
(
stmt
,
arr
))
return
false
;
for
(
char
*
type
:
arr
[
0
])
for
(
char
*
attr
:
arr
[
1
])
for
(
auto
type
:
arr
[
0
])
for
(
auto
attr
:
arr
[
1
])
run_fn
(
type
,
attr
);
return
true
;
}
// Pattern 5:
action source target class default
// Pattern 5:
type name { attribute }
template
<
typename
Func
>
static
bool
parse_pattern_5
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
vector
<
vector
<
char
*>>
arr
;
if
(
!
tokenize_and_check
<
4
,
0
,
1
,
2
,
3
>
(
stmt
,
arr
))
parsed_tokens
arr
;
string
tmp_str
;
if
(
!
tokenize_string
(
stmt
,
arr
))
return
false
;
run_fn
(
arr
[
0
][
0
],
arr
[
1
][
0
],
arr
[
2
][
0
],
arr
[
3
][
0
]);
if
(
arr
.
size
()
==
1
)
{
arr
.
emplace_back
(
initializer_list
<
const
char
*>
{
"domain"
});
}
if
(
!
check_tokens
<
2
,
0
>
(
arr
))
return
false
;
for
(
auto
attr
:
arr
[
1
])
run_fn
(
arr
[
0
][
0
],
attr
);
return
true
;
}
// Pattern 6: a
ction source target class default (filename)
// Pattern 6: a
ttribute name
template
<
typename
Func
>
static
bool
parse_pattern_6
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
vector
<
vector
<
char
*>>
arr
;
parsed_tokens
arr
;
if
(
!
tokenize_and_check
<
1
,
0
>
(
stmt
,
arr
))
return
false
;
run_fn
(
arr
[
0
][
1
]);
return
true
;
}
// Pattern 7: type_transition source target class default (filename)
template
<
typename
Func
>
static
bool
parse_pattern_7
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
parsed_tokens
arr
;
if
(
!
tokenize_string
(
stmt
,
arr
))
return
false
;
if
(
arr
.
size
()
==
4
)
arr
.
emplace_back
(
initializer_list
<
char
*>
{
nullptr
});
arr
.
emplace_back
(
initializer_list
<
c
onst
c
har
*>
{
nullptr
});
if
(
!
check_tokens
<
5
,
0
,
1
,
2
,
3
,
4
>
(
arr
))
return
false
;
run_fn
(
arr
[
0
][
0
],
arr
[
1
][
0
],
arr
[
2
][
0
],
arr
[
3
][
0
],
arr
[
4
][
0
]);
return
true
;
}
// Pattern
7: action name path contex
t
// Pattern
8: type_change source target class defaul
t
template
<
typename
Func
>
static
bool
parse_pattern_7
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
vector
<
vector
<
char
*>>
arr
;
static
bool
parse_pattern_8
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
parsed_tokens
arr
;
if
(
!
tokenize_and_check
<
4
,
0
,
1
,
2
,
3
>
(
stmt
,
arr
))
return
false
;
run_fn
(
arr
[
0
][
0
],
arr
[
1
][
0
],
arr
[
2
][
0
],
arr
[
3
][
0
]);
return
true
;
}
// Pattern 9: genfscon name path context
template
<
typename
Func
>
static
bool
parse_pattern_9
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
parsed_tokens
arr
;
if
(
!
tokenize_and_check
<
3
,
0
,
1
,
2
>
(
stmt
,
arr
))
return
false
;
run_fn
(
arr
[
0
][
0
],
arr
[
1
][
0
],
arr
[
2
][
0
]);
...
...
@@ -256,18 +295,20 @@ void sepolicy::parse_statement(const char *stmt) {
add_action
(
allowxperm
,
2
)
add_action
(
auditallowxperm
,
2
)
add_action
(
dontauditxperm
,
2
)
add_action
(
create
,
3
)
add_action
(
permissive
,
3
)
add_action
(
enforce
,
3
)
add_action
(
typeattribute
,
4
)
add_action
(
type_change
,
5
)
add_action
(
type_member
,
5
)
add_action
(
type_transition
,
6
)
add_action
(
genfscon
,
7
)
add_action
(
type
,
5
)
add_action
(
attribute
,
6
)
add_action
(
type_transition
,
7
)
add_action
(
type_change
,
8
)
add_action
(
type_member
,
8
)
add_action
(
genfscon
,
9
)
// Backwards compatible syntax
add_action
(
create
,
3
)
add_action_func
(
"attradd"
,
4
,
typeattribute
)
add_action_func
(
"name_transition"
,
6
,
type_transition
)
add_action_func
(
"name_transition"
,
7
,
type_transition
)
else
{
LOGW
(
"Unknown action: '%s'
\n\n
"
,
action
);
}
}
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment