Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
M
Magisk
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
Magisk
Commits
4499cebc
Commit
4499cebc
authored
May 25, 2020
by
topjohnwu
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Support new sepolicy rules
Support declare new type with attribute and declare new attributes
parent
cd6eca1d
Hide whitespace changes
Inline
Side-by-side
Showing
4 changed files
with
155 additions
and
90 deletions
+155
-90
magiskpolicy.hpp
native/jni/include/magiskpolicy.hpp
+5
-1
sepolicy.cpp
native/jni/magiskpolicy/sepolicy.cpp
+43
-24
sepolicy.hpp
native/jni/magiskpolicy/sepolicy.hpp
+3
-2
statement.cpp
native/jni/magiskpolicy/statement.cpp
+104
-63
No files found.
native/jni/include/magiskpolicy.hpp
View file @
4499cebc
...
@@ -23,7 +23,8 @@ public:
...
@@ -23,7 +23,8 @@ public:
void
load_rule_file
(
c_str
file
);
void
load_rule_file
(
c_str
file
);
// Operation on types
// Operation on types
bool
create
(
c_str
type
);
bool
type
(
c_str
name
,
c_str
attr
);
bool
attribute
(
c_str
name
);
bool
permissive
(
c_str
type
);
bool
permissive
(
c_str
type
);
bool
enforce
(
c_str
type
);
bool
enforce
(
c_str
type
);
bool
typeattribute
(
c_str
type
,
c_str
attr
);
bool
typeattribute
(
c_str
type
,
c_str
attr
);
...
@@ -51,6 +52,9 @@ public:
...
@@ -51,6 +52,9 @@ public:
// Magisk
// Magisk
void
magisk_rules
();
void
magisk_rules
();
// Deprecate
bool
create
(
c_str
name
)
{
return
type
(
name
,
"domain"
);
}
protected
:
protected
:
policydb
*
db
;
policydb
*
db
;
};
};
native/jni/magiskpolicy/sepolicy.cpp
View file @
4499cebc
...
@@ -513,7 +513,7 @@ bool sepol_impl::add_genfscon(const char *fs_name, const char *path, const char
...
@@ -513,7 +513,7 @@ bool sepol_impl::add_genfscon(const char *fs_name, const char *path, const char
return
true
;
return
true
;
}
}
bool
sepol_impl
::
create_domain
(
const
char
*
type_name
)
{
bool
sepol_impl
::
add_type
(
const
char
*
type_name
,
uint32_t
flavor
)
{
type_datum_t
*
type
=
hashtab_find
(
db
->
p_types
.
table
,
type_name
);
type_datum_t
*
type
=
hashtab_find
(
db
->
p_types
.
table
,
type_name
);
if
(
type
)
{
if
(
type
)
{
LOGW
(
"Type %s already exists
\n
"
,
type_name
);
LOGW
(
"Type %s already exists
\n
"
,
type_name
);
...
@@ -523,7 +523,7 @@ bool sepol_impl::create_domain(const char *type_name) {
...
@@ -523,7 +523,7 @@ bool sepol_impl::create_domain(const char *type_name) {
type
=
auto_cast
(
xmalloc
(
sizeof
(
type_datum_t
)));
type
=
auto_cast
(
xmalloc
(
sizeof
(
type_datum_t
)));
type_datum_init
(
type
);
type_datum_init
(
type
);
type
->
primary
=
1
;
type
->
primary
=
1
;
type
->
flavor
=
TYPE_TYPE
;
type
->
flavor
=
flavor
;
uint32_t
value
=
0
;
uint32_t
value
=
0
;
if
(
symtab_insert
(
db
,
SYM_TYPES
,
strdup
(
type_name
),
type
,
SCOPE_DECL
,
1
,
&
value
))
if
(
symtab_insert
(
db
,
SYM_TYPES
,
strdup
(
type_name
),
type
,
SCOPE_DECL
,
1
,
&
value
))
...
@@ -551,22 +551,21 @@ bool sepol_impl::create_domain(const char *type_name) {
...
@@ -551,22 +551,21 @@ bool sepol_impl::create_domain(const char *type_name) {
type_set_expand
(
&
db
->
role_val_to_struct
[
i
]
->
types
,
&
db
->
role_val_to_struct
[
i
]
->
cache
,
db
,
0
);
type_set_expand
(
&
db
->
role_val_to_struct
[
i
]
->
types
,
&
db
->
role_val_to_struct
[
i
]
->
cache
,
db
,
0
);
}
}
set_attr
(
"domain"
,
value
);
return
true
;
return
true
;
}
}
bool
sepol_impl
::
set_
domain_state
(
const
char
*
s
,
bool
permissive
)
{
bool
sepol_impl
::
set_
type_state
(
const
char
*
type_name
,
bool
permissive
)
{
type_datum_t
*
type
;
type_datum_t
*
type
;
if
(
s
==
nullptr
)
{
if
(
type_name
==
nullptr
)
{
hashtab_for_each
(
db
->
p_types
.
table
,
[
&
](
hashtab_ptr_t
node
)
{
hashtab_for_each
(
db
->
p_types
.
table
,
[
&
](
hashtab_ptr_t
node
)
{
type
=
auto_cast
(
node
->
datum
);
type
=
auto_cast
(
node
->
datum
);
if
(
ebitmap_set_bit
(
&
db
->
permissive_map
,
type
->
s
.
value
,
permissive
))
if
(
ebitmap_set_bit
(
&
db
->
permissive_map
,
type
->
s
.
value
,
permissive
))
LOGW
(
"Could not set bit in permissive map
\n
"
);
LOGW
(
"Could not set bit in permissive map
\n
"
);
});
});
}
else
{
}
else
{
type
=
hashtab_find
(
db
->
p_types
.
table
,
s
);
type
=
hashtab_find
(
db
->
p_types
.
table
,
type_name
);
if
(
type
==
nullptr
)
{
if
(
type
==
nullptr
)
{
LOGW
(
"type %s does not exist
\n
"
,
s
);
LOGW
(
"type %s does not exist
\n
"
,
type_name
);
return
false
;
return
false
;
}
}
if
(
ebitmap_set_bit
(
&
db
->
permissive_map
,
type
->
s
.
value
,
permissive
))
{
if
(
ebitmap_set_bit
(
&
db
->
permissive_map
,
type
->
s
.
value
,
permissive
))
{
...
@@ -577,28 +576,43 @@ bool sepol_impl::set_domain_state(const char *s, bool permissive) {
...
@@ -577,28 +576,43 @@ bool sepol_impl::set_domain_state(const char *s, bool permissive) {
return
true
;
return
true
;
}
}
bool
sepol_impl
::
add_typeattribute
(
const
char
*
type
,
const
char
*
attr
)
{
void
sepol_impl
::
add_typeattribute
(
type_datum_t
*
type
,
type_datum_t
*
attr
)
{
type_datum_t
*
domain
=
hashtab_find
(
db
->
p_types
.
table
,
type
);
ebitmap_set_bit
(
&
db
->
type_attr_map
[
type
->
s
.
value
-
1
],
attr
->
s
.
value
-
1
,
1
);
if
(
domain
==
nullptr
)
{
ebitmap_set_bit
(
&
db
->
attr_type_map
[
attr
->
s
.
value
-
1
],
type
->
s
.
value
-
1
,
1
);
LOGW
(
"type %s does not exist
\n
"
,
type
);
return
false
;
}
int
attr_val
=
set_attr
(
attr
,
domain
->
s
.
value
);
if
(
attr_val
<
0
)
return
false
;
hashtab_for_each
(
db
->
p_classes
.
table
,
[
&
](
hashtab_ptr_t
node
){
hashtab_for_each
(
db
->
p_classes
.
table
,
[
&
](
hashtab_ptr_t
node
){
auto
cls
=
static_cast
<
class_datum_t
*>
(
node
->
datum
);
auto
cls
=
static_cast
<
class_datum_t
*>
(
node
->
datum
);
for
(
constraint_node_t
*
n
=
cls
->
constraints
;
n
;
n
=
n
->
next
)
{
for
(
constraint_node_t
*
n
=
cls
->
constraints
;
n
;
n
=
n
->
next
)
{
for
(
constraint_expr_t
*
e
=
n
->
expr
;
e
;
e
=
e
->
next
)
{
for
(
constraint_expr_t
*
e
=
n
->
expr
;
e
;
e
=
e
->
next
)
{
if
(
e
->
expr_type
==
CEXPR_NAMES
&&
if
(
e
->
expr_type
==
CEXPR_NAMES
&&
ebitmap_get_bit
(
&
e
->
type_names
->
types
,
attr
_val
-
1
))
{
ebitmap_get_bit
(
&
e
->
type_names
->
types
,
attr
->
s
.
value
-
1
))
{
ebitmap_set_bit
(
&
e
->
names
,
domain
->
s
.
value
-
1
,
1
);
ebitmap_set_bit
(
&
e
->
names
,
type
->
s
.
value
-
1
,
1
);
}
}
}
}
}
}
});
});
}
bool
sepol_impl
::
add_typeattribute
(
const
char
*
type
,
const
char
*
attr
)
{
type_datum_t
*
type_d
=
hashtab_find
(
db
->
p_types
.
table
,
type
);
if
(
type_d
==
nullptr
)
{
LOGW
(
"type %s does not exist
\n
"
,
type
);
return
false
;
}
else
if
(
type_d
->
flavor
==
TYPE_ATTRIB
)
{
LOGW
(
"type %s is an attribute
\n
"
,
attr
);
return
false
;
}
type_datum
*
attr_d
=
hashtab_find
(
db
->
p_types
.
table
,
attr
);
if
(
attr_d
==
nullptr
)
{
LOGW
(
"attribute %s does not exist
\n
"
,
type
);
return
false
;
}
else
if
(
attr_d
->
flavor
!=
TYPE_ATTRIB
)
{
LOGW
(
"type %s is not an attribute
\n
"
,
attr
);
return
false
;
}
add_typeattribute
(
type_d
,
attr_d
);
return
true
;
return
true
;
}
}
...
@@ -666,17 +680,22 @@ bool sepolicy::type_transition(const char *s, const char *t, const char *c, cons
...
@@ -666,17 +680,22 @@ bool sepolicy::type_transition(const char *s, const char *t, const char *c, cons
bool
sepolicy
::
permissive
(
const
char
*
s
)
{
bool
sepolicy
::
permissive
(
const
char
*
s
)
{
dprint
(
__FUNCTION__
,
s
);
dprint
(
__FUNCTION__
,
s
);
return
impl
->
set_
domain
_state
(
s
,
true
);
return
impl
->
set_
type
_state
(
s
,
true
);
}
}
bool
sepolicy
::
enforce
(
const
char
*
s
)
{
bool
sepolicy
::
enforce
(
const
char
*
s
)
{
dprint
(
__FUNCTION__
,
s
);
dprint
(
__FUNCTION__
,
s
);
return
impl
->
set_
domain
_state
(
s
,
false
);
return
impl
->
set_
type
_state
(
s
,
false
);
}
}
bool
sepolicy
::
create
(
const
char
*
s
)
{
bool
sepolicy
::
type
(
const
char
*
name
,
const
char
*
attr
)
{
dprint
(
__FUNCTION__
,
s
);
dprint
(
__FUNCTION__
,
name
,
attr
);
return
impl
->
create_domain
(
s
);
return
impl
->
add_type
(
name
,
TYPE_TYPE
)
&&
impl
->
add_typeattribute
(
name
,
attr
);
}
bool
sepolicy
::
attribute
(
const
char
*
name
)
{
dprint
(
__FUNCTION__
,
name
);
return
impl
->
add_type
(
name
,
TYPE_ATTRIB
);
}
}
bool
sepolicy
::
typeattribute
(
const
char
*
type
,
const
char
*
attr
)
{
bool
sepolicy
::
typeattribute
(
const
char
*
type
,
const
char
*
attr
)
{
...
...
native/jni/magiskpolicy/sepolicy.hpp
View file @
4499cebc
...
@@ -16,8 +16,9 @@ struct sepol_impl : public sepolicy {
...
@@ -16,8 +16,9 @@ struct sepol_impl : public sepolicy {
bool
add_type_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
int
effect
);
bool
add_type_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
int
effect
);
bool
add_filename_trans
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
);
bool
add_filename_trans
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
);
bool
add_genfscon
(
const
char
*
fs_name
,
const
char
*
path
,
const
char
*
context
);
bool
add_genfscon
(
const
char
*
fs_name
,
const
char
*
path
,
const
char
*
context
);
bool
create_domain
(
const
char
*
type_name
);
bool
add_type
(
const
char
*
type_name
,
uint32_t
flavor
);
bool
set_domain_state
(
const
char
*
s
,
bool
permissive
);
bool
set_type_state
(
const
char
*
type_name
,
bool
permissive
);
void
add_typeattribute
(
type_datum_t
*
type
,
type_datum_t
*
attr
);
bool
add_typeattribute
(
const
char
*
type
,
const
char
*
attr
);
bool
add_typeattribute
(
const
char
*
type
,
const
char
*
attr
);
void
strip_dontaudit
();
void
strip_dontaudit
();
void
allow_su_client
(
const
char
*
type
);
void
allow_su_client
(
const
char
*
type
);
...
...
native/jni/magiskpolicy/statement.cpp
View file @
4499cebc
...
@@ -11,45 +11,52 @@
...
@@ -11,45 +11,52 @@
using
namespace
std
;
using
namespace
std
;
static
const
char
*
type_msg_1
=
static
const
char
*
type_msg_1
=
R"EOF(Type 1:
R"EOF("allow *source_type *target_type *class *perm_set"
"<rule_name> ^source_type ^target_type ^class ^perm_set"
"deny *source_type *target_type *class *perm_set"
Rules: allow, deny, auditallow, dontaudit
"auditallow *source_type *target_type *class *perm_set"
"dontaudit *source_type *target_type *class *perm_set"
)EOF"
;
)EOF"
;
static
const
char
*
type_msg_2
=
static
const
char
*
type_msg_2
=
R"EOF(Type 2:
R"EOF("allowxperm *source_type *target_type *class operation xperm_set"
"<rule_name> ^source_type ^target_type ^class operation xperm_set"
"auditallowxperm *source_type *target_type *class operation xperm_set"
Rules: allowxperm, auditallowxperm, dontauditxperm
"dontauditxperm *source_type *target_type *class operation xperm_set"
- The only supported operation is ioctl
- The only supported operation is 'ioctl'
- The only supported xperm_set format is range ([low-high])
- xperm_set format is either 'low-high', 'value', or '*'.
'*' will be treated as '0x0000-0xFFFF'.
All values should be written in hexadecimal.
)EOF"
;
)EOF"
;
static
const
char
*
type_msg_3
=
static
const
char
*
type_msg_3
=
R"EOF(Type 3:
R"EOF("permissive ^type"
"<rule_name> ^type"
"enforce ^type"
Rules: create, permissive, enforcing
)EOF"
;
)EOF"
;
static
const
char
*
type_msg_4
=
static
const
char
*
type_msg_4
=
R"EOF(Type 4:
R"EOF("typeattribute ^type ^attribute"
"typeattribute ^type ^attribute"
)EOF"
;
)EOF"
;
static
const
char
*
type_msg_5
=
static
const
char
*
type_msg_5
=
R"EOF(Type 5:
R"EOF("type type_name ^(attribute)"
"<rule_name> source_type target_type class default_type"
- Argument 'attribute' is optional, default to 'domain'
Rules: type_change, type_member
)EOF"
;
)EOF"
;
static
const
char
*
type_msg_6
=
static
const
char
*
type_msg_6
=
R"EOF(Type 6:
R"EOF("attribute attribute_name"
"type_transition source_type target_type class default_type (object_name)"
- Entry 'object_name' is optional
)EOF"
;
)EOF"
;
static
const
char
*
type_msg_7
=
static
const
char
*
type_msg_7
=
R"EOF(Type 7:
R"EOF("type_transition source_type target_type class default_type (object_name)"
"genfscon fs_name partial_path fs_context"
- Argument 'object_name' is optional
)EOF"
;
static
const
char
*
type_msg_8
=
R"EOF("type_change source_type target_type class default_type"
"type_member source_type target_type class default_type"
)EOF"
;
static
const
char
*
type_msg_9
=
R"EOF("genfscon fs_name partial_path fs_context"
)EOF"
;
)EOF"
;
void
statement_help
()
{
void
statement_help
()
{
...
@@ -61,8 +68,8 @@ Multiple policy statements can be provided in a single command.
...
@@ -61,8 +68,8 @@ Multiple policy statements can be provided in a single command.
Statements has a format of "<rule_name> [args...]".
Statements has a format of "<rule_name> [args...]".
Arguments labeled with (^) can accept one or more entries. Multiple
Arguments labeled with (^) can accept one or more entries. Multiple
entries consist of a space separated list enclosed in braces ({}).
entries consist of a space separated list enclosed in braces ({}).
For args that support multiple entries, (*) can be used to
Arguments labeled with (*) are the same as (^), but additionally
represent all valid matches
.
support the match-all operator (*)
.
Example: "allow { s1 s2 } { t1 t2 } class *"
Example: "allow { s1 s2 } { t1 t2 } class *"
Will be expanded to:
Will be expanded to:
...
@@ -81,15 +88,20 @@ Supported policy statements:
...
@@ -81,15 +88,20 @@ Supported policy statements:
%s
%s
%s
%s
%s
%s
)EOF"
,
type_msg_1
,
type_msg_2
,
type_msg_3
,
type_msg_4
,
type_msg_5
,
type_msg_6
,
type_msg_7
);
%s
%s
)EOF"
,
type_msg_1
,
type_msg_2
,
type_msg_3
,
type_msg_4
,
type_msg_5
,
type_msg_6
,
type_msg_7
,
type_msg_8
,
type_msg_9
);
exit
(
0
);
exit
(
0
);
}
}
static
bool
tokenize_string
(
char
*
stmt
,
vector
<
vector
<
char
*>>
&
arr
)
{
using
parsed_tokens
=
vector
<
vector
<
const
char
*>>
;
static
bool
tokenize_string
(
char
*
stmt
,
parsed_tokens
&
arr
)
{
// cur is the pointer to where the top level is parsing
// cur is the pointer to where the top level is parsing
char
*
cur
=
stmt
;
char
*
cur
=
stmt
;
for
(
char
*
tok
;
(
tok
=
strtok_r
(
nullptr
,
" "
,
&
cur
))
!=
nullptr
;)
{
for
(
char
*
tok
;
(
tok
=
strtok_r
(
nullptr
,
" "
,
&
cur
))
!=
nullptr
;)
{
vector
<
char
*>
token
;
vector
<
c
onst
c
har
*>
token
;
if
(
tok
[
0
]
==
'{'
)
{
if
(
tok
[
0
]
==
'{'
)
{
// cur could point to somewhere in the braces, restore the string
// cur could point to somewhere in the braces, restore the string
if
(
cur
)
if
(
cur
)
...
@@ -116,7 +128,7 @@ static bool tokenize_string(char *stmt, vector<vector<char *>> &arr) {
...
@@ -116,7 +128,7 @@ static bool tokenize_string(char *stmt, vector<vector<char *>> &arr) {
// Check array size and all args listed in 'ones' have size = 1 (no multiple entries)
// Check array size and all args listed in 'ones' have size = 1 (no multiple entries)
template
<
int
size
,
int
...
ones
>
template
<
int
size
,
int
...
ones
>
static
bool
check_tokens
(
vector
<
vector
<
char
*>>
&
arr
)
{
static
bool
check_tokens
(
parsed_tokens
&
arr
)
{
if
(
arr
.
size
()
!=
size
)
if
(
arr
.
size
()
!=
size
)
return
false
;
return
false
;
initializer_list
<
int
>
list
{
ones
...};
initializer_list
<
int
>
list
{
ones
...};
...
@@ -127,7 +139,7 @@ static bool check_tokens(vector<vector<char *>> &arr) {
...
@@ -127,7 +139,7 @@ static bool check_tokens(vector<vector<char *>> &arr) {
}
}
template
<
int
size
,
int
...
ones
>
template
<
int
size
,
int
...
ones
>
static
bool
tokenize_and_check
(
char
*
stmt
,
vector
<
vector
<
char
*>>
&
arr
)
{
static
bool
tokenize_and_check
(
char
*
stmt
,
parsed_tokens
&
arr
)
{
return
tokenize_string
(
stmt
,
arr
)
&&
check_tokens
<
size
,
ones
...
>
(
arr
);
return
tokenize_string
(
stmt
,
arr
)
&&
check_tokens
<
size
,
ones
...
>
(
arr
);
}
}
...
@@ -143,85 +155,112 @@ static void run_and_check(const Func &fn, const char *action, Args ...args) {
...
@@ -143,85 +155,112 @@ static void run_and_check(const Func &fn, const char *action, Args ...args) {
#define run_fn(...) run_and_check(fn, action, __VA_ARGS__)
#define run_fn(...) run_and_check(fn, action, __VA_ARGS__)
// Pattern 1: a
ction
{ source } { target } { class } { permission }
// Pattern 1: a
llow
{ source } { target } { class } { permission }
template
<
typename
Func
>
template
<
typename
Func
>
static
bool
parse_pattern_1
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
static
bool
parse_pattern_1
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
vector
<
vector
<
char
*>>
arr
;
parsed_tokens
arr
;
if
(
!
tokenize_and_check
<
4
>
(
stmt
,
arr
))
if
(
!
tokenize_and_check
<
4
>
(
stmt
,
arr
))
return
false
;
return
false
;
for
(
char
*
src
:
arr
[
0
])
for
(
auto
src
:
arr
[
0
])
for
(
char
*
tgt
:
arr
[
1
])
for
(
auto
tgt
:
arr
[
1
])
for
(
char
*
cls
:
arr
[
2
])
for
(
auto
cls
:
arr
[
2
])
for
(
char
*
perm
:
arr
[
3
])
for
(
auto
perm
:
arr
[
3
])
run_fn
(
src
,
tgt
,
cls
,
perm
);
run_fn
(
src
,
tgt
,
cls
,
perm
);
return
true
;
return
true
;
}
}
// Pattern 2: a
ction
{ source } { target } { class } ioctl range
// Pattern 2: a
llowxperm
{ source } { target } { class } ioctl range
template
<
typename
Func
>
template
<
typename
Func
>
static
bool
parse_pattern_2
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
static
bool
parse_pattern_2
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
vector
<
vector
<
char
*>>
arr
;
parsed_tokens
arr
;
if
(
!
tokenize_and_check
<
5
,
3
,
4
>
(
stmt
,
arr
)
||
arr
[
3
][
0
]
!=
"ioctl"
sv
)
if
(
!
tokenize_and_check
<
5
,
3
,
4
>
(
stmt
,
arr
)
||
arr
[
3
][
0
]
!=
"ioctl"
sv
)
return
false
;
return
false
;
char
*
range
=
arr
[
4
][
0
];
auto
range
=
arr
[
4
][
0
];
for
(
char
*
src
:
arr
[
0
])
for
(
auto
src
:
arr
[
0
])
for
(
char
*
tgt
:
arr
[
1
])
for
(
auto
tgt
:
arr
[
1
])
for
(
char
*
cls
:
arr
[
2
])
for
(
auto
cls
:
arr
[
2
])
run_fn
(
src
,
tgt
,
cls
,
range
);
run_fn
(
src
,
tgt
,
cls
,
range
);
return
true
;
return
true
;
}
}
// Pattern 3:
action
{ type }
// Pattern 3:
permissive
{ type }
template
<
typename
Func
>
template
<
typename
Func
>
static
bool
parse_pattern_3
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
static
bool
parse_pattern_3
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
vector
<
vector
<
char
*>>
arr
;
parsed_tokens
arr
;
if
(
!
tokenize_and_check
<
1
>
(
stmt
,
arr
))
if
(
!
tokenize_and_check
<
1
>
(
stmt
,
arr
))
return
false
;
return
false
;
for
(
char
*
type
:
arr
[
0
])
for
(
auto
type
:
arr
[
0
])
run_fn
(
type
);
run_fn
(
type
);
return
true
;
return
true
;
}
}
// Pattern 4:
action
{ type } { attribute }
// Pattern 4:
typeattribute
{ type } { attribute }
template
<
typename
Func
>
template
<
typename
Func
>
static
bool
parse_pattern_4
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
static
bool
parse_pattern_4
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
vector
<
vector
<
char
*>>
arr
;
parsed_tokens
arr
;
if
(
!
tokenize_and_check
<
2
>
(
stmt
,
arr
))
if
(
!
tokenize_and_check
<
2
>
(
stmt
,
arr
))
return
false
;
return
false
;
for
(
char
*
type
:
arr
[
0
])
for
(
auto
type
:
arr
[
0
])
for
(
char
*
attr
:
arr
[
1
])
for
(
auto
attr
:
arr
[
1
])
run_fn
(
type
,
attr
);
run_fn
(
type
,
attr
);
return
true
;
return
true
;
}
}
// Pattern 5:
action source target class default
// Pattern 5:
type name { attribute }
template
<
typename
Func
>
template
<
typename
Func
>
static
bool
parse_pattern_5
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
static
bool
parse_pattern_5
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
vector
<
vector
<
char
*>>
arr
;
parsed_tokens
arr
;
if
(
!
tokenize_and_check
<
4
,
0
,
1
,
2
,
3
>
(
stmt
,
arr
))
string
tmp_str
;
if
(
!
tokenize_string
(
stmt
,
arr
))
return
false
;
return
false
;
run_fn
(
arr
[
0
][
0
],
arr
[
1
][
0
],
arr
[
2
][
0
],
arr
[
3
][
0
]);
if
(
arr
.
size
()
==
1
)
{
arr
.
emplace_back
(
initializer_list
<
const
char
*>
{
"domain"
});
}
if
(
!
check_tokens
<
2
,
0
>
(
arr
))
return
false
;
for
(
auto
attr
:
arr
[
1
])
run_fn
(
arr
[
0
][
0
],
attr
);
return
true
;
return
true
;
}
}
// Pattern 6: a
ction source target class default (filename)
// Pattern 6: a
ttribute name
template
<
typename
Func
>
template
<
typename
Func
>
static
bool
parse_pattern_6
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
static
bool
parse_pattern_6
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
vector
<
vector
<
char
*>>
arr
;
parsed_tokens
arr
;
if
(
!
tokenize_and_check
<
1
,
0
>
(
stmt
,
arr
))
return
false
;
run_fn
(
arr
[
0
][
1
]);
return
true
;
}
// Pattern 7: type_transition source target class default (filename)
template
<
typename
Func
>
static
bool
parse_pattern_7
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
parsed_tokens
arr
;
if
(
!
tokenize_string
(
stmt
,
arr
))
if
(
!
tokenize_string
(
stmt
,
arr
))
return
false
;
return
false
;
if
(
arr
.
size
()
==
4
)
if
(
arr
.
size
()
==
4
)
arr
.
emplace_back
(
initializer_list
<
char
*>
{
nullptr
});
arr
.
emplace_back
(
initializer_list
<
c
onst
c
har
*>
{
nullptr
});
if
(
!
check_tokens
<
5
,
0
,
1
,
2
,
3
,
4
>
(
arr
))
if
(
!
check_tokens
<
5
,
0
,
1
,
2
,
3
,
4
>
(
arr
))
return
false
;
return
false
;
run_fn
(
arr
[
0
][
0
],
arr
[
1
][
0
],
arr
[
2
][
0
],
arr
[
3
][
0
],
arr
[
4
][
0
]);
run_fn
(
arr
[
0
][
0
],
arr
[
1
][
0
],
arr
[
2
][
0
],
arr
[
3
][
0
],
arr
[
4
][
0
]);
return
true
;
return
true
;
}
}
// Pattern
7: action name path contex
t
// Pattern
8: type_change source target class defaul
t
template
<
typename
Func
>
template
<
typename
Func
>
static
bool
parse_pattern_7
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
static
bool
parse_pattern_8
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
vector
<
vector
<
char
*>>
arr
;
parsed_tokens
arr
;
if
(
!
tokenize_and_check
<
4
,
0
,
1
,
2
,
3
>
(
stmt
,
arr
))
return
false
;
run_fn
(
arr
[
0
][
0
],
arr
[
1
][
0
],
arr
[
2
][
0
],
arr
[
3
][
0
]);
return
true
;
}
// Pattern 9: genfscon name path context
template
<
typename
Func
>
static
bool
parse_pattern_9
(
const
Func
&
fn
,
const
char
*
action
,
char
*
stmt
)
{
parsed_tokens
arr
;
if
(
!
tokenize_and_check
<
3
,
0
,
1
,
2
>
(
stmt
,
arr
))
if
(
!
tokenize_and_check
<
3
,
0
,
1
,
2
>
(
stmt
,
arr
))
return
false
;
return
false
;
run_fn
(
arr
[
0
][
0
],
arr
[
1
][
0
],
arr
[
2
][
0
]);
run_fn
(
arr
[
0
][
0
],
arr
[
1
][
0
],
arr
[
2
][
0
]);
...
@@ -256,18 +295,20 @@ void sepolicy::parse_statement(const char *stmt) {
...
@@ -256,18 +295,20 @@ void sepolicy::parse_statement(const char *stmt) {
add_action
(
allowxperm
,
2
)
add_action
(
allowxperm
,
2
)
add_action
(
auditallowxperm
,
2
)
add_action
(
auditallowxperm
,
2
)
add_action
(
dontauditxperm
,
2
)
add_action
(
dontauditxperm
,
2
)
add_action
(
create
,
3
)
add_action
(
permissive
,
3
)
add_action
(
permissive
,
3
)
add_action
(
enforce
,
3
)
add_action
(
enforce
,
3
)
add_action
(
typeattribute
,
4
)
add_action
(
typeattribute
,
4
)
add_action
(
type_change
,
5
)
add_action
(
type
,
5
)
add_action
(
type_member
,
5
)
add_action
(
attribute
,
6
)
add_action
(
type_transition
,
6
)
add_action
(
type_transition
,
7
)
add_action
(
genfscon
,
7
)
add_action
(
type_change
,
8
)
add_action
(
type_member
,
8
)
add_action
(
genfscon
,
9
)
// Backwards compatible syntax
// Backwards compatible syntax
add_action
(
create
,
3
)
add_action_func
(
"attradd"
,
4
,
typeattribute
)
add_action_func
(
"attradd"
,
4
,
typeattribute
)
add_action_func
(
"name_transition"
,
6
,
type_transition
)
add_action_func
(
"name_transition"
,
7
,
type_transition
)
else
{
LOGW
(
"Unknown action: '%s'
\n\n
"
,
action
);
}
else
{
LOGW
(
"Unknown action: '%s'
\n\n
"
,
action
);
}
}
}
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment