Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
M
Magisk
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
Magisk
Commits
599ee57d
Commit
599ee57d
authored
May 25, 2020
by
topjohnwu
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Simplify sepolicy rules
parent
4499cebc
Show whitespace changes
Inline
Side-by-side
Showing
2 changed files
with
15 additions
and
61 deletions
+15
-61
rootdir.cpp
native/jni/init/rootdir.cpp
+0
-1
rules.cpp
native/jni/magiskpolicy/rules.cpp
+15
-60
No files found.
native/jni/init/rootdir.cpp
View file @
599ee57d
...
@@ -152,7 +152,6 @@ bool MagiskInit::patch_sepolicy(const char *file) {
...
@@ -152,7 +152,6 @@ bool MagiskInit::patch_sepolicy(const char *file) {
sepol
=
sepolicy
::
from_split
();
sepol
=
sepolicy
::
from_split
();
sepol
->
magisk_rules
();
sepol
->
magisk_rules
();
sepol
->
allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
ALL
,
ALL
);
// Custom rules
// Custom rules
if
(
auto
dir
=
open_dir
(
persist_dir
.
data
());
dir
)
{
if
(
auto
dir
=
open_dir
(
persist_dir
.
data
());
dir
)
{
...
...
native/jni/magiskpolicy/rules.cpp
View file @
599ee57d
...
@@ -11,8 +11,6 @@ void sepol_impl::allow_su_client(const char *type) {
...
@@ -11,8 +11,6 @@ void sepol_impl::allow_su_client(const char *type) {
return
;
return
;
allow
(
type
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"connectto"
);
allow
(
type
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"connectto"
);
allow
(
type
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"getopt"
);
allow
(
type
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"getopt"
);
allow
(
SEPOL_PROC_DOMAIN
,
type
,
"fd"
,
"use"
);
allow
(
SEPOL_PROC_DOMAIN
,
type
,
"fifo_file"
,
ALL
);
// Allow binder service
// Allow binder service
allow
(
type
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"call"
);
allow
(
type
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"call"
);
...
@@ -36,15 +34,12 @@ void sepolicy::magisk_rules() {
...
@@ -36,15 +34,12 @@ void sepolicy::magisk_rules() {
auto
bak
=
log_cb
.
w
;
auto
bak
=
log_cb
.
w
;
log_cb
.
w
=
nop_log
;
log_cb
.
w
=
nop_log
;
//
First p
revent anything to change sepolicy except ourselves
//
P
revent anything to change sepolicy except ourselves
deny
(
ALL
,
"kernel"
,
"security"
,
"load_policy"
);
deny
(
ALL
,
"kernel"
,
"security"
,
"load_policy"
);
if
(
!
exists
(
SEPOL_PROC_DOMAIN
))
type
(
SEPOL_PROC_DOMAIN
,
"domain"
);
create
(
SEPOL_PROC_DOMAIN
);
type
(
SEPOL_FILE_DOMAIN
,
"file_type"
);
if
(
!
exists
(
SEPOL_FILE_DOMAIN
))
create
(
SEPOL_FILE_DOMAIN
);
permissive
(
SEPOL_PROC_DOMAIN
);
permissive
(
SEPOL_PROC_DOMAIN
);
typeattribute
(
SEPOL_PROC_DOMAIN
,
"mlstrustedsubject"
);
typeattribute
(
SEPOL_PROC_DOMAIN
,
"mlstrustedsubject"
);
typeattribute
(
SEPOL_PROC_DOMAIN
,
"netdomain"
);
typeattribute
(
SEPOL_PROC_DOMAIN
,
"netdomain"
);
typeattribute
(
SEPOL_PROC_DOMAIN
,
"bluetoothdomain"
);
typeattribute
(
SEPOL_PROC_DOMAIN
,
"bluetoothdomain"
);
...
@@ -66,18 +61,17 @@ void sepolicy::magisk_rules() {
...
@@ -66,18 +61,17 @@ void sepolicy::magisk_rules() {
allow
(
"init"
,
"tmpfs"
,
"file"
,
"getattr"
);
allow
(
"init"
,
"tmpfs"
,
"file"
,
"getattr"
);
allow
(
"init"
,
"tmpfs"
,
"file"
,
"execute"
);
allow
(
"init"
,
"tmpfs"
,
"file"
,
"execute"
);
// Shell, properties, logs
// Make our domain unconstrained
if
(
exists
(
"default_prop"
))
allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
ALL
,
ALL
);
allow
(
SEPOL_PROC_DOMAIN
,
"default_prop"
,
"property_service"
,
"set"
);
// Allow us to do any ioctl on all block devices
allow
(
SEPOL_PROC_DOMAIN
,
"init"
,
"unix_stream_socket"
,
"connectto"
);
if
(
db
->
policyvers
>=
POLICYDB_VERSION_XPERMS_IOCTL
)
allow
(
SEPOL_PROC_DOMAIN
,
"rootfs"
,
"filesystem"
,
"remount"
);
allowxperm
(
SEPOL_PROC_DOMAIN
,
ALL
,
"blk_file"
,
ALL
);
if
(
exists
(
"logd"
))
allow
(
SEPOL_PROC_DOMAIN
,
"logd"
,
"unix_stream_socket"
,
"connectto"
);
allow
(
SEPOL_PROC_DOMAIN
,
SEPOL_PROC_DOMAIN
,
ALL
,
ALL
);
// For sepolicy live patching
// Make our file type unconstrained
allow
(
SEPOL_PROC_DOMAIN
,
"kernel"
,
"security"
,
"read_policy"
);
allow
(
ALL
,
SEPOL_FILE_DOMAIN
,
"file"
,
ALL
);
allow
(
SEPOL_PROC_DOMAIN
,
"kernel"
,
"security"
,
"load_policy"
);
allow
(
ALL
,
SEPOL_FILE_DOMAIN
,
"dir"
,
ALL
);
allow
(
ALL
,
SEPOL_FILE_DOMAIN
,
"fifo_file"
,
ALL
);
allow
(
ALL
,
SEPOL_FILE_DOMAIN
,
"chr_file"
,
ALL
);
// Allow these processes to access MagiskSU
// Allow these processes to access MagiskSU
std
::
initializer_list
<
const
char
*>
clients
{
std
::
initializer_list
<
const
char
*>
clients
{
...
@@ -93,13 +87,6 @@ void sepolicy::magisk_rules() {
...
@@ -93,13 +87,6 @@ void sepolicy::magisk_rules() {
allow
(
"servicemanager"
,
SEPOL_PROC_DOMAIN
,
"file"
,
"read"
);
allow
(
"servicemanager"
,
SEPOL_PROC_DOMAIN
,
"file"
,
"read"
);
allow
(
"servicemanager"
,
SEPOL_PROC_DOMAIN
,
"process"
,
"getattr"
);
allow
(
"servicemanager"
,
SEPOL_PROC_DOMAIN
,
"process"
,
"getattr"
);
allow
(
"servicemanager"
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"transfer"
);
allow
(
"servicemanager"
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"transfer"
);
allow
(
SEPOL_PROC_DOMAIN
,
"servicemanager"
,
"dir"
,
"search"
);
allow
(
SEPOL_PROC_DOMAIN
,
"servicemanager"
,
"dir"
,
"read"
);
allow
(
SEPOL_PROC_DOMAIN
,
"servicemanager"
,
"file"
,
"open"
);
allow
(
SEPOL_PROC_DOMAIN
,
"servicemanager"
,
"file"
,
"read"
);
allow
(
SEPOL_PROC_DOMAIN
,
"servicemanager"
,
"process"
,
"getattr"
);
allow
(
SEPOL_PROC_DOMAIN
,
"servicemanager"
,
"binder"
,
"transfer"
);
allow
(
SEPOL_PROC_DOMAIN
,
"servicemanager"
,
"binder"
,
"call"
);
allow
(
ALL
,
SEPOL_PROC_DOMAIN
,
"process"
,
"sigchld"
);
allow
(
ALL
,
SEPOL_PROC_DOMAIN
,
"process"
,
"sigchld"
);
// allowLog
// allowLog
...
@@ -108,12 +95,6 @@ void sepolicy::magisk_rules() {
...
@@ -108,12 +95,6 @@ void sepolicy::magisk_rules() {
allow
(
"logd"
,
SEPOL_PROC_DOMAIN
,
"file"
,
"open"
);
allow
(
"logd"
,
SEPOL_PROC_DOMAIN
,
"file"
,
"open"
);
allow
(
"logd"
,
SEPOL_PROC_DOMAIN
,
"file"
,
"getattr"
);
allow
(
"logd"
,
SEPOL_PROC_DOMAIN
,
"file"
,
"getattr"
);
// suBackL0
allow
(
"system_server"
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"call"
);
allow
(
"system_server"
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"transfer"
);
allow
(
SEPOL_PROC_DOMAIN
,
"system_server"
,
"binder"
,
"call"
);
allow
(
SEPOL_PROC_DOMAIN
,
"system_server"
,
"binder"
,
"transfer"
);
// suBackL6
// suBackL6
allow
(
"surfaceflinger"
,
"app_data_file"
,
"dir"
,
ALL
);
allow
(
"surfaceflinger"
,
"app_data_file"
,
"dir"
,
ALL
);
allow
(
"surfaceflinger"
,
"app_data_file"
,
"file"
,
ALL
);
allow
(
"surfaceflinger"
,
"app_data_file"
,
"file"
,
ALL
);
...
@@ -121,7 +102,6 @@ void sepolicy::magisk_rules() {
...
@@ -121,7 +102,6 @@ void sepolicy::magisk_rules() {
typeattribute
(
"surfaceflinger"
,
"mlstrustedsubject"
);
typeattribute
(
"surfaceflinger"
,
"mlstrustedsubject"
);
// suMiscL6
// suMiscL6
if
(
exists
(
"audioserver"
))
allow
(
"audioserver"
,
"audioserver"
,
"process"
,
"execmem"
);
allow
(
"audioserver"
,
"audioserver"
,
"process"
,
"execmem"
);
// Liveboot
// Liveboot
...
@@ -146,38 +126,13 @@ void sepolicy::magisk_rules() {
...
@@ -146,38 +126,13 @@ void sepolicy::magisk_rules() {
allow
(
"hwservicemanager"
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"transfer"
);
allow
(
"hwservicemanager"
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"transfer"
);
// For mounting loop devices, mirrors, tmpfs
// For mounting loop devices, mirrors, tmpfs
allow
(
SEPOL_PROC_DOMAIN
,
"kernel"
,
"process"
,
"setsched"
);
allow
(
SEPOL_PROC_DOMAIN
,
"labeledfs"
,
"filesystem"
,
"mount"
);
allow
(
SEPOL_PROC_DOMAIN
,
"labeledfs"
,
"filesystem"
,
"unmount"
);
allow
(
SEPOL_PROC_DOMAIN
,
"tmpfs"
,
"filesystem"
,
"mount"
);
allow
(
SEPOL_PROC_DOMAIN
,
"tmpfs"
,
"filesystem"
,
"unmount"
);
allow
(
"kernel"
,
ALL
,
"file"
,
"read"
);
allow
(
"kernel"
,
ALL
,
"file"
,
"read"
);
allow
(
"kernel"
,
ALL
,
"file"
,
"write"
);
allow
(
"kernel"
,
ALL
,
"file"
,
"write"
);
// Allow us to do anything to any files/dir/links
allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"file"
,
ALL
);
allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"dir"
,
ALL
);
allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"lnk_file"
,
ALL
);
allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"blk_file"
,
ALL
);
allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"sock_file"
,
ALL
);
allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"chr_file"
,
ALL
);
allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"fifo_file"
,
ALL
);
// Allow us to do any ioctl on all block devices
if
(
db
->
policyvers
>=
POLICYDB_VERSION_XPERMS_IOCTL
)
allowxperm
(
SEPOL_PROC_DOMAIN
,
ALL
,
"blk_file"
,
"0x0000-0xFFFF"
);
// Allow all binder transactions
// Allow all binder transactions
allow
(
ALL
,
SEPOL_PROC_DOMAIN
,
"binder"
,
ALL
);
allow
(
ALL
,
SEPOL_PROC_DOMAIN
,
"binder"
,
ALL
);
// Super files
// For changing file context
allow
(
ALL
,
SEPOL_FILE_DOMAIN
,
"file"
,
ALL
);
allow
(
ALL
,
SEPOL_FILE_DOMAIN
,
"dir"
,
ALL
);
allow
(
ALL
,
SEPOL_FILE_DOMAIN
,
"fifo_file"
,
ALL
);
allow
(
ALL
,
SEPOL_FILE_DOMAIN
,
"chr_file"
,
ALL
);
allow
(
SEPOL_FILE_DOMAIN
,
ALL
,
"filesystem"
,
"associate"
);
// For changing attributes
allow
(
"rootfs"
,
"tmpfs"
,
"filesystem"
,
"associate"
);
allow
(
"rootfs"
,
"tmpfs"
,
"filesystem"
,
"associate"
);
// Xposed
// Xposed
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment