Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
M
Magisk
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
Magisk
Commits
5f53cfb4
Commit
5f53cfb4
authored
Apr 30, 2019
by
topjohnwu
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Update sepolicy rules
parent
a2fa8d8b
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
10 additions
and
15 deletions
+10
-15
rules.cpp
native/jni/magiskpolicy/rules.cpp
+10
-15
No files found.
native/jni/magiskpolicy/rules.cpp
View file @
5f53cfb4
...
@@ -2,6 +2,7 @@
...
@@ -2,6 +2,7 @@
#include "magiskpolicy.h"
#include "magiskpolicy.h"
#include "sepolicy.h"
#include "sepolicy.h"
#include "flags.h"
static
void
allowSuClient
(
const
char
*
target
)
{
static
void
allowSuClient
(
const
char
*
target
)
{
if
(
!
sepol_exists
(
target
))
if
(
!
sepol_exists
(
target
))
...
@@ -14,18 +15,6 @@ static void allowSuClient(const char *target) {
...
@@ -14,18 +15,6 @@ static void allowSuClient(const char *target) {
// Allow binder service
// Allow binder service
sepol_allow
(
target
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"call"
);
sepol_allow
(
target
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"call"
);
sepol_allow
(
target
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"transfer"
);
sepol_allow
(
target
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"transfer"
);
// Allow termios ioctl
sepol_allow
(
target
,
"devpts"
,
"chr_file"
,
"ioctl"
);
sepol_allow
(
target
,
"untrusted_app_devpts"
,
"chr_file"
,
"ioctl"
);
sepol_allow
(
target
,
"untrusted_app_25_devpts"
,
"chr_file"
,
"ioctl"
);
sepol_allow
(
target
,
"untrusted_app_all_devpts"
,
"chr_file"
,
"ioctl"
);
if
(
policydb
->
policyvers
>=
POLICYDB_VERSION_XPERMS_IOCTL
)
{
sepol_allowxperm
(
target
,
"devpts"
,
"chr_file"
,
"0x5400-0x54FF"
);
sepol_allowxperm
(
target
,
"untrusted_app_devpts"
,
"chr_file"
,
"0x5400-0x54FF"
);
sepol_allowxperm
(
target
,
"untrusted_app_25_devpts"
,
"chr_file"
,
"0x5400-0x54FF"
);
sepol_allowxperm
(
target
,
"untrusted_app_all_devpts"
,
"chr_file"
,
"0x5400-0x54FF"
);
}
}
}
void
sepol_magisk_rules
()
{
void
sepol_magisk_rules
()
{
...
@@ -47,7 +36,7 @@ void sepol_magisk_rules() {
...
@@ -47,7 +36,7 @@ void sepol_magisk_rules() {
sepol_attradd
(
SEPOL_PROC_DOMAIN
,
"bluetoothdomain"
);
sepol_attradd
(
SEPOL_PROC_DOMAIN
,
"bluetoothdomain"
);
sepol_attradd
(
SEPOL_FILE_DOMAIN
,
"mlstrustedobject"
);
sepol_attradd
(
SEPOL_FILE_DOMAIN
,
"mlstrustedobject"
);
// Let init
daemon transit context
// Let init
transit to SEPOL_PROC_DOMAIN
sepol_allow
(
"kernel"
,
"kernel"
,
"process"
,
"setcurrent"
);
sepol_allow
(
"kernel"
,
"kernel"
,
"process"
,
"setcurrent"
);
sepol_allow
(
"kernel"
,
SEPOL_PROC_DOMAIN
,
"process"
,
"dyntransition"
);
sepol_allow
(
"kernel"
,
SEPOL_PROC_DOMAIN
,
"process"
,
"dyntransition"
);
...
@@ -148,7 +137,7 @@ void sepol_magisk_rules() {
...
@@ -148,7 +137,7 @@ void sepol_magisk_rules() {
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"tmpfs"
,
"filesystem"
,
"unmount"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"tmpfs"
,
"filesystem"
,
"unmount"
);
sepol_allow
(
"kernel"
,
ALL
,
"file"
,
"read"
);
sepol_allow
(
"kernel"
,
ALL
,
"file"
,
"read"
);
// Allow
su
to do anything to any files/dir/links
// Allow
us
to do anything to any files/dir/links
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"file"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"file"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"dir"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"dir"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"lnk_file"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"lnk_file"
,
ALL
);
...
@@ -157,6 +146,10 @@ void sepol_magisk_rules() {
...
@@ -157,6 +146,10 @@ void sepol_magisk_rules() {
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"chr_file"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"chr_file"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"fifo_file"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"fifo_file"
,
ALL
);
// Allow us to do any ioctl on all block devices
if
(
policydb
->
policyvers
>=
POLICYDB_VERSION_XPERMS_IOCTL
)
sepol_allowxperm
(
SEPOL_PROC_DOMAIN
,
ALL
,
"blk_file"
,
"0x0000-0xFFFF"
);
// Allow all binder transactions
// Allow all binder transactions
sepol_allow
(
ALL
,
SEPOL_PROC_DOMAIN
,
"binder"
,
ALL
);
sepol_allow
(
ALL
,
SEPOL_PROC_DOMAIN
,
"binder"
,
ALL
);
...
@@ -184,12 +177,14 @@ void sepol_magisk_rules() {
...
@@ -184,12 +177,14 @@ void sepol_magisk_rules() {
// Allow update engine to source addon.d.sh
// Allow update engine to source addon.d.sh
sepol_allow
(
"update_engine"
,
"adb_data_file"
,
"dir"
,
ALL
);
sepol_allow
(
"update_engine"
,
"adb_data_file"
,
"dir"
,
ALL
);
// Remove all dontaudit
#ifdef MAGISK_DEBUG
// Remove all dontaudit in debug mode
avtab_ptr_t
av
;
avtab_ptr_t
av
;
avtab_for_each
(
&
policydb
->
te_avtab
,
av
,
{
avtab_for_each
(
&
policydb
->
te_avtab
,
av
,
{
if
(
av
->
key
.
specified
==
AVTAB_AUDITDENY
||
av
->
key
.
specified
==
AVTAB_XPERMS_DONTAUDIT
)
if
(
av
->
key
.
specified
==
AVTAB_AUDITDENY
||
av
->
key
.
specified
==
AVTAB_XPERMS_DONTAUDIT
)
avtab_remove_node
(
&
policydb
->
te_avtab
,
av
);
avtab_remove_node
(
&
policydb
->
te_avtab
,
av
);
})
})
#endif
log_cb
.
w
=
bak
;
log_cb
.
w
=
bak
;
}
}
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment