Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
M
Magisk
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
Magisk
Commits
704f9154
Commit
704f9154
authored
Mar 30, 2022
by
topjohnwu
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Reorganize magiskpolicy source code
parent
efb3239c
Show whitespace changes
Inline
Side-by-side
Showing
11 changed files
with
170 additions
and
167 deletions
+170
-167
build.gradle.kts
native/build.gradle.kts
+1
-1
Android.mk
native/jni/Android.mk
+26
-19
selinux.cpp
native/jni/init/selinux.cpp
+1
-1
api.cpp
native/jni/magiskpolicy/api.cpp
+105
-0
sepolicy.hpp
native/jni/magiskpolicy/include/sepolicy.hpp
+3
-6
main.cpp
native/jni/magiskpolicy/main.cpp
+1
-2
policy.hpp
native/jni/magiskpolicy/policy.hpp
+9
-4
policydb.cpp
native/jni/magiskpolicy/policydb.cpp
+8
-12
rules.cpp
native/jni/magiskpolicy/rules.cpp
+2
-3
sepolicy.cpp
native/jni/magiskpolicy/sepolicy.cpp
+13
-117
statement.cpp
native/jni/magiskpolicy/statement.cpp
+1
-2
No files found.
native/build.gradle.kts
View file @
704f9154
...
@@ -15,7 +15,7 @@ android {
...
@@ -15,7 +15,7 @@ android {
externalNativeBuild
{
externalNativeBuild
{
ndkBuild
{
ndkBuild
{
// Pass arguments to ndk-build.
// Pass arguments to ndk-build.
arguments
(
"B_MAGISK=1"
,
"B_INIT=1"
,
"B_BOOT=1"
,
"B_TEST=1"
,
arguments
(
"B_MAGISK=1"
,
"B_INIT=1"
,
"B_BOOT=1"
,
"B_TEST=1"
,
"B_POLICY=1"
,
"MAGISK_DEBUG=1"
,
"MAGISK_VERSION=debug"
,
"MAGISK_VER_CODE=INT_MAX"
)
"MAGISK_DEBUG=1"
,
"MAGISK_VERSION=debug"
,
"MAGISK_VER_CODE=INT_MAX"
)
}
}
}
}
...
...
native/jni/Android.mk
View file @
704f9154
...
@@ -54,7 +54,7 @@ include $(CLEAR_VARS)
...
@@ -54,7 +54,7 @@ include $(CLEAR_VARS)
LOCAL_MODULE := magiskinit
LOCAL_MODULE := magiskinit
LOCAL_STATIC_LIBRARIES := \
LOCAL_STATIC_LIBRARIES := \
libutilx \
libutilx \
lib
sepol
\
lib
policy
\
libxz
libxz
LOCAL_SRC_FILES := \
LOCAL_SRC_FILES := \
...
@@ -63,11 +63,7 @@ LOCAL_SRC_FILES := \
...
@@ -63,11 +63,7 @@ LOCAL_SRC_FILES := \
init/rootdir.cpp \
init/rootdir.cpp \
init/getinfo.cpp \
init/getinfo.cpp \
init/twostage.cpp \
init/twostage.cpp \
init/selinux.cpp \
init/selinux.cpp
magiskpolicy/sepolicy.cpp \
magiskpolicy/rules.cpp \
magiskpolicy/policydb.cpp \
magiskpolicy/statement.cpp
LOCAL_LDFLAGS := -static
LOCAL_LDFLAGS := -static
include $(BUILD_EXECUTABLE)
include $(BUILD_EXECUTABLE)
...
@@ -110,14 +106,9 @@ include $(CLEAR_VARS)
...
@@ -110,14 +106,9 @@ include $(CLEAR_VARS)
LOCAL_MODULE := magiskpolicy
LOCAL_MODULE := magiskpolicy
LOCAL_STATIC_LIBRARIES := \
LOCAL_STATIC_LIBRARIES := \
libutils \
libutils \
lib
sepol
lib
policy
LOCAL_SRC_FILES := \
LOCAL_SRC_FILES := magiskpolicy/main.cpp
magiskpolicy/main.cpp \
magiskpolicy/sepolicy.cpp \
magiskpolicy/rules.cpp \
magiskpolicy/policydb.cpp \
magiskpolicy/statement.cpp
include $(BUILD_EXECUTABLE)
include $(BUILD_EXECUTABLE)
...
@@ -158,14 +149,30 @@ include $(BUILD_EXECUTABLE)
...
@@ -158,14 +149,30 @@ include $(BUILD_EXECUTABLE)
endif
endif
endif
endif
ifdef B_BB
include jni/external/busybox/Android.mk
endif
########################
########################
# Libraries
# Libraries
########################
########################
include $(CLEAR_VARS)
LOCAL_MODULE:= libpolicy
LOCAL_STATIC_LIBRARIES := \
libutils \
libsepol
LOCAL_C_INCLUDES := jni/magiskpolicy jni/magiskpolicy/include
LOCAL_EXPORT_C_INCLUDES := jni/magiskpolicy/include
LOCAL_SRC_FILES := \
magiskpolicy/api.cpp \
magiskpolicy/sepolicy.cpp \
magiskpolicy/rules.cpp \
magiskpolicy/policydb.cpp \
magiskpolicy/statement.cpp
include $(BUILD_STATIC_LIBRARY)
include jni/utils/Android.mk
include jni/utils/Android.mk
include jni/external/Android.mk
include jni/external/Android.mk
ifdef B_BB
include jni/external/busybox/Android.mk
endif
native/jni/init/selinux.cpp
View file @
704f9154
#include <sys/mount.h>
#include <sys/mount.h>
#include <magisk.hpp>
#include <magisk.hpp>
#include <
magisk
policy.hpp>
#include <
se
policy.hpp>
#include <utils.hpp>
#include <utils.hpp>
#include "init.hpp"
#include "init.hpp"
...
...
native/jni/magiskpolicy/api.cpp
0 → 100644
View file @
704f9154
#include <utils.hpp>
#include "policy.hpp"
#if 0
// Print out all rules going through public API for debugging
template <typename ...Args>
static void dprint(const char *action, Args ...args) {
std::string s(action);
for (int i = 0; i < sizeof...(args); ++i) s += " %s";
s += "\n";
LOGD(s.data(), (args ? args : "*")...);
}
#else
#define dprint(...)
#endif
bool
sepolicy
::
allow
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
p
);
return
impl
->
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
false
);
}
bool
sepolicy
::
deny
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
p
);
return
impl
->
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
true
);
}
bool
sepolicy
::
auditallow
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
p
);
return
impl
->
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITALLOW
,
false
);
}
bool
sepolicy
::
dontaudit
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
p
);
return
impl
->
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITDENY
,
true
);
}
bool
sepolicy
::
allowxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
"ioctl"
,
range
);
return
impl
->
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_ALLOWED
,
false
);
}
bool
sepolicy
::
auditallowxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
"ioctl"
,
range
);
return
impl
->
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_AUDITALLOW
,
false
);
}
bool
sepolicy
::
dontauditxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
"ioctl"
,
range
);
return
impl
->
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_DONTAUDIT
,
false
);
}
bool
sepolicy
::
type_change
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
d
);
return
impl
->
add_type_rule
(
s
,
t
,
c
,
d
,
AVTAB_CHANGE
);
}
bool
sepolicy
::
type_member
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
d
);
return
impl
->
add_type_rule
(
s
,
t
,
c
,
d
,
AVTAB_MEMBER
);
}
bool
sepolicy
::
type_transition
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
)
{
if
(
o
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
d
,
o
);
return
impl
->
add_filename_trans
(
s
,
t
,
c
,
d
,
o
);
}
else
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
d
);
return
impl
->
add_type_rule
(
s
,
t
,
c
,
d
,
AVTAB_TRANSITION
);
}
}
bool
sepolicy
::
permissive
(
const
char
*
s
)
{
dprint
(
__FUNCTION__
,
s
);
return
impl
->
set_type_state
(
s
,
true
);
}
bool
sepolicy
::
enforce
(
const
char
*
s
)
{
dprint
(
__FUNCTION__
,
s
);
return
impl
->
set_type_state
(
s
,
false
);
}
bool
sepolicy
::
type
(
const
char
*
name
,
const
char
*
attr
)
{
dprint
(
__FUNCTION__
,
name
,
attr
);
return
impl
->
add_type
(
name
,
TYPE_TYPE
)
&&
impl
->
add_typeattribute
(
name
,
attr
);
}
bool
sepolicy
::
attribute
(
const
char
*
name
)
{
dprint
(
__FUNCTION__
,
name
);
return
impl
->
add_type
(
name
,
TYPE_ATTRIB
);
}
bool
sepolicy
::
typeattribute
(
const
char
*
type
,
const
char
*
attr
)
{
dprint
(
__FUNCTION__
,
type
,
attr
);
return
impl
->
add_typeattribute
(
type
,
attr
);
}
bool
sepolicy
::
genfscon
(
const
char
*
fs_name
,
const
char
*
path
,
const
char
*
ctx
)
{
dprint
(
__FUNCTION__
,
fs_name
,
path
,
ctx
);
return
impl
->
add_genfscon
(
fs_name
,
path
,
ctx
);
}
bool
sepolicy
::
exists
(
const
char
*
type
)
{
return
hashtab_search
(
impl
->
db
->
p_types
.
table
,
type
)
!=
nullptr
;
}
native/jni/
include/magisk
policy.hpp
→
native/jni/
magiskpolicy/include/se
policy.hpp
View file @
704f9154
...
@@ -6,12 +6,8 @@
...
@@ -6,12 +6,8 @@
#define ALL nullptr
#define ALL nullptr
struct
policydb
;
struct
sepolicy
{
class
sepolicy
{
public
:
using
c_str
=
const
char
*
;
using
c_str
=
const
char
*
;
~
sepolicy
();
// Public static factory functions
// Public static factory functions
static
sepolicy
*
from_data
(
char
*
data
,
size_t
len
);
static
sepolicy
*
from_data
(
char
*
data
,
size_t
len
);
...
@@ -59,5 +55,6 @@ public:
...
@@ -59,5 +55,6 @@ public:
bool
create
(
c_str
name
)
{
return
type
(
name
,
"domain"
);
}
bool
create
(
c_str
name
)
{
return
type
(
name
,
"domain"
);
}
protected
:
protected
:
policydb
*
db
;
// Prevent anyone from accidentally creating an instance
sepolicy
()
=
default
;
};
};
native/jni/magiskpolicy/main.cpp
View file @
704f9154
#include <utils.hpp>
#include <utils.hpp>
#include <vector>
#include <vector>
#include <magiskpolicy.hpp>
#include "
se
policy.hpp"
#include "policy.hpp"
using
namespace
std
;
using
namespace
std
;
...
...
native/jni/magiskpolicy/
se
policy.hpp
→
native/jni/magiskpolicy/policy.hpp
View file @
704f9154
#pragma once
#pragma once
// libse internal APIs, do not use directly
#include <sepol/policydb/policydb.h>
#include <sepol/policydb/policydb.h>
#include <
magisk
policy.hpp>
#include <
se
policy.hpp>
// Internal APIs, do not use directly
struct
sepol_impl
:
public
sepolicy
{
struct
sepol_impl
:
public
sepolicy
{
void
check_avtab_node
(
avtab_ptr_t
node
);
avtab_ptr_t
get_avtab_node
(
avtab_key_t
*
key
,
avtab_extended_perms_t
*
xperms
);
avtab_ptr_t
get_avtab_node
(
avtab_key_t
*
key
,
avtab_extended_perms_t
*
xperms
);
bool
add_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
,
int
effect
,
bool
invert
);
bool
add_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
,
int
effect
,
bool
invert
);
void
add_rule
(
type_datum_t
*
src
,
type_datum_t
*
tgt
,
class_datum_t
*
cls
,
perm_datum_t
*
perm
,
int
effect
,
bool
invert
);
void
add_rule
(
type_datum_t
*
src
,
type_datum_t
*
tgt
,
class_datum_t
*
cls
,
perm_datum_t
*
perm
,
int
effect
,
bool
invert
);
...
@@ -20,8 +20,13 @@ struct sepol_impl : public sepolicy {
...
@@ -20,8 +20,13 @@ struct sepol_impl : public sepolicy {
void
add_typeattribute
(
type_datum_t
*
type
,
type_datum_t
*
attr
);
void
add_typeattribute
(
type_datum_t
*
type
,
type_datum_t
*
attr
);
bool
add_typeattribute
(
const
char
*
type
,
const
char
*
attr
);
bool
add_typeattribute
(
const
char
*
type
,
const
char
*
attr
);
void
strip_dontaudit
();
void
strip_dontaudit
();
sepol_impl
(
policydb
*
db
)
:
db
(
db
)
{}
~
sepol_impl
();
policydb
*
db
;
};
};
#define impl
static
_cast<sepol_impl *>(this)
#define impl
reinterpret
_cast<sepol_impl *>(this)
void
statement_help
();
void
statement_help
();
native/jni/magiskpolicy/policydb.cpp
View file @
704f9154
...
@@ -7,9 +7,8 @@
...
@@ -7,9 +7,8 @@
#include <utils.hpp>
#include <utils.hpp>
#include <stream.hpp>
#include <stream.hpp>
#include <magiskpolicy.hpp>
#include "
se
policy.hpp"
#include "policy.hpp"
#define SHALEN 64
#define SHALEN 64
static
bool
cmp_sha256
(
const
char
*
a
,
const
char
*
b
)
{
static
bool
cmp_sha256
(
const
char
*
a
,
const
char
*
b
)
{
...
@@ -95,8 +94,7 @@ sepolicy *sepolicy::from_data(char *data, size_t len) {
...
@@ -95,8 +94,7 @@ sepolicy *sepolicy::from_data(char *data, size_t len) {
return
nullptr
;
return
nullptr
;
}
}
auto
sepol
=
new
sepolicy
();
auto
sepol
=
new
sepol_impl
(
db
);
sepol
->
db
=
db
;
return
sepol
;
return
sepol
;
}
}
...
@@ -116,8 +114,7 @@ sepolicy *sepolicy::from_file(const char *file) {
...
@@ -116,8 +114,7 @@ sepolicy *sepolicy::from_file(const char *file) {
return
nullptr
;
return
nullptr
;
}
}
auto
sepol
=
new
sepolicy
();
auto
sepol
=
new
sepol_impl
(
db
);
sepol
->
db
=
db
;
return
sepol
;
return
sepol
;
}
}
...
@@ -216,8 +213,7 @@ sepolicy *sepolicy::compile_split() {
...
@@ -216,8 +213,7 @@ sepolicy *sepolicy::compile_split() {
if
(
cil_build_policydb
(
db
,
&
pdb
))
if
(
cil_build_policydb
(
db
,
&
pdb
))
return
nullptr
;
return
nullptr
;
auto
sepol
=
new
sepolicy
();
auto
sepol
=
new
sepol_impl
(
&
pdb
->
p
);
sepol
->
db
=
&
pdb
->
p
;
return
sepol
;
return
sepol
;
}
}
...
@@ -232,7 +228,7 @@ sepolicy *sepolicy::from_split() {
...
@@ -232,7 +228,7 @@ sepolicy *sepolicy::from_split() {
return
sepolicy
::
compile_split
();
return
sepolicy
::
compile_split
();
}
}
sepol
icy
::~
sepolicy
()
{
sepol
_impl
::~
sepol_impl
()
{
policydb_destroy
(
db
);
policydb_destroy
(
db
);
free
(
db
);
free
(
db
);
}
}
...
@@ -241,8 +237,8 @@ bool sepolicy::to_file(const char *file) {
...
@@ -241,8 +237,8 @@ bool sepolicy::to_file(const char *file) {
uint8_t
*
data
;
uint8_t
*
data
;
size_t
len
;
size_t
len
;
/
*
No partial writes are allowed to /sys/fs/selinux/load, thus the reason why we
/
/
No partial writes are allowed to /sys/fs/selinux/load, thus the reason why we
* first dump everything into memory, then directly call write system call */
// first dump everything into memory, then directly call write system call
auto
fp
=
make_stream_fp
<
byte_stream
>
(
data
,
len
);
auto
fp
=
make_stream_fp
<
byte_stream
>
(
data
,
len
);
run_finally
fin
([
=
]{
free
(
data
);
});
run_finally
fin
([
=
]{
free
(
data
);
});
...
@@ -251,7 +247,7 @@ bool sepolicy::to_file(const char *file) {
...
@@ -251,7 +247,7 @@ bool sepolicy::to_file(const char *file) {
policy_file_init
(
&
pf
);
policy_file_init
(
&
pf
);
pf
.
type
=
PF_USE_STDIO
;
pf
.
type
=
PF_USE_STDIO
;
pf
.
fp
=
fp
.
get
();
pf
.
fp
=
fp
.
get
();
if
(
policydb_write
(
db
,
&
pf
))
{
if
(
policydb_write
(
impl
->
db
,
&
pf
))
{
LOGE
(
"Fail to create policy image
\n
"
);
LOGE
(
"Fail to create policy image
\n
"
);
return
false
;
return
false
;
}
}
...
...
native/jni/magiskpolicy/rules.cpp
View file @
704f9154
#include <utils.hpp>
#include <utils.hpp>
#include <magiskpolicy.hpp>
#include "
se
policy.hpp"
#include "policy.hpp"
using
namespace
std
;
using
namespace
std
;
...
@@ -27,7 +26,7 @@ void sepolicy::magisk_rules() {
...
@@ -27,7 +26,7 @@ void sepolicy::magisk_rules() {
// Make our root domain unconstrained
// Make our root domain unconstrained
allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
ALL
,
ALL
);
allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
ALL
,
ALL
);
// Allow us to do any ioctl
// Allow us to do any ioctl
if
(
db
->
policyvers
>=
POLICYDB_VERSION_XPERMS_IOCTL
)
{
if
(
impl
->
db
->
policyvers
>=
POLICYDB_VERSION_XPERMS_IOCTL
)
{
allowxperm
(
SEPOL_PROC_DOMAIN
,
ALL
,
"blk_file"
,
ALL
);
allowxperm
(
SEPOL_PROC_DOMAIN
,
ALL
,
"blk_file"
,
ALL
);
allowxperm
(
SEPOL_PROC_DOMAIN
,
ALL
,
"fifo_file"
,
ALL
);
allowxperm
(
SEPOL_PROC_DOMAIN
,
ALL
,
"fifo_file"
,
ALL
);
allowxperm
(
SEPOL_PROC_DOMAIN
,
ALL
,
"chr_file"
,
ALL
);
allowxperm
(
SEPOL_PROC_DOMAIN
,
ALL
,
"chr_file"
,
ALL
);
...
...
native/jni/magiskpolicy/sepolicy.cpp
View file @
704f9154
#include <sepol/policydb/policydb.h>
#include <magiskpolicy.hpp>
#include <utils.hpp>
#include <utils.hpp>
#include "sepolicy.hpp"
#include "policy.hpp"
#if 0
// Print out all rules going through public API for debugging
template <typename ...Args>
static void dprint(const char *action, Args ...args) {
std::string s(action);
for (int i = 0; i < sizeof...(args); ++i) s += " %s";
s += "\n";
LOGD(s.data(), (args ? args : "*")...);
}
#else
#define dprint(...)
#endif
// Invert is adding rules for auditdeny; in other cases, invert is removing rules
// Invert is adding rules for auditdeny; in other cases, invert is removing rules
#define strip_av(effect, invert) ((effect == AVTAB_AUDITDENY) == !invert)
#define strip_av(effect, invert) ((effect == AVTAB_AUDITDENY) == !invert)
...
@@ -106,16 +90,15 @@ static int avtab_remove_node(avtab_t *h, avtab_ptr_t node) {
...
@@ -106,16 +90,15 @@ static int avtab_remove_node(avtab_t *h, avtab_ptr_t node) {
return
0
;
return
0
;
}
}
void
sepol_impl
::
check_avtab_node
(
avtab_ptr_t
node
)
{
static
bool
is_redundant
(
avtab_ptr_t
node
)
{
bool
redundant
;
switch
(
node
->
key
.
specified
)
{
if
(
node
->
key
.
specified
==
AVTAB_AUDITDENY
)
case
AVTAB_AUDITDENY
:
redundant
=
node
->
datum
.
data
==
~
0U
;
return
node
->
datum
.
data
==
~
0U
;
else
if
(
node
->
key
.
specified
&
AVTAB_XPERMS
)
case
AVTAB_XPERMS
:
redundant
=
node
->
datum
.
xperms
==
nullptr
;
return
node
->
datum
.
xperms
==
nullptr
;
else
default
:
redundant
=
node
->
datum
.
data
==
0U
;
return
node
->
datum
.
data
==
0U
;
if
(
redundant
)
}
avtab_remove_node
(
&
db
->
te_avtab
,
node
);
}
}
avtab_ptr_t
sepol_impl
::
get_avtab_node
(
avtab_key_t
*
key
,
avtab_extended_perms_t
*
xperms
)
{
avtab_ptr_t
sepol_impl
::
get_avtab_node
(
avtab_key_t
*
key
,
avtab_extended_perms_t
*
xperms
)
{
...
@@ -199,7 +182,9 @@ void sepol_impl::add_rule(type_datum_t *src, type_datum_t *tgt, class_datum_t *c
...
@@ -199,7 +182,9 @@ void sepol_impl::add_rule(type_datum_t *src, type_datum_t *tgt, class_datum_t *c
else
else
node
->
datum
.
data
=
~
0U
;
node
->
datum
.
data
=
~
0U
;
}
}
check_avtab_node
(
node
);
if
(
is_redundant
(
node
))
avtab_remove_node
(
&
db
->
te_avtab
,
node
);
}
}
}
}
...
@@ -622,92 +607,3 @@ void sepol_impl::strip_dontaudit() {
...
@@ -622,92 +607,3 @@ void sepol_impl::strip_dontaudit() {
avtab_remove_node
(
&
db
->
te_avtab
,
node
);
avtab_remove_node
(
&
db
->
te_avtab
,
node
);
});
});
}
}
bool
sepolicy
::
allow
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
p
);
return
impl
->
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
false
);
}
bool
sepolicy
::
deny
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
p
);
return
impl
->
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
true
);
}
bool
sepolicy
::
auditallow
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
p
);
return
impl
->
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITALLOW
,
false
);
}
bool
sepolicy
::
dontaudit
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
p
);
return
impl
->
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITDENY
,
true
);
}
bool
sepolicy
::
allowxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
"ioctl"
,
range
);
return
impl
->
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_ALLOWED
,
false
);
}
bool
sepolicy
::
auditallowxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
"ioctl"
,
range
);
return
impl
->
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_AUDITALLOW
,
false
);
}
bool
sepolicy
::
dontauditxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
"ioctl"
,
range
);
return
impl
->
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_DONTAUDIT
,
false
);
}
bool
sepolicy
::
type_change
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
d
);
return
impl
->
add_type_rule
(
s
,
t
,
c
,
d
,
AVTAB_CHANGE
);
}
bool
sepolicy
::
type_member
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
d
);
return
impl
->
add_type_rule
(
s
,
t
,
c
,
d
,
AVTAB_MEMBER
);
}
bool
sepolicy
::
type_transition
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
)
{
if
(
o
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
d
,
o
);
return
impl
->
add_filename_trans
(
s
,
t
,
c
,
d
,
o
);
}
else
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
d
);
return
impl
->
add_type_rule
(
s
,
t
,
c
,
d
,
AVTAB_TRANSITION
);
}
}
bool
sepolicy
::
permissive
(
const
char
*
s
)
{
dprint
(
__FUNCTION__
,
s
);
return
impl
->
set_type_state
(
s
,
true
);
}
bool
sepolicy
::
enforce
(
const
char
*
s
)
{
dprint
(
__FUNCTION__
,
s
);
return
impl
->
set_type_state
(
s
,
false
);
}
bool
sepolicy
::
type
(
const
char
*
name
,
const
char
*
attr
)
{
dprint
(
__FUNCTION__
,
name
,
attr
);
return
impl
->
add_type
(
name
,
TYPE_TYPE
)
&&
impl
->
add_typeattribute
(
name
,
attr
);
}
bool
sepolicy
::
attribute
(
const
char
*
name
)
{
dprint
(
__FUNCTION__
,
name
);
return
impl
->
add_type
(
name
,
TYPE_ATTRIB
);
}
bool
sepolicy
::
typeattribute
(
const
char
*
type
,
const
char
*
attr
)
{
dprint
(
__FUNCTION__
,
type
,
attr
);
return
impl
->
add_typeattribute
(
type
,
attr
);
}
bool
sepolicy
::
genfscon
(
const
char
*
fs_name
,
const
char
*
path
,
const
char
*
ctx
)
{
dprint
(
__FUNCTION__
,
fs_name
,
path
,
ctx
);
return
impl
->
add_genfscon
(
fs_name
,
path
,
ctx
);
}
bool
sepolicy
::
exists
(
const
char
*
source
)
{
return
hashtab_search
(
db
->
p_types
.
table
,
source
)
!=
nullptr
;
}
native/jni/magiskpolicy/statement.cpp
View file @
704f9154
...
@@ -2,10 +2,9 @@
...
@@ -2,10 +2,9 @@
#include <vector>
#include <vector>
#include <string>
#include <string>
#include <magiskpolicy.hpp>
#include <utils.hpp>
#include <utils.hpp>
#include "
se
policy.hpp"
#include "policy.hpp"
using
namespace
std
;
using
namespace
std
;
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment