Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
M
Magisk
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
Magisk
Commits
7cec8baa
Commit
7cec8baa
authored
Jul 18, 2018
by
topjohnwu
Browse files
Options
Browse Files
Download
Plain Diff
Merge magiskpolicy into Magisk main repo
parents
c603b908
e987db9f
Expand all
Hide whitespace changes
Inline
Side-by-side
Showing
6 changed files
with
1373 additions
and
0 deletions
+1373
-0
api.c
native/jni/magiskpolicy/api.c
+71
-0
magiskpolicy.c
native/jni/magiskpolicy/magiskpolicy.c
+484
-0
magiskpolicy.h
native/jni/magiskpolicy/magiskpolicy.h
+36
-0
rules.c
native/jni/magiskpolicy/rules.c
+163
-0
sepolicy.c
native/jni/magiskpolicy/sepolicy.c
+572
-0
sepolicy.h
native/jni/magiskpolicy/sepolicy.h
+47
-0
No files found.
native/jni/magiskpolicy/api.c
0 → 100644
View file @
7cec8baa
#include "magiskpolicy.h"
#include "sepolicy.h"
int
sepol_allow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
// printf("allow %s %s %s %s\n", s, t, c, p);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
0
);
}
int
sepol_deny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
// printf("deny %s %s %s %s\n", s, t, c, p);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
1
);
}
int
sepol_auditallow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
// printf("auditallow %s %s %s %s\n", s, t, c, p);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITALLOW
,
0
);
}
int
sepol_auditdeny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
// printf("auditdeny %s %s %s %s\n", s, t, c, p);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITDENY
,
0
);
}
int
sepol_typetrans
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
,
char
*
o
)
{
if
(
o
==
NULL
)
{
// printf("add_trans %s %s %s %s\n", s, t, c ,d);
return
add_transition
(
s
,
t
,
c
,
d
);
}
else
{
// printf("add_file_trans %s %s %s %s %s\n", s, t, c ,d, o);
return
add_file_transition
(
s
,
t
,
c
,
d
,
o
);
}
}
int
sepol_allowxperm
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
range
)
{
// printf("allowxperm %s %s %s %s\n", s, t, c, range);
return
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_ALLOWED
,
0
);
}
int
sepol_auditallowxperm
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
range
)
{
// printf("auditallowxperm %s %s %s %s\n", s, t, c, range);
return
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_AUDITALLOW
,
0
);
}
int
sepol_dontauditxperm
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
range
)
{
// printf("dontauditxperm %s %s %s %s\n", s, t, c, range);
return
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_DONTAUDIT
,
0
);
}
int
sepol_permissive
(
char
*
s
)
{
// printf("permissive %s\n", s);
return
set_domain_state
(
s
,
1
);
}
int
sepol_enforce
(
char
*
s
)
{
// printf("enforce %s\n", s);
return
set_domain_state
(
s
,
0
);
}
int
sepol_create
(
char
*
s
)
{
// printf("create %s\n", s);
return
create_domain
(
s
);
}
int
sepol_attradd
(
char
*
s
,
char
*
a
)
{
// printf("attradd %s %s\n", s, a);
return
add_typeattribute
(
s
,
a
);
}
int
sepol_exists
(
char
*
source
)
{
return
!!
hashtab_search
(
policydb
->
p_types
.
table
,
source
);
}
native/jni/magiskpolicy/magiskpolicy.c
0 → 100644
View file @
7cec8baa
This diff is collapsed.
Click to expand it.
native/jni/magiskpolicy/magiskpolicy.h
0 → 100644
View file @
7cec8baa
/* magiskpolicy.h - Public API for policy patching
*/
#ifndef _MAGISKPOLICY_H
#define _MAGISKPOLICY_H
#include <stdlib.h>
#define ALL NULL
#define SEPOL_PROC_DOMAIN "magisk"
#define SEPOL_FILE_DOMAIN "magisk_file"
// policydb functions
int
load_policydb
(
const
char
*
filename
);
int
dump_policydb
(
const
char
*
filename
);
void
destroy_policydb
();
// Handy functions
int
sepol_allow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
sepol_deny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
sepol_auditallow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
sepol_auditdeny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
sepol_typetrans
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
,
char
*
o
);
int
sepol_allowxperm
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
range
);
int
sepol_auditallowxperm
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
range
);
int
sepol_dontauditxperm
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
range
);
int
sepol_create
(
char
*
s
);
int
sepol_permissive
(
char
*
s
);
int
sepol_enforce
(
char
*
s
);
int
sepol_attradd
(
char
*
s
,
char
*
a
);
int
sepol_exists
(
char
*
source
);
// Built in rules
void
sepol_magisk_rules
();
#endif
native/jni/magiskpolicy/rules.c
0 → 100644
View file @
7cec8baa
#include "magiskpolicy.h"
#include "sepolicy.h"
void
allowSuClient
(
char
*
target
)
{
if
(
!
sepol_exists
(
target
))
return
;
sepol_allow
(
target
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"connectto"
);
sepol_allow
(
target
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"getopt"
);
sepol_allow
(
target
,
"devpts"
,
"chr_file"
,
"ioctl"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
target
,
"fd"
,
"use"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
target
,
"fifo_file"
,
ALL
);
sepol_allow
(
target
,
SEPOL_PROC_DOMAIN
,
"process"
,
"sigchld"
);
// Allow access to magisk files
sepol_allow
(
target
,
SEPOL_FILE_DOMAIN
,
"sock_file"
,
"read"
);
sepol_allow
(
target
,
SEPOL_FILE_DOMAIN
,
"sock_file"
,
"write"
);
sepol_allow
(
target
,
SEPOL_FILE_DOMAIN
,
"file"
,
ALL
);
sepol_allow
(
target
,
SEPOL_FILE_DOMAIN
,
"dir"
,
ALL
);
// Fix several terminal apps running root shell
if
(
policydb
->
policyvers
>=
POLICYDB_VERSION_XPERMS_IOCTL
)
{
sepol_allowxperm
(
target
,
"devpts"
,
"chr_file"
,
"0x5400-0x54FF"
);
if
(
sepol_exists
(
"untrusted_app_devpts"
))
sepol_allowxperm
(
target
,
"untrusted_app_devpts"
,
"chr_file"
,
"0x5400-0x54FF"
);
if
(
sepol_exists
(
"untrusted_app_25_devpts"
))
sepol_allowxperm
(
target
,
"untrusted_app_25_devpts"
,
"chr_file"
,
"0x5400-0x54FF"
);
if
(
sepol_exists
(
"untrusted_app_all_devpts"
))
sepol_allowxperm
(
target
,
"untrusted_app_all_devpts"
,
"chr_file"
,
"0x5400-0x54FF"
);
}
}
void
suRights
()
{
sepol_allow
(
"servicemanager"
,
SEPOL_PROC_DOMAIN
,
"dir"
,
"search"
);
sepol_allow
(
"servicemanager"
,
SEPOL_PROC_DOMAIN
,
"dir"
,
"read"
);
sepol_allow
(
"servicemanager"
,
SEPOL_PROC_DOMAIN
,
"file"
,
"open"
);
sepol_allow
(
"servicemanager"
,
SEPOL_PROC_DOMAIN
,
"file"
,
"read"
);
sepol_allow
(
"servicemanager"
,
SEPOL_PROC_DOMAIN
,
"process"
,
"getattr"
);
sepol_allow
(
"servicemanager"
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"transfer"
);
sepol_allow
(
"system_server"
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"call"
);
sepol_allow
(
"system_server"
,
SEPOL_PROC_DOMAIN
,
"fd"
,
"use"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"servicemanager"
,
"dir"
,
"search"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"servicemanager"
,
"dir"
,
"read"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"servicemanager"
,
"file"
,
"open"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"servicemanager"
,
"file"
,
"read"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"servicemanager"
,
"process"
,
"getattr"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"servicemanager"
,
"binder"
,
"transfer"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"servicemanager"
,
"binder"
,
"call"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"system_server"
,
"binder"
,
"transfer"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"system_server"
,
"binder"
,
"call"
);
}
void
otherToSU
()
{
// allowLog
sepol_allow
(
"logd"
,
SEPOL_PROC_DOMAIN
,
"dir"
,
"search"
);
sepol_allow
(
"logd"
,
SEPOL_PROC_DOMAIN
,
"file"
,
"read"
);
sepol_allow
(
"logd"
,
SEPOL_PROC_DOMAIN
,
"file"
,
"open"
);
sepol_allow
(
"logd"
,
SEPOL_PROC_DOMAIN
,
"file"
,
"getattr"
);
// suBackL0
sepol_allow
(
"system_server"
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"call"
);
sepol_allow
(
"system_server"
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"transfer"
);
// suBackL6
sepol_allow
(
"surfaceflinger"
,
"app_data_file"
,
"dir"
,
ALL
);
sepol_allow
(
"surfaceflinger"
,
"app_data_file"
,
"file"
,
ALL
);
sepol_allow
(
"surfaceflinger"
,
"app_data_file"
,
"lnk_file"
,
ALL
);
sepol_attradd
(
"surfaceflinger"
,
"mlstrustedsubject"
);
// suMiscL6
if
(
sepol_exists
(
"audioserver"
))
sepol_allow
(
"audioserver"
,
"audioserver"
,
"process"
,
"execmem"
);
// Liveboot
sepol_allow
(
"surfaceflinger"
,
SEPOL_PROC_DOMAIN
,
"process"
,
"ptrace"
);
sepol_allow
(
"surfaceflinger"
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"transfer"
);
sepol_allow
(
"surfaceflinger"
,
SEPOL_PROC_DOMAIN
,
"binder"
,
"call"
);
sepol_allow
(
"surfaceflinger"
,
SEPOL_PROC_DOMAIN
,
"fd"
,
"use"
);
sepol_allow
(
"debuggerd"
,
SEPOL_PROC_DOMAIN
,
"process"
,
"ptrace"
);
// dumpsys
sepol_allow
(
ALL
,
SEPOL_PROC_DOMAIN
,
"fd"
,
"use"
);
sepol_allow
(
ALL
,
SEPOL_PROC_DOMAIN
,
"fifo_file"
,
"write"
);
sepol_allow
(
ALL
,
SEPOL_PROC_DOMAIN
,
"fifo_file"
,
"read"
);
sepol_allow
(
ALL
,
SEPOL_PROC_DOMAIN
,
"fifo_file"
,
"open"
);
sepol_allow
(
ALL
,
SEPOL_PROC_DOMAIN
,
"fifo_file"
,
"getattr"
);
}
void
sepol_magisk_rules
()
{
// First prevent anything to change sepolicy except ourselves
sepol_deny
(
ALL
,
"kernel"
,
"security"
,
"load_policy"
);
if
(
!
sepol_exists
(
SEPOL_PROC_DOMAIN
))
sepol_create
(
SEPOL_PROC_DOMAIN
);
if
(
!
sepol_exists
(
SEPOL_FILE_DOMAIN
))
sepol_create
(
SEPOL_FILE_DOMAIN
);
sepol_permissive
(
SEPOL_PROC_DOMAIN
);
sepol_attradd
(
SEPOL_PROC_DOMAIN
,
"mlstrustedsubject"
);
sepol_attradd
(
SEPOL_PROC_DOMAIN
,
"netdomain"
);
sepol_attradd
(
SEPOL_PROC_DOMAIN
,
"bluetoothdomain"
);
sepol_attradd
(
SEPOL_FILE_DOMAIN
,
"mlstrustedobject"
);
// Let init run stuffs
sepol_allow
(
"kernel"
,
SEPOL_PROC_DOMAIN
,
"fd"
,
"use"
);
sepol_allow
(
"init"
,
SEPOL_PROC_DOMAIN
,
"process"
,
ALL
);
// Shell, properties, logs
if
(
sepol_exists
(
"default_prop"
))
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"default_prop"
,
"property_service"
,
"set"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"init"
,
"unix_stream_socket"
,
"connectto"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"rootfs"
,
"filesystem"
,
"remount"
);
if
(
sepol_exists
(
"logd"
))
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"logd"
,
"unix_stream_socket"
,
"connectto"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
SEPOL_PROC_DOMAIN
,
ALL
,
ALL
);
// For sepolicy live patching
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"kernel"
,
"security"
,
"read_policy"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"kernel"
,
"security"
,
"load_policy"
);
// Allow these client to access su
allowSuClient
(
"init"
);
allowSuClient
(
"shell"
);
allowSuClient
(
"system_app"
);
allowSuClient
(
"priv_app"
);
allowSuClient
(
"platform_app"
);
allowSuClient
(
"untrusted_app"
);
allowSuClient
(
"untrusted_app_25"
);
allowSuClient
(
"untrusted_app_27"
);
// Some superuser stuffs
suRights
();
otherToSU
();
// For mounting loop devices, mirrors, tmpfs
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"kernel"
,
"process"
,
"setsched"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"labeledfs"
,
"filesystem"
,
"mount"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"labeledfs"
,
"filesystem"
,
"unmount"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"tmpfs"
,
"filesystem"
,
"mount"
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
"tmpfs"
,
"filesystem"
,
"unmount"
);
sepol_allow
(
"kernel"
,
ALL
,
"file"
,
"read"
);
// Allow su to do anything to any files/dir/links
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"file"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"dir"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"lnk_file"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"blk_file"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"sock_file"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"chr_file"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"fifo_file"
,
ALL
);
// For changing attributes
sepol_allow
(
"rootfs"
,
"tmpfs"
,
"filesystem"
,
"associate"
);
sepol_allow
(
SEPOL_FILE_DOMAIN
,
"labeledfs"
,
"filesystem"
,
"associate"
);
sepol_allow
(
SEPOL_FILE_DOMAIN
,
"tmpfs"
,
"filesystem"
,
"associate"
);
// Xposed
sepol_allow
(
"untrusted_app"
,
"untrusted_app"
,
"capability"
,
"setgid"
);
sepol_allow
(
"system_server"
,
"dex2oat_exec"
,
"file"
,
ALL
);
// Support deodexed ROM on Oreo
sepol_allow
(
"zygote"
,
"dalvikcache_data_file"
,
"file"
,
"execute"
);
}
native/jni/magiskpolicy/sepolicy.c
0 → 100644
View file @
7cec8baa
This diff is collapsed.
Click to expand it.
native/jni/magiskpolicy/sepolicy.h
0 → 100644
View file @
7cec8baa
/* sepolicy.h - Header for magiskpolicy non-public APIs
*/
#ifndef _SEPOLICY_H
#define _SEPOLICY_H
#include <getopt.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <limits.h>
#include <string.h>
#include <sepol/debug.h>
#include <sepol/policydb/policydb.h>
#include <sepol/policydb/expand.h>
#include <sepol/policydb/link.h>
#include <sepol/policydb/services.h>
#include <sepol/policydb/avrule_block.h>
#include <sepol/policydb/conditional.h>
#include <sepol/policydb/constraint.h>
#include "vector.h"
// hashtab traversal macro
#define hashtab_for_each(table, ptr) \
for (int _i = 0; _i < table->size; ++_i) \
for (*ptr = table->htable[_i]; *ptr != NULL; *ptr = (*ptr)->next)
// Global policydb
extern
policydb_t
*
policydb
;
// sepolicy manipulation functions
int
create_domain
(
char
*
d
);
int
set_domain_state
(
char
*
s
,
int
state
);
int
add_transition
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
);
int
add_file_transition
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
,
char
*
filename
);
int
add_typeattribute
(
char
*
domainS
,
char
*
attr
);
int
add_rule
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
,
int
effect
,
int
not
);
int
add_xperm_rule
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
range
,
int
effect
,
int
not
);
extern
int
policydb_index_decls
(
sepol_handle_t
*
handle
,
policydb_t
*
p
);
#endif
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment