Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
M
Magisk
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
Magisk
Commits
838b2757
Commit
838b2757
authored
Apr 15, 2017
by
topjohnwu
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Separate public and private APIs
parent
7bb8b903
Show whitespace changes
Inline
Side-by-side
Showing
7 changed files
with
254 additions
and
233 deletions
+254
-233
Android.mk
Android.mk
+1
-1
api.c
api.c
+11
-10
magiskpolicy.c
magiskpolicy.c
+18
-13
magiskpolicy.h
magiskpolicy.h
+17
-51
rules.c
rules.c
+158
-158
sepolicy.c
sepolicy.c
+1
-0
sepolicy.h
sepolicy.h
+48
-0
No files found.
Android.mk
View file @
838b2757
...
...
@@ -3,7 +3,7 @@ LOCAL_PATH := $(call my-dir)
include $(CLEAR_VARS)
LOCAL_MODULE := magiskpolicy
LOCAL_STATIC_LIBRARIES := libsepol
LOCAL_SRC_FILES := magiskpolicy.c sepolicy.c rules.c
utils
.c ../utils/vector.c
LOCAL_SRC_FILES := magiskpolicy.c sepolicy.c rules.c
api
.c ../utils/vector.c
LOCAL_C_INCLUDES := jni/selinux/libsepol/include jni/utils
LOCAL_CFLAGS := -DINDEP_BINARY
include $(BUILD_EXECUTABLE)
...
...
utils
.c
→
api
.c
View file @
838b2757
#include "magiskpolicy.h"
#include "sepolicy.h"
int
allow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
int
sepol_
allow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
0
);
}
int
deny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
int
sepol_
deny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
1
);
}
int
auditallow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
int
sepol_
auditallow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITALLOW
,
0
);
}
int
auditdeny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
int
sepol_
auditdeny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITDENY
,
0
);
}
int
typetrans
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
,
char
*
o
)
{
int
sepol_
typetrans
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
,
char
*
o
)
{
if
(
o
==
NULL
)
return
add_transition
(
s
,
t
,
c
,
d
);
else
return
add_file_transition
(
s
,
t
,
c
,
d
,
o
);
}
int
permissive
(
char
*
s
)
{
int
sepol_
permissive
(
char
*
s
)
{
return
set_domain_state
(
s
,
1
);
}
int
enforce
(
char
*
s
)
{
int
sepol_
enforce
(
char
*
s
)
{
return
set_domain_state
(
s
,
0
);
}
int
create
(
char
*
s
)
{
int
sepol_
create
(
char
*
s
)
{
return
create_domain
(
s
);
}
int
attradd
(
char
*
s
,
char
*
a
)
{
int
sepol_
attradd
(
char
*
s
,
char
*
a
)
{
return
add_typeattribute
(
s
,
a
);
}
int
exists
(
char
*
source
)
{
int
sepol_
exists
(
char
*
source
)
{
return
!!
hashtab_search
(
policy
->
p_types
.
table
,
source
);
}
magiskpolicy.c
View file @
838b2757
#include "vector.h"
#include "magiskpolicy.h"
/* magiskpolicy.c - Main function for policy patching
*
* Includes all the parsing logic for the policy statements
*/
#ifdef INDEP_BINARY
int
magiskpolicy_main
(
int
argc
,
char
*
argv
[]);
...
...
@@ -10,6 +12,9 @@ int main(int argc, char *argv[]) {
#include "magisk.h"
#endif
#include "magiskpolicy.h"
#include "sepolicy.h"
static
int
syntax_err
=
0
;
static
char
err_msg
[
ARG_MAX
];
...
...
@@ -112,19 +117,19 @@ static int parse_pattern_1(int action, char* statement) {
for
(
int
k
=
0
;
k
<
permission
.
size
;
++
k
)
switch
(
action
)
{
case
0
:
if
(
allow
(
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]))
if
(
sepol_
allow
(
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]))
fprintf
(
stderr
,
"Error in: allow %s %s %s %s
\n
"
,
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]);
break
;
case
1
:
if
(
deny
(
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]))
if
(
sepol_
deny
(
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]))
fprintf
(
stderr
,
"Error in: deny %s %s %s %s
\n
"
,
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]);
break
;
case
2
:
if
(
auditallow
(
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]))
if
(
sepol_
auditallow
(
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]))
fprintf
(
stderr
,
"Error in: auditallow %s %s %s %s
\n
"
,
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]);
break
;
case
3
:
if
(
auditdeny
(
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]))
if
(
sepol_
auditdeny
(
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]))
fprintf
(
stderr
,
"Error in: auditdeny %s %s %s %s
\n
"
,
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]);
break
;
default:
...
...
@@ -181,7 +186,7 @@ static int parse_pattern_2(int action, char* statement) {
for
(
int
j
=
0
;
j
<
attribute
.
size
;
++
j
)
switch
(
action
)
{
case
0
:
if
(
attradd
(
class
.
data
[
i
],
attribute
.
data
[
j
]))
if
(
sepol_
attradd
(
class
.
data
[
i
],
attribute
.
data
[
j
]))
fprintf
(
stderr
,
"Error in: attradd %s %s
\n
"
,
class
.
data
[
i
],
attribute
.
data
[
j
]);
break
;
default:
...
...
@@ -206,15 +211,15 @@ static int parse_pattern_3(int action, char* statement) {
for
(
int
i
=
0
;
i
<
classes
.
size
;
++
i
)
{
switch
(
action
)
{
case
0
:
if
(
create
(
classes
.
data
[
i
]))
if
(
sepol_
create
(
classes
.
data
[
i
]))
fprintf
(
stderr
,
"Domain %s already exists
\n
"
,
classes
.
data
[
i
]);
break
;
case
1
:
if
(
permissive
(
classes
.
data
[
i
]))
if
(
sepol_
permissive
(
classes
.
data
[
i
]))
fprintf
(
stderr
,
"Error in: permissive %s
\n
"
,
classes
.
data
[
i
]);
break
;
case
2
:
if
(
enforce
(
classes
.
data
[
i
]))
if
(
sepol_
enforce
(
classes
.
data
[
i
]))
fprintf
(
stderr
,
"Error in: enforce %s
\n
"
,
classes
.
data
[
i
]);
break
;
}
...
...
@@ -253,7 +258,7 @@ static int parse_pattern_4(int action, char* statement) {
++
state
;
}
if
(
state
<
4
)
return
1
;
if
(
typetrans
(
source
,
target
,
class
,
def
,
filename
))
if
(
sepol_
typetrans
(
source
,
target
,
class
,
def
,
filename
))
fprintf
(
stderr
,
"Error in: typetrans %s %s %s %s %s
\n
"
,
source
,
target
,
class
,
def
,
filename
?
filename
:
""
);
return
0
;
}
...
...
@@ -313,8 +318,8 @@ int magiskpolicy_main(int argc, char *argv[]) {
if
(
policydb_load_isids
(
&
policydb
,
&
sidtab
))
return
1
;
if
(
full
)
full_rules
();
else
if
(
minimal
)
min_rules
();
if
(
full
)
sepol_
full_rules
();
else
if
(
minimal
)
sepol_
min_rules
();
for
(
int
i
=
0
;
i
<
rules
.
size
;
++
i
)
{
// Since strtok will modify the origin string, copy the policy for error messages
...
...
magiskpolicy.h
View file @
838b2757
#ifndef MAGISKPOLICY_H
#define MAGISKPOLICY_H
/* magiskpolicy.h - Public API for policy patching
*/
#define ALL NULL
#ifndef _MAGISKPOLICY_H
#define _MAGISKPOLICY_H
#include <getopt.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <limits.h>
#include <string.h>
#include <sepol/debug.h>
#include <sepol/policydb/policydb.h>
#include <sepol/policydb/expand.h>
#include <sepol/policydb/link.h>
#include <sepol/policydb/services.h>
#include <sepol/policydb/avrule_block.h>
#include <sepol/policydb/conditional.h>
#include <sepol/policydb/constraint.h>
#include "vector.h"
// hashtab traversal macro
#define hashtab_for_each(table, ptr) \
for (int _i = 0; _i < table->size; ++_i) \
for (*ptr = table->htable[_i]; *ptr != NULL; *ptr = (*ptr)->next)
// Global policydb
policydb_t
*
policy
;
// sepolicy manipulation functions
int
load_policy
(
const
char
*
filename
);
int
dump_policy
(
const
char
*
filename
);
int
create_domain
(
char
*
d
);
int
set_domain_state
(
char
*
s
,
int
state
);
int
add_transition
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
);
int
add_file_transition
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
,
char
*
filename
);
int
add_typeattribute
(
char
*
domainS
,
char
*
attr
);
int
add_rule
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
,
int
effect
,
int
not
);
#define ALL NULL
// Handy functions
int
allow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
deny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
auditallow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
auditdeny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
typetrans
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
,
char
*
o
);
int
create
(
char
*
s
);
int
permissive
(
char
*
s
);
int
enforce
(
char
*
s
);
int
attradd
(
char
*
s
,
char
*
a
);
int
exists
(
char
*
source
);
int
sepol_
allow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
sepol_
deny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
sepol_
auditallow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
sepol_
auditdeny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
sepol_
typetrans
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
,
char
*
o
);
int
sepol_
create
(
char
*
s
);
int
sepol_
permissive
(
char
*
s
);
int
sepol_
enforce
(
char
*
s
);
int
sepol_
attradd
(
char
*
s
,
char
*
a
);
int
sepol_
exists
(
char
*
source
);
// Built in rules
void
full_rules
();
void
min_rules
();
void
sepol_
full_rules
();
void
sepol_
min_rules
();
#endif
rules.c
View file @
838b2757
#include "magiskpolicy.h"
void
samsung
()
{
deny
(
"init"
,
"kernel"
,
"security"
,
"load_policy"
);
deny
(
"policyloader_app"
,
"security_spota_file"
,
"dir"
,
"read"
);
deny
(
"policyloader_app"
,
"security_spota_file"
,
"dir"
,
"write"
);
deny
(
"policyloader_app"
,
"security_spota_file"
,
"file"
,
"read"
);
deny
(
"policyloader_app"
,
"security_spota_file"
,
"file"
,
"write"
);
deny
(
"system_server"
,
"security_spota_file"
,
"dir"
,
"read"
);
deny
(
"system_server"
,
"security_spota_file"
,
"dir"
,
"write"
);
deny
(
"system_server"
,
"security_spota_file"
,
"file"
,
"read"
);
deny
(
"system_server"
,
"security_spota_file"
,
"file"
,
"write"
);
deny
(
"system_app"
,
"security_spota_file"
,
"dir"
,
"read"
);
deny
(
"system_app"
,
"security_spota_file"
,
"dir"
,
"write"
);
deny
(
"system_app"
,
"security_spota_file"
,
"file"
,
"read"
);
deny
(
"system_app"
,
"security_spota_file"
,
"file"
,
"write"
);
deny
(
"installd"
,
"security_spota_file"
,
"dir"
,
"read"
);
deny
(
"installd"
,
"security_spota_file"
,
"dir"
,
"write"
);
deny
(
"installd"
,
"security_spota_file"
,
"file"
,
"read"
);
deny
(
"installd"
,
"security_spota_file"
,
"file"
,
"write"
);
deny
(
"init"
,
"security_spota_file"
,
"dir"
,
"read"
);
deny
(
"init"
,
"security_spota_file"
,
"dir"
,
"write"
);
deny
(
"init"
,
"security_spota_file"
,
"file"
,
"read"
);
deny
(
"init"
,
"security_spota_file"
,
"file"
,
"write"
);
deny
(
"ueventd"
,
"security_spota_file"
,
"dir"
,
"read"
);
deny
(
"ueventd"
,
"security_spota_file"
,
"dir"
,
"write"
);
deny
(
"ueventd"
,
"security_spota_file"
,
"file"
,
"read"
);
deny
(
"ueventd"
,
"security_spota_file"
,
"file"
,
"write"
);
deny
(
"runas"
,
"security_spota_file"
,
"dir"
,
"read"
);
deny
(
"runas"
,
"security_spota_file"
,
"dir"
,
"write"
);
deny
(
"runas"
,
"security_spota_file"
,
"file"
,
"read"
);
deny
(
"runas"
,
"security_spota_file"
,
"file"
,
"write"
);
deny
(
"drsd"
,
"security_spota_file"
,
"dir"
,
"read"
);
deny
(
"drsd"
,
"security_spota_file"
,
"dir"
,
"write"
);
deny
(
"drsd"
,
"security_spota_file"
,
"file"
,
"read"
);
deny
(
"drsd"
,
"security_spota_file"
,
"file"
,
"write"
);
deny
(
"debuggerd"
,
"security_spota_file"
,
"dir"
,
"read"
);
deny
(
"debuggerd"
,
"security_spota_file"
,
"dir"
,
"write"
);
deny
(
"debuggerd"
,
"security_spota_file"
,
"file"
,
"read"
);
deny
(
"debuggerd"
,
"security_spota_file"
,
"file"
,
"write"
);
deny
(
"vold"
,
"security_spota_file"
,
"dir"
,
"read"
);
deny
(
"vold"
,
"security_spota_file"
,
"dir"
,
"write"
);
deny
(
"vold"
,
"security_spota_file"
,
"file"
,
"read"
);
deny
(
"vold"
,
"security_spota_file"
,
"file"
,
"write"
);
deny
(
"zygote"
,
"security_spota_file"
,
"dir"
,
"read"
);
deny
(
"zygote"
,
"security_spota_file"
,
"dir"
,
"write"
);
deny
(
"zygote"
,
"security_spota_file"
,
"file"
,
"read"
);
deny
(
"zygote"
,
"security_spota_file"
,
"file"
,
"write"
);
deny
(
"auditd"
,
"security_spota_file"
,
"dir"
,
"read"
);
deny
(
"auditd"
,
"security_spota_file"
,
"dir"
,
"write"
);
deny
(
"auditd"
,
"security_spota_file"
,
"file"
,
"read"
);
deny
(
"auditd"
,
"security_spota_file"
,
"file"
,
"write"
);
deny
(
"servicemanager"
,
"security_spota_file"
,
"dir"
,
"read"
);
deny
(
"servicemanager"
,
"security_spota_file"
,
"dir"
,
"write"
);
deny
(
"servicemanager"
,
"security_spota_file"
,
"file"
,
"read"
);
deny
(
"servicemanager"
,
"security_spota_file"
,
"file"
,
"write"
);
deny
(
"itsonbs"
,
"security_spota_file"
,
"dir"
,
"read"
);
deny
(
"itsonbs"
,
"security_spota_file"
,
"dir"
,
"write"
);
deny
(
"itsonbs"
,
"security_spota_file"
,
"file"
,
"read"
);
deny
(
"itsonbs"
,
"security_spota_file"
,
"file"
,
"write"
);
deny
(
"commonplatformappdomain"
,
"security_spota_file"
,
"dir"
,
"read"
);
deny
(
"commonplatformappdomain"
,
"security_spota_file"
,
"dir"
,
"write"
);
deny
(
"commonplatformappdomain"
,
"security_spota_file"
,
"file"
,
"read"
);
deny
(
"commonplatformappdomain"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_
deny
(
"init"
,
"kernel"
,
"security"
,
"load_policy"
);
sepol_
deny
(
"policyloader_app"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_
deny
(
"policyloader_app"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_
deny
(
"policyloader_app"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_
deny
(
"policyloader_app"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_
deny
(
"system_server"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_
deny
(
"system_server"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_
deny
(
"system_server"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_
deny
(
"system_server"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_
deny
(
"system_app"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_
deny
(
"system_app"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_
deny
(
"system_app"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_
deny
(
"system_app"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_
deny
(
"installd"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_
deny
(
"installd"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_
deny
(
"installd"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_
deny
(
"installd"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_
deny
(
"init"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_
deny
(
"init"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_
deny
(
"init"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_
deny
(
"init"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_
deny
(
"ueventd"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_
deny
(
"ueventd"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_
deny
(
"ueventd"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_
deny
(
"ueventd"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_
deny
(
"runas"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_
deny
(
"runas"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_
deny
(
"runas"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_
deny
(
"runas"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_
deny
(
"drsd"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_
deny
(
"drsd"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_
deny
(
"drsd"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_
deny
(
"drsd"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_
deny
(
"debuggerd"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_
deny
(
"debuggerd"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_
deny
(
"debuggerd"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_
deny
(
"debuggerd"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_
deny
(
"vold"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_
deny
(
"vold"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_
deny
(
"vold"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_
deny
(
"vold"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_
deny
(
"zygote"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_
deny
(
"zygote"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_
deny
(
"zygote"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_
deny
(
"zygote"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_
deny
(
"auditd"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_
deny
(
"auditd"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_
deny
(
"auditd"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_
deny
(
"auditd"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_
deny
(
"servicemanager"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_
deny
(
"servicemanager"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_
deny
(
"servicemanager"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_
deny
(
"servicemanager"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_
deny
(
"itsonbs"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_
deny
(
"itsonbs"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_
deny
(
"itsonbs"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_
deny
(
"itsonbs"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_
deny
(
"commonplatformappdomain"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_
deny
(
"commonplatformappdomain"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_
deny
(
"commonplatformappdomain"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_
deny
(
"commonplatformappdomain"
,
"security_spota_file"
,
"file"
,
"write"
);
}
void
allowSuClient
(
char
*
target
)
{
allow
(
target
,
"rootfs"
,
"file"
,
"execute_no_trans"
);
allow
(
target
,
"rootfs"
,
"file"
,
"execute"
);
allow
(
target
,
"su"
,
"unix_stream_socket"
,
"connectto"
);
allow
(
target
,
"su"
,
"unix_stream_socket"
,
"getopt"
);
allow
(
target
,
"su_device"
,
"dir"
,
"search"
);
allow
(
target
,
"su_device"
,
"dir"
,
"read"
);
allow
(
target
,
"su_device"
,
"sock_file"
,
"read"
);
allow
(
target
,
"su_device"
,
"sock_file"
,
"write"
);
sepol_
allow
(
target
,
"rootfs"
,
"file"
,
"execute_no_trans"
);
sepol_
allow
(
target
,
"rootfs"
,
"file"
,
"execute"
);
sepol_
allow
(
target
,
"su"
,
"unix_stream_socket"
,
"connectto"
);
sepol_
allow
(
target
,
"su"
,
"unix_stream_socket"
,
"getopt"
);
sepol_
allow
(
target
,
"su_device"
,
"dir"
,
"search"
);
sepol_
allow
(
target
,
"su_device"
,
"dir"
,
"read"
);
sepol_
allow
(
target
,
"su_device"
,
"sock_file"
,
"read"
);
sepol_
allow
(
target
,
"su_device"
,
"sock_file"
,
"write"
);
}
void
suRights
()
{
allow
(
"servicemanager"
,
"su"
,
"dir"
,
"search"
);
allow
(
"servicemanager"
,
"su"
,
"dir"
,
"read"
);
allow
(
"servicemanager"
,
"su"
,
"file"
,
"open"
);
allow
(
"servicemanager"
,
"su"
,
"file"
,
"read"
);
allow
(
"servicemanager"
,
"su"
,
"process"
,
"getattr"
);
allow
(
"servicemanager"
,
"su"
,
"binder"
,
"transfer"
);
allow
(
"system_server"
,
"su"
,
"binder"
,
"call"
);
sepol_
allow
(
"servicemanager"
,
"su"
,
"dir"
,
"search"
);
sepol_
allow
(
"servicemanager"
,
"su"
,
"dir"
,
"read"
);
sepol_
allow
(
"servicemanager"
,
"su"
,
"file"
,
"open"
);
sepol_
allow
(
"servicemanager"
,
"su"
,
"file"
,
"read"
);
sepol_
allow
(
"servicemanager"
,
"su"
,
"process"
,
"getattr"
);
sepol_
allow
(
"servicemanager"
,
"su"
,
"binder"
,
"transfer"
);
sepol_
allow
(
"system_server"
,
"su"
,
"binder"
,
"call"
);
}
void
otherToSU
()
{
// allowLog
allow
(
"logd"
,
"su"
,
"dir"
,
"search"
);
allow
(
"logd"
,
"su"
,
"file"
,
"read"
);
allow
(
"logd"
,
"su"
,
"file"
,
"open"
);
allow
(
"logd"
,
"su"
,
"file"
,
"getattr"
);
sepol_
allow
(
"logd"
,
"su"
,
"dir"
,
"search"
);
sepol_
allow
(
"logd"
,
"su"
,
"file"
,
"read"
);
sepol_
allow
(
"logd"
,
"su"
,
"file"
,
"open"
);
sepol_
allow
(
"logd"
,
"su"
,
"file"
,
"getattr"
);
// suBackL0
allow
(
"system_server"
,
"su"
,
"binder"
,
"call"
);
allow
(
"system_server"
,
"su"
,
"binder"
,
"transfer"
);
sepol_
allow
(
"system_server"
,
"su"
,
"binder"
,
"call"
);
sepol_
allow
(
"system_server"
,
"su"
,
"binder"
,
"transfer"
);
// ES Explorer opens a sokcet
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"ioctl"
);
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"read"
);
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"getattr"
);
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"write"
);
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"setattr"
);
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"lock"
);
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"append"
);
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"bind"
);
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"connect"
);
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"getopt"
);
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"setopt"
);
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"shutdown"
);
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"connectto"
);
sepol_
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"ioctl"
);
sepol_
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"read"
);
sepol_
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"getattr"
);
sepol_
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"write"
);
sepol_
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"setattr"
);
sepol_
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"lock"
);
sepol_
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"append"
);
sepol_
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"bind"
);
sepol_
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"connect"
);
sepol_
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"getopt"
);
sepol_
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"setopt"
);
sepol_
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"shutdown"
);
sepol_
allow
(
"untrusted_app"
,
"su"
,
"unix_stream_socket"
,
"connectto"
);
// Any domain is allowed to send su "sigchld"
allow
(
ALL
,
"su"
,
"process"
,
"sigchld"
);
sepol_
allow
(
ALL
,
"su"
,
"process"
,
"sigchld"
);
// uNetworkL0
attradd
(
"su"
,
"netdomain"
);
attradd
(
"su"
,
"bluetoothdomain"
);
sepol_
attradd
(
"su"
,
"netdomain"
);
sepol_
attradd
(
"su"
,
"bluetoothdomain"
);
// suBackL6
allow
(
"surfaceflinger"
,
"app_data_file"
,
"dir"
,
ALL
);
allow
(
"surfaceflinger"
,
"app_data_file"
,
"file"
,
ALL
);
allow
(
"surfaceflinger"
,
"app_data_file"
,
"lnk_file"
,
ALL
);
attradd
(
"surfaceflinger"
,
"mlstrustedsubject"
);
sepol_
allow
(
"surfaceflinger"
,
"app_data_file"
,
"dir"
,
ALL
);
sepol_
allow
(
"surfaceflinger"
,
"app_data_file"
,
"file"
,
ALL
);
sepol_
allow
(
"surfaceflinger"
,
"app_data_file"
,
"lnk_file"
,
ALL
);
sepol_
attradd
(
"surfaceflinger"
,
"mlstrustedsubject"
);
// suMiscL6
if
(
exists
(
"audioserver"
))
allow
(
"audioserver"
,
"audioserver"
,
"process"
,
"execmem"
);
if
(
sepol_
exists
(
"audioserver"
))
sepol_
allow
(
"audioserver"
,
"audioserver"
,
"process"
,
"execmem"
);
}
void
full_rules
()
{
void
sepol_
full_rules
()
{
// Samsung specific
// Prevent system from loading policy
if
(
exists
(
"knox_system_app"
))
if
(
sepol_
exists
(
"knox_system_app"
))
samsung
();
// Min rules first
min_rules
();
sepol_
min_rules
();
// Create domains if they don't exist
if
(
!
exists
(
"su_device"
))
create
(
"su_device"
);
enforce
(
"su_device"
);
if
(
!
sepol_
exists
(
"su_device"
))
sepol_
create
(
"su_device"
);
sepol_
enforce
(
"su_device"
);
// Patch su to everything
allow
(
"su"
,
ALL
,
ALL
,
ALL
);
sepol_
allow
(
"su"
,
ALL
,
ALL
,
ALL
);
// Autotransition su's socket to su_device
add_transition
(
"su"
,
"device"
,
"file"
,
"su_device"
);
add_transition
(
"su"
,
"device"
,
"dir"
,
"su_device"
);
allow
(
"su_device"
,
"tmpfs"
,
"filesystem"
,
"associate"
);
sepol_typetrans
(
"su"
,
"device"
,
"file"
,
"su_device"
,
NULL
);
sepol_typetrans
(
"su"
,
"device"
,
"dir"
,
"su_device"
,
NULL
);
sepol_
allow
(
"su_device"
,
"tmpfs"
,
"filesystem"
,
"associate"
);
// Transition from untrusted_app to su_client
allowSuClient
(
"shell"
);
allowSuClient
(
"untrusted_app"
);
allowSuClient
(
"system_app"
);
allowSuClient
(
"platform_app"
);
if
(
exists
(
"priv_app"
))
if
(
sepol_
exists
(
"priv_app"
))
allowSuClient
(
"priv_app"
);
if
(
exists
(
"ssd_tool"
))
if
(
sepol_
exists
(
"ssd_tool"
))
allowSuClient
(
"ssd_tool"
);
// Allow init to execute su daemon/transition
allow
(
"init"
,
"su"
,
"process"
,
"transition"
);
allow
(
"init"
,
"su"
,
"process"
,
"rlimitinh"
);
allow
(
"init"
,
"su"
,
"process"
,
"siginh"
);
allow
(
"init"
,
"su"
,
"process"
,
"noatsecure"
);
sepol_
allow
(
"init"
,
"su"
,
"process"
,
"transition"
);
sepol_
allow
(
"init"
,
"su"
,
"process"
,
"rlimitinh"
);
sepol_
allow
(
"init"
,
"su"
,
"process"
,
"siginh"
);
sepol_
allow
(
"init"
,
"su"
,
"process"
,
"noatsecure"
);
suRights
();
otherToSU
();
// Need to set su_device/su as trusted to be accessible from other categories
attradd
(
"su_device"
,
"mlstrustedobject"
);
attradd
(
"su"
,
"mlstrustedsubject"
);
sepol_
attradd
(
"su_device"
,
"mlstrustedobject"
);
sepol_
attradd
(
"su"
,
"mlstrustedsubject"
);
}
// Minimal to run Magisk script before live patching
void
min_rules
()
{
void
sepol_
min_rules
()
{
if
(
!
exists
(
"su"
))
create
(
"su"
);
permissive
(
"su"
);
permissive
(
"init"
);
if
(
!
sepol_
exists
(
"su"
))
sepol_
create
(
"su"
);
sepol_
permissive
(
"su"
);
sepol_
permissive
(
"init"
);
attradd
(
"su"
,
"mlstrustedsubject"
);
sepol_
attradd
(
"su"
,
"mlstrustedsubject"
);
// Let init run stuffs in su context
allow
(
"kernel"
,
"su"
,
"fd"
,
"use"
);
allow
(
"init"
,
"su"
,
"process"
,
ALL
);
allow
(
"init"
,
"system_file"
,
"dir"
,
ALL
);
allow
(
"init"
,
"system_file"
,
"lnk_file"
,
ALL
);
allow
(
"init"
,
"system_file"
,
"file"
,
ALL
);
sepol_
allow
(
"kernel"
,
"su"
,
"fd"
,
"use"
);
sepol_
allow
(
"init"
,
"su"
,
"process"
,
ALL
);
sepol_
allow
(
"init"
,
"system_file"
,
"dir"
,
ALL
);
sepol_
allow
(
"init"
,
"system_file"
,
"lnk_file"
,
ALL
);
sepol_
allow
(
"init"
,
"system_file"
,
"file"
,
ALL
);
// Misc: basic shell scripts, prop management etc.
allow
(
"su"
,
"property_socket"
,
"sock_file"
,
"write"
);
if
(
exists
(
"default_prop"
))
allow
(
"su"
,
"default_prop"
,
"property_service"
,
"set"
);
allow
(
"su"
,
"init"
,
"unix_stream_socket"
,
"connectto"
);
allow
(
"su"
,
"su"
,
"unix_dgram_socket"
,
ALL
);
allow
(
"su"
,
"su"
,
"unix_stream_socket"
,
ALL
);
allow
(
"su"
,
"su"
,
"process"
,
ALL
);
allow
(
"su"
,
"su"
,
"capability"
,
ALL
);
allow
(
"su"
,
"su"
,
"file"
,
ALL
);
allow
(
"su"
,
"su"
,
"fifo_file"
,
ALL
);
allow
(
"su"
,
"su"
,
"lnk_file"
,
ALL
);
allow
(
"su"
,
"su"
,
"dir"
,
ALL
);
sepol_
allow
(
"su"
,
"property_socket"
,
"sock_file"
,
"write"
);
if
(
sepol_
exists
(
"default_prop"
))
sepol_
allow
(
"su"
,
"default_prop"
,
"property_service"
,
"set"
);
sepol_
allow
(
"su"
,
"init"
,
"unix_stream_socket"
,
"connectto"
);
sepol_
allow
(
"su"
,
"su"
,
"unix_dgram_socket"
,
ALL
);
sepol_
allow
(
"su"
,
"su"
,
"unix_stream_socket"
,
ALL
);
sepol_
allow
(
"su"
,
"su"
,
"process"
,
ALL
);
sepol_
allow
(
"su"
,
"su"
,
"capability"
,
ALL
);
sepol_
allow
(
"su"
,
"su"
,
"file"
,
ALL
);
sepol_
allow
(
"su"
,
"su"
,
"fifo_file"
,
ALL
);
sepol_
allow
(
"su"
,
"su"
,
"lnk_file"
,
ALL
);
sepol_
allow
(
"su"
,
"su"
,
"dir"
,
ALL
);
// Allow su to do anything to files/dir/links
allow
(
"su"
,
ALL
,
"file"
,
ALL
);
allow
(
"su"
,
ALL
,
"dir"
,
ALL
);
allow
(
"su"
,
ALL
,
"lnk_file"
,
ALL
);
sepol_
allow
(
"su"
,
ALL
,
"file"
,
ALL
);
sepol_
allow
(
"su"
,
ALL
,
"dir"
,
ALL
);
sepol_
allow
(
"su"
,
ALL
,
"lnk_file"
,
ALL
);
// For sepolicy live patching
allow
(
"su"
,
"kernel"
,
"security"
,
"read_policy"
);
allow
(
"su"
,
"kernel"
,
"security"
,
"load_policy"
);
sepol_
allow
(
"su"
,
"kernel"
,
"security"
,
"read_policy"
);
sepol_
allow
(
"su"
,
"kernel"
,
"security"
,
"load_policy"
);
// For mounting loop devices and mirrors
allow
(
"su"
,
"kernel"
,
"process"
,
"setsched"
);
allow
(
"su"
,
"labeledfs"
,
"filesystem"
,
"mount"
);
allow
(
"su"
,
"labeledfs"
,
"filesystem"
,
"unmount"
);
allow
(
"su"
,
"loop_device"
,
"blk_file"
,
ALL
);
allow
(
"su"
,
"block_device"
,
"blk_file"
,
ALL
);
allow
(
"su"
,
"system_block_device"
,
"blk_file"
,
ALL
);
sepol_
allow
(
"su"
,
"kernel"
,
"process"
,
"setsched"
);
sepol_
allow
(
"su"
,
"labeledfs"
,
"filesystem"
,
"mount"
);
sepol_
allow
(
"su"
,
"labeledfs"
,
"filesystem"
,
"unmount"
);
sepol_
allow
(
"su"
,
"loop_device"
,
"blk_file"
,
ALL
);
sepol_
allow
(
"su"
,
"block_device"
,
"blk_file"
,
ALL
);
sepol_
allow
(
"su"
,
"system_block_device"
,
"blk_file"
,
ALL
);
// Xposed
allow
(
"untrusted_app"
,
"untrusted_app"
,
"capability"
,
"setgid"
);
allow
(
"system_server"
,
"dex2oat_exec"
,
"file"
,
ALL
);
sepol_
allow
(
"untrusted_app"
,
"untrusted_app"
,
"capability"
,
"setgid"
);
sepol_
allow
(
"system_server"
,
"dex2oat_exec"
,
"file"
,
ALL
);
}
sepolicy.c
View file @
838b2757
#include "magiskpolicy.h"
#include "sepolicy.h"
static
void
*
cmalloc
(
size_t
s
)
{
void
*
t
=
malloc
(
s
);
...
...
sepolicy.h
0 → 100644
View file @
838b2757
/* sepolicy.h - Header for magiskpolicy non-public APIs
*/
#ifndef _SEPOLICY_H
#define _SEPOLICY_H
#define ALL NULL
#include <getopt.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <limits.h>
#include <string.h>
#include <sepol/debug.h>
#include <sepol/policydb/policydb.h>
#include <sepol/policydb/expand.h>
#include <sepol/policydb/link.h>
#include <sepol/policydb/services.h>
#include <sepol/policydb/avrule_block.h>
#include <sepol/policydb/conditional.h>
#include <sepol/policydb/constraint.h>
#include "vector.h"
// hashtab traversal macro
#define hashtab_for_each(table, ptr) \
for (int _i = 0; _i < table->size; ++_i) \
for (*ptr = table->htable[_i]; *ptr != NULL; *ptr = (*ptr)->next)
// Global policydb
policydb_t
*
policy
;
// sepolicy manipulation functions
int
load_policy
(
const
char
*
filename
);
int
dump_policy
(
const
char
*
filename
);
int
create_domain
(
char
*
d
);
int
set_domain_state
(
char
*
s
,
int
state
);
int
add_transition
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
);
int
add_file_transition
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
,
char
*
filename
);
int
add_typeattribute
(
char
*
domainS
,
char
*
attr
);
int
add_rule
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
,
int
effect
,
int
not
);
#endif
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment