Commit 838b2757 authored by topjohnwu's avatar topjohnwu

Separate public and private APIs

parent 7bb8b903
...@@ -3,7 +3,7 @@ LOCAL_PATH := $(call my-dir) ...@@ -3,7 +3,7 @@ LOCAL_PATH := $(call my-dir)
include $(CLEAR_VARS) include $(CLEAR_VARS)
LOCAL_MODULE := magiskpolicy LOCAL_MODULE := magiskpolicy
LOCAL_STATIC_LIBRARIES := libsepol LOCAL_STATIC_LIBRARIES := libsepol
LOCAL_SRC_FILES := magiskpolicy.c sepolicy.c rules.c utils.c ../utils/vector.c LOCAL_SRC_FILES := magiskpolicy.c sepolicy.c rules.c api.c ../utils/vector.c
LOCAL_C_INCLUDES := jni/selinux/libsepol/include jni/utils LOCAL_C_INCLUDES := jni/selinux/libsepol/include jni/utils
LOCAL_CFLAGS := -DINDEP_BINARY LOCAL_CFLAGS := -DINDEP_BINARY
include $(BUILD_EXECUTABLE) include $(BUILD_EXECUTABLE)
......
#include "magiskpolicy.h" #include "magiskpolicy.h"
#include "sepolicy.h"
int allow(char *s, char *t, char *c, char *p) { int sepol_allow(char *s, char *t, char *c, char *p) {
return add_rule(s, t, c, p, AVTAB_ALLOWED, 0); return add_rule(s, t, c, p, AVTAB_ALLOWED, 0);
} }
int deny(char *s, char *t, char *c, char *p) { int sepol_deny(char *s, char *t, char *c, char *p) {
return add_rule(s, t, c, p, AVTAB_ALLOWED, 1); return add_rule(s, t, c, p, AVTAB_ALLOWED, 1);
} }
int auditallow(char *s, char *t, char *c, char *p) { int sepol_auditallow(char *s, char *t, char *c, char *p) {
return add_rule(s, t, c, p, AVTAB_AUDITALLOW, 0); return add_rule(s, t, c, p, AVTAB_AUDITALLOW, 0);
} }
int auditdeny(char *s, char *t, char *c, char *p) { int sepol_auditdeny(char *s, char *t, char *c, char *p) {
return add_rule(s, t, c, p, AVTAB_AUDITDENY, 0); return add_rule(s, t, c, p, AVTAB_AUDITDENY, 0);
} }
int typetrans(char *s, char *t, char *c, char *d, char *o) { int sepol_typetrans(char *s, char *t, char *c, char *d, char *o) {
if (o == NULL) if (o == NULL)
return add_transition(s, t, c, d); return add_transition(s, t, c, d);
else else
return add_file_transition(s, t, c, d, o); return add_file_transition(s, t, c, d, o);
} }
int permissive(char *s) { int sepol_permissive(char *s) {
return set_domain_state(s, 1); return set_domain_state(s, 1);
} }
int enforce(char *s) { int sepol_enforce(char *s) {
return set_domain_state(s, 0); return set_domain_state(s, 0);
} }
int create(char *s) { int sepol_create(char *s) {
return create_domain(s); return create_domain(s);
} }
int attradd(char *s, char *a) { int sepol_attradd(char *s, char *a) {
return add_typeattribute(s, a); return add_typeattribute(s, a);
} }
int exists(char* source) { int sepol_exists(char* source) {
return !! hashtab_search(policy->p_types.table, source); return !! hashtab_search(policy->p_types.table, source);
} }
#include "vector.h" /* magiskpolicy.c - Main function for policy patching
#include "magiskpolicy.h" *
* Includes all the parsing logic for the policy statements
*/
#ifdef INDEP_BINARY #ifdef INDEP_BINARY
int magiskpolicy_main(int argc, char *argv[]); int magiskpolicy_main(int argc, char *argv[]);
...@@ -10,6 +12,9 @@ int main(int argc, char *argv[]) { ...@@ -10,6 +12,9 @@ int main(int argc, char *argv[]) {
#include "magisk.h" #include "magisk.h"
#endif #endif
#include "magiskpolicy.h"
#include "sepolicy.h"
static int syntax_err = 0; static int syntax_err = 0;
static char err_msg[ARG_MAX]; static char err_msg[ARG_MAX];
...@@ -112,19 +117,19 @@ static int parse_pattern_1(int action, char* statement) { ...@@ -112,19 +117,19 @@ static int parse_pattern_1(int action, char* statement) {
for (int k = 0; k < permission.size; ++k) for (int k = 0; k < permission.size; ++k)
switch (action) { switch (action) {
case 0: case 0:
if (allow(source.data[i], target.data[j], class, permission.data[k])) if (sepol_allow(source.data[i], target.data[j], class, permission.data[k]))
fprintf(stderr, "Error in: allow %s %s %s %s\n", source.data[i], target.data[j], class, permission.data[k]); fprintf(stderr, "Error in: allow %s %s %s %s\n", source.data[i], target.data[j], class, permission.data[k]);
break; break;
case 1: case 1:
if (deny(source.data[i], target.data[j], class, permission.data[k])) if (sepol_deny(source.data[i], target.data[j], class, permission.data[k]))
fprintf(stderr, "Error in: deny %s %s %s %s\n", source.data[i], target.data[j], class, permission.data[k]); fprintf(stderr, "Error in: deny %s %s %s %s\n", source.data[i], target.data[j], class, permission.data[k]);
break; break;
case 2: case 2:
if (auditallow(source.data[i], target.data[j], class, permission.data[k])) if (sepol_auditallow(source.data[i], target.data[j], class, permission.data[k]))
fprintf(stderr, "Error in: auditallow %s %s %s %s\n", source.data[i], target.data[j], class, permission.data[k]); fprintf(stderr, "Error in: auditallow %s %s %s %s\n", source.data[i], target.data[j], class, permission.data[k]);
break; break;
case 3: case 3:
if (auditdeny(source.data[i], target.data[j], class, permission.data[k])) if (sepol_auditdeny(source.data[i], target.data[j], class, permission.data[k]))
fprintf(stderr, "Error in: auditdeny %s %s %s %s\n", source.data[i], target.data[j], class, permission.data[k]); fprintf(stderr, "Error in: auditdeny %s %s %s %s\n", source.data[i], target.data[j], class, permission.data[k]);
break; break;
default: default:
...@@ -181,7 +186,7 @@ static int parse_pattern_2(int action, char* statement) { ...@@ -181,7 +186,7 @@ static int parse_pattern_2(int action, char* statement) {
for (int j = 0; j < attribute.size; ++j) for (int j = 0; j < attribute.size; ++j)
switch (action) { switch (action) {
case 0: case 0:
if (attradd(class.data[i], attribute.data[j])) if (sepol_attradd(class.data[i], attribute.data[j]))
fprintf(stderr, "Error in: attradd %s %s\n", class.data[i], attribute.data[j]); fprintf(stderr, "Error in: attradd %s %s\n", class.data[i], attribute.data[j]);
break; break;
default: default:
...@@ -206,15 +211,15 @@ static int parse_pattern_3(int action, char* statement) { ...@@ -206,15 +211,15 @@ static int parse_pattern_3(int action, char* statement) {
for (int i = 0; i < classes.size; ++i) { for (int i = 0; i < classes.size; ++i) {
switch (action) { switch (action) {
case 0: case 0:
if (create(classes.data[i])) if (sepol_create(classes.data[i]))
fprintf(stderr, "Domain %s already exists\n", classes.data[i]); fprintf(stderr, "Domain %s already exists\n", classes.data[i]);
break; break;
case 1: case 1:
if (permissive(classes.data[i])) if (sepol_permissive(classes.data[i]))
fprintf(stderr, "Error in: permissive %s\n", classes.data[i]); fprintf(stderr, "Error in: permissive %s\n", classes.data[i]);
break; break;
case 2: case 2:
if (enforce(classes.data[i])) if (sepol_enforce(classes.data[i]))
fprintf(stderr, "Error in: enforce %s\n", classes.data[i]); fprintf(stderr, "Error in: enforce %s\n", classes.data[i]);
break; break;
} }
...@@ -253,7 +258,7 @@ static int parse_pattern_4(int action, char* statement) { ...@@ -253,7 +258,7 @@ static int parse_pattern_4(int action, char* statement) {
++state; ++state;
} }
if (state < 4) return 1; if (state < 4) return 1;
if (typetrans(source, target, class, def, filename)) if (sepol_typetrans(source, target, class, def, filename))
fprintf(stderr, "Error in: typetrans %s %s %s %s %s\n", source, target, class, def, filename ? filename : ""); fprintf(stderr, "Error in: typetrans %s %s %s %s %s\n", source, target, class, def, filename ? filename : "");
return 0; return 0;
} }
...@@ -313,8 +318,8 @@ int magiskpolicy_main(int argc, char *argv[]) { ...@@ -313,8 +318,8 @@ int magiskpolicy_main(int argc, char *argv[]) {
if (policydb_load_isids(&policydb, &sidtab)) if (policydb_load_isids(&policydb, &sidtab))
return 1; return 1;
if (full) full_rules(); if (full) sepol_full_rules();
else if (minimal) min_rules(); else if (minimal) sepol_min_rules();
for (int i = 0; i < rules.size; ++i) { for (int i = 0; i < rules.size; ++i) {
// Since strtok will modify the origin string, copy the policy for error messages // Since strtok will modify the origin string, copy the policy for error messages
......
#ifndef MAGISKPOLICY_H /* magiskpolicy.h - Public API for policy patching
#define MAGISKPOLICY_H */
#define ALL NULL #ifndef _MAGISKPOLICY_H
#define _MAGISKPOLICY_H
#include <getopt.h>
#include <unistd.h>
#include <stdlib.h> #include <stdlib.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <limits.h>
#include <string.h>
#include <sepol/debug.h>
#include <sepol/policydb/policydb.h>
#include <sepol/policydb/expand.h>
#include <sepol/policydb/link.h>
#include <sepol/policydb/services.h>
#include <sepol/policydb/avrule_block.h>
#include <sepol/policydb/conditional.h>
#include <sepol/policydb/constraint.h>
#include "vector.h"
// hashtab traversal macro
#define hashtab_for_each(table, ptr) \
for (int _i = 0; _i < table->size; ++_i) \
for (*ptr = table->htable[_i]; *ptr != NULL; *ptr = (*ptr)->next)
// Global policydb #define ALL NULL
policydb_t *policy;
// sepolicy manipulation functions
int load_policy(const char *filename);
int dump_policy(const char *filename);
int create_domain(char *d);
int set_domain_state(char* s, int state);
int add_transition(char *s, char *t, char *c, char *d);
int add_file_transition(char *s, char *t, char *c, char *d, char* filename);
int add_typeattribute(char *domainS, char *attr);
int add_rule(char *s, char *t, char *c, char *p, int effect, int not);
// Handy functions // Handy functions
int allow(char *s, char *t, char *c, char *p); int sepol_allow(char *s, char *t, char *c, char *p);
int deny(char *s, char *t, char *c, char *p); int sepol_deny(char *s, char *t, char *c, char *p);
int auditallow(char *s, char *t, char *c, char *p); int sepol_auditallow(char *s, char *t, char *c, char *p);
int auditdeny(char *s, char *t, char *c, char *p); int sepol_auditdeny(char *s, char *t, char *c, char *p);
int typetrans(char *s, char *t, char *c, char *d, char *o); int sepol_typetrans(char *s, char *t, char *c, char *d, char *o);
int create(char *s); int sepol_create(char *s);
int permissive(char *s); int sepol_permissive(char *s);
int enforce(char *s); int sepol_enforce(char *s);
int attradd(char *s, char *a); int sepol_attradd(char *s, char *a);
int exists(char *source); int sepol_exists(char *source);
// Built in rules // Built in rules
void full_rules(); void sepol_full_rules();
void min_rules(); void sepol_min_rules();
#endif #endif
This diff is collapsed.
#include "magiskpolicy.h" #include "magiskpolicy.h"
#include "sepolicy.h"
static void *cmalloc(size_t s) { static void *cmalloc(size_t s) {
void *t = malloc(s); void *t = malloc(s);
......
/* sepolicy.h - Header for magiskpolicy non-public APIs
*/
#ifndef _SEPOLICY_H
#define _SEPOLICY_H
#define ALL NULL
#include <getopt.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <limits.h>
#include <string.h>
#include <sepol/debug.h>
#include <sepol/policydb/policydb.h>
#include <sepol/policydb/expand.h>
#include <sepol/policydb/link.h>
#include <sepol/policydb/services.h>
#include <sepol/policydb/avrule_block.h>
#include <sepol/policydb/conditional.h>
#include <sepol/policydb/constraint.h>
#include "vector.h"
// hashtab traversal macro
#define hashtab_for_each(table, ptr) \
for (int _i = 0; _i < table->size; ++_i) \
for (*ptr = table->htable[_i]; *ptr != NULL; *ptr = (*ptr)->next)
// Global policydb
policydb_t *policy;
// sepolicy manipulation functions
int load_policy(const char *filename);
int dump_policy(const char *filename);
int create_domain(char *d);
int set_domain_state(char* s, int state);
int add_transition(char *s, char *t, char *c, char *d);
int add_file_transition(char *s, char *t, char *c, char *d, char* filename);
int add_typeattribute(char *domainS, char *attr);
int add_rule(char *s, char *t, char *c, char *p, int effect, int not);
#endif
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment