Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
M
Magisk
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
Magisk
Commits
838b2757
Commit
838b2757
authored
Apr 15, 2017
by
topjohnwu
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Separate public and private APIs
parent
7bb8b903
Expand all
Show whitespace changes
Inline
Side-by-side
Showing
7 changed files
with
254 additions
and
233 deletions
+254
-233
Android.mk
Android.mk
+1
-1
api.c
api.c
+11
-10
magiskpolicy.c
magiskpolicy.c
+18
-13
magiskpolicy.h
magiskpolicy.h
+17
-51
rules.c
rules.c
+158
-158
sepolicy.c
sepolicy.c
+1
-0
sepolicy.h
sepolicy.h
+48
-0
No files found.
Android.mk
View file @
838b2757
...
@@ -3,7 +3,7 @@ LOCAL_PATH := $(call my-dir)
...
@@ -3,7 +3,7 @@ LOCAL_PATH := $(call my-dir)
include $(CLEAR_VARS)
include $(CLEAR_VARS)
LOCAL_MODULE := magiskpolicy
LOCAL_MODULE := magiskpolicy
LOCAL_STATIC_LIBRARIES := libsepol
LOCAL_STATIC_LIBRARIES := libsepol
LOCAL_SRC_FILES := magiskpolicy.c sepolicy.c rules.c
utils
.c ../utils/vector.c
LOCAL_SRC_FILES := magiskpolicy.c sepolicy.c rules.c
api
.c ../utils/vector.c
LOCAL_C_INCLUDES := jni/selinux/libsepol/include jni/utils
LOCAL_C_INCLUDES := jni/selinux/libsepol/include jni/utils
LOCAL_CFLAGS := -DINDEP_BINARY
LOCAL_CFLAGS := -DINDEP_BINARY
include $(BUILD_EXECUTABLE)
include $(BUILD_EXECUTABLE)
...
...
utils
.c
→
api
.c
View file @
838b2757
#include "magiskpolicy.h"
#include "magiskpolicy.h"
#include "sepolicy.h"
int
allow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
int
sepol_
allow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
0
);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
0
);
}
}
int
deny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
int
sepol_
deny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
1
);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
1
);
}
}
int
auditallow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
int
sepol_
auditallow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITALLOW
,
0
);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITALLOW
,
0
);
}
}
int
auditdeny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
int
sepol_
auditdeny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITDENY
,
0
);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITDENY
,
0
);
}
}
int
typetrans
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
,
char
*
o
)
{
int
sepol_
typetrans
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
,
char
*
o
)
{
if
(
o
==
NULL
)
if
(
o
==
NULL
)
return
add_transition
(
s
,
t
,
c
,
d
);
return
add_transition
(
s
,
t
,
c
,
d
);
else
else
return
add_file_transition
(
s
,
t
,
c
,
d
,
o
);
return
add_file_transition
(
s
,
t
,
c
,
d
,
o
);
}
}
int
permissive
(
char
*
s
)
{
int
sepol_
permissive
(
char
*
s
)
{
return
set_domain_state
(
s
,
1
);
return
set_domain_state
(
s
,
1
);
}
}
int
enforce
(
char
*
s
)
{
int
sepol_
enforce
(
char
*
s
)
{
return
set_domain_state
(
s
,
0
);
return
set_domain_state
(
s
,
0
);
}
}
int
create
(
char
*
s
)
{
int
sepol_
create
(
char
*
s
)
{
return
create_domain
(
s
);
return
create_domain
(
s
);
}
}
int
attradd
(
char
*
s
,
char
*
a
)
{
int
sepol_
attradd
(
char
*
s
,
char
*
a
)
{
return
add_typeattribute
(
s
,
a
);
return
add_typeattribute
(
s
,
a
);
}
}
int
exists
(
char
*
source
)
{
int
sepol_
exists
(
char
*
source
)
{
return
!!
hashtab_search
(
policy
->
p_types
.
table
,
source
);
return
!!
hashtab_search
(
policy
->
p_types
.
table
,
source
);
}
}
magiskpolicy.c
View file @
838b2757
#include "vector.h"
/* magiskpolicy.c - Main function for policy patching
#include "magiskpolicy.h"
*
* Includes all the parsing logic for the policy statements
*/
#ifdef INDEP_BINARY
#ifdef INDEP_BINARY
int
magiskpolicy_main
(
int
argc
,
char
*
argv
[]);
int
magiskpolicy_main
(
int
argc
,
char
*
argv
[]);
...
@@ -10,6 +12,9 @@ int main(int argc, char *argv[]) {
...
@@ -10,6 +12,9 @@ int main(int argc, char *argv[]) {
#include "magisk.h"
#include "magisk.h"
#endif
#endif
#include "magiskpolicy.h"
#include "sepolicy.h"
static
int
syntax_err
=
0
;
static
int
syntax_err
=
0
;
static
char
err_msg
[
ARG_MAX
];
static
char
err_msg
[
ARG_MAX
];
...
@@ -112,19 +117,19 @@ static int parse_pattern_1(int action, char* statement) {
...
@@ -112,19 +117,19 @@ static int parse_pattern_1(int action, char* statement) {
for
(
int
k
=
0
;
k
<
permission
.
size
;
++
k
)
for
(
int
k
=
0
;
k
<
permission
.
size
;
++
k
)
switch
(
action
)
{
switch
(
action
)
{
case
0
:
case
0
:
if
(
allow
(
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]))
if
(
sepol_
allow
(
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]))
fprintf
(
stderr
,
"Error in: allow %s %s %s %s
\n
"
,
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]);
fprintf
(
stderr
,
"Error in: allow %s %s %s %s
\n
"
,
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]);
break
;
break
;
case
1
:
case
1
:
if
(
deny
(
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]))
if
(
sepol_
deny
(
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]))
fprintf
(
stderr
,
"Error in: deny %s %s %s %s
\n
"
,
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]);
fprintf
(
stderr
,
"Error in: deny %s %s %s %s
\n
"
,
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]);
break
;
break
;
case
2
:
case
2
:
if
(
auditallow
(
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]))
if
(
sepol_
auditallow
(
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]))
fprintf
(
stderr
,
"Error in: auditallow %s %s %s %s
\n
"
,
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]);
fprintf
(
stderr
,
"Error in: auditallow %s %s %s %s
\n
"
,
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]);
break
;
break
;
case
3
:
case
3
:
if
(
auditdeny
(
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]))
if
(
sepol_
auditdeny
(
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]))
fprintf
(
stderr
,
"Error in: auditdeny %s %s %s %s
\n
"
,
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]);
fprintf
(
stderr
,
"Error in: auditdeny %s %s %s %s
\n
"
,
source
.
data
[
i
],
target
.
data
[
j
],
class
,
permission
.
data
[
k
]);
break
;
break
;
default:
default:
...
@@ -181,7 +186,7 @@ static int parse_pattern_2(int action, char* statement) {
...
@@ -181,7 +186,7 @@ static int parse_pattern_2(int action, char* statement) {
for
(
int
j
=
0
;
j
<
attribute
.
size
;
++
j
)
for
(
int
j
=
0
;
j
<
attribute
.
size
;
++
j
)
switch
(
action
)
{
switch
(
action
)
{
case
0
:
case
0
:
if
(
attradd
(
class
.
data
[
i
],
attribute
.
data
[
j
]))
if
(
sepol_
attradd
(
class
.
data
[
i
],
attribute
.
data
[
j
]))
fprintf
(
stderr
,
"Error in: attradd %s %s
\n
"
,
class
.
data
[
i
],
attribute
.
data
[
j
]);
fprintf
(
stderr
,
"Error in: attradd %s %s
\n
"
,
class
.
data
[
i
],
attribute
.
data
[
j
]);
break
;
break
;
default:
default:
...
@@ -206,15 +211,15 @@ static int parse_pattern_3(int action, char* statement) {
...
@@ -206,15 +211,15 @@ static int parse_pattern_3(int action, char* statement) {
for
(
int
i
=
0
;
i
<
classes
.
size
;
++
i
)
{
for
(
int
i
=
0
;
i
<
classes
.
size
;
++
i
)
{
switch
(
action
)
{
switch
(
action
)
{
case
0
:
case
0
:
if
(
create
(
classes
.
data
[
i
]))
if
(
sepol_
create
(
classes
.
data
[
i
]))
fprintf
(
stderr
,
"Domain %s already exists
\n
"
,
classes
.
data
[
i
]);
fprintf
(
stderr
,
"Domain %s already exists
\n
"
,
classes
.
data
[
i
]);
break
;
break
;
case
1
:
case
1
:
if
(
permissive
(
classes
.
data
[
i
]))
if
(
sepol_
permissive
(
classes
.
data
[
i
]))
fprintf
(
stderr
,
"Error in: permissive %s
\n
"
,
classes
.
data
[
i
]);
fprintf
(
stderr
,
"Error in: permissive %s
\n
"
,
classes
.
data
[
i
]);
break
;
break
;
case
2
:
case
2
:
if
(
enforce
(
classes
.
data
[
i
]))
if
(
sepol_
enforce
(
classes
.
data
[
i
]))
fprintf
(
stderr
,
"Error in: enforce %s
\n
"
,
classes
.
data
[
i
]);
fprintf
(
stderr
,
"Error in: enforce %s
\n
"
,
classes
.
data
[
i
]);
break
;
break
;
}
}
...
@@ -253,7 +258,7 @@ static int parse_pattern_4(int action, char* statement) {
...
@@ -253,7 +258,7 @@ static int parse_pattern_4(int action, char* statement) {
++
state
;
++
state
;
}
}
if
(
state
<
4
)
return
1
;
if
(
state
<
4
)
return
1
;
if
(
typetrans
(
source
,
target
,
class
,
def
,
filename
))
if
(
sepol_
typetrans
(
source
,
target
,
class
,
def
,
filename
))
fprintf
(
stderr
,
"Error in: typetrans %s %s %s %s %s
\n
"
,
source
,
target
,
class
,
def
,
filename
?
filename
:
""
);
fprintf
(
stderr
,
"Error in: typetrans %s %s %s %s %s
\n
"
,
source
,
target
,
class
,
def
,
filename
?
filename
:
""
);
return
0
;
return
0
;
}
}
...
@@ -313,8 +318,8 @@ int magiskpolicy_main(int argc, char *argv[]) {
...
@@ -313,8 +318,8 @@ int magiskpolicy_main(int argc, char *argv[]) {
if
(
policydb_load_isids
(
&
policydb
,
&
sidtab
))
if
(
policydb_load_isids
(
&
policydb
,
&
sidtab
))
return
1
;
return
1
;
if
(
full
)
full_rules
();
if
(
full
)
sepol_
full_rules
();
else
if
(
minimal
)
min_rules
();
else
if
(
minimal
)
sepol_
min_rules
();
for
(
int
i
=
0
;
i
<
rules
.
size
;
++
i
)
{
for
(
int
i
=
0
;
i
<
rules
.
size
;
++
i
)
{
// Since strtok will modify the origin string, copy the policy for error messages
// Since strtok will modify the origin string, copy the policy for error messages
...
...
magiskpolicy.h
View file @
838b2757
#ifndef MAGISKPOLICY_H
/* magiskpolicy.h - Public API for policy patching
#define MAGISKPOLICY_H
*/
#define ALL NULL
#ifndef _MAGISKPOLICY_H
#define _MAGISKPOLICY_H
#include <getopt.h>
#include <unistd.h>
#include <stdlib.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <limits.h>
#include <string.h>
#include <sepol/debug.h>
#include <sepol/policydb/policydb.h>
#include <sepol/policydb/expand.h>
#include <sepol/policydb/link.h>
#include <sepol/policydb/services.h>
#include <sepol/policydb/avrule_block.h>
#include <sepol/policydb/conditional.h>
#include <sepol/policydb/constraint.h>
#include "vector.h"
// hashtab traversal macro
#define hashtab_for_each(table, ptr) \
for (int _i = 0; _i < table->size; ++_i) \
for (*ptr = table->htable[_i]; *ptr != NULL; *ptr = (*ptr)->next)
// Global policydb
#define ALL NULL
policydb_t
*
policy
;
// sepolicy manipulation functions
int
load_policy
(
const
char
*
filename
);
int
dump_policy
(
const
char
*
filename
);
int
create_domain
(
char
*
d
);
int
set_domain_state
(
char
*
s
,
int
state
);
int
add_transition
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
);
int
add_file_transition
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
,
char
*
filename
);
int
add_typeattribute
(
char
*
domainS
,
char
*
attr
);
int
add_rule
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
,
int
effect
,
int
not
);
// Handy functions
// Handy functions
int
allow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
sepol_
allow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
deny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
sepol_
deny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
auditallow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
sepol_
auditallow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
auditdeny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
sepol_
auditdeny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
typetrans
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
,
char
*
o
);
int
sepol_
typetrans
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
,
char
*
o
);
int
create
(
char
*
s
);
int
sepol_
create
(
char
*
s
);
int
permissive
(
char
*
s
);
int
sepol_
permissive
(
char
*
s
);
int
enforce
(
char
*
s
);
int
sepol_
enforce
(
char
*
s
);
int
attradd
(
char
*
s
,
char
*
a
);
int
sepol_
attradd
(
char
*
s
,
char
*
a
);
int
exists
(
char
*
source
);
int
sepol_
exists
(
char
*
source
);
// Built in rules
// Built in rules
void
full_rules
();
void
sepol_
full_rules
();
void
min_rules
();
void
sepol_
min_rules
();
#endif
#endif
rules.c
View file @
838b2757
This diff is collapsed.
Click to expand it.
sepolicy.c
View file @
838b2757
#include "magiskpolicy.h"
#include "magiskpolicy.h"
#include "sepolicy.h"
static
void
*
cmalloc
(
size_t
s
)
{
static
void
*
cmalloc
(
size_t
s
)
{
void
*
t
=
malloc
(
s
);
void
*
t
=
malloc
(
s
);
...
...
sepolicy.h
0 → 100644
View file @
838b2757
/* sepolicy.h - Header for magiskpolicy non-public APIs
*/
#ifndef _SEPOLICY_H
#define _SEPOLICY_H
#define ALL NULL
#include <getopt.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <limits.h>
#include <string.h>
#include <sepol/debug.h>
#include <sepol/policydb/policydb.h>
#include <sepol/policydb/expand.h>
#include <sepol/policydb/link.h>
#include <sepol/policydb/services.h>
#include <sepol/policydb/avrule_block.h>
#include <sepol/policydb/conditional.h>
#include <sepol/policydb/constraint.h>
#include "vector.h"
// hashtab traversal macro
#define hashtab_for_each(table, ptr) \
for (int _i = 0; _i < table->size; ++_i) \
for (*ptr = table->htable[_i]; *ptr != NULL; *ptr = (*ptr)->next)
// Global policydb
policydb_t
*
policy
;
// sepolicy manipulation functions
int
load_policy
(
const
char
*
filename
);
int
dump_policy
(
const
char
*
filename
);
int
create_domain
(
char
*
d
);
int
set_domain_state
(
char
*
s
,
int
state
);
int
add_transition
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
);
int
add_file_transition
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
,
char
*
filename
);
int
add_typeattribute
(
char
*
domainS
,
char
*
attr
);
int
add_rule
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
,
int
effect
,
int
not
);
#endif
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment