Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
M
Magisk
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
Magisk
Commits
8b7b05da
Commit
8b7b05da
authored
May 26, 2019
by
topjohnwu
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Separate hide policies
parent
92400ebc
Hide whitespace changes
Inline
Side-by-side
Showing
5 changed files
with
109 additions
and
101 deletions
+109
-101
Android.mk
native/jni/Android.mk
+1
-0
hide_policy.cpp
native/jni/magiskhide/hide_policy.cpp
+103
-0
hide_utils.cpp
native/jni/magiskhide/hide_utils.cpp
+0
-43
magiskhide.h
native/jni/magiskhide/magiskhide.h
+5
-2
proc_monitor.cpp
native/jni/magiskhide/proc_monitor.cpp
+0
-56
No files found.
native/jni/Android.mk
View file @
8b7b05da
...
@@ -41,6 +41,7 @@ LOCAL_SRC_FILES := \
...
@@ -41,6 +41,7 @@ LOCAL_SRC_FILES := \
magiskhide/magiskhide.cpp \
magiskhide/magiskhide.cpp \
magiskhide/proc_monitor.cpp \
magiskhide/proc_monitor.cpp \
magiskhide/hide_utils.cpp \
magiskhide/hide_utils.cpp \
magiskhide/hide_policy.cpp \
resetprop/persist_properties.cpp \
resetprop/persist_properties.cpp \
resetprop/resetprop.cpp \
resetprop/resetprop.cpp \
resetprop/system_property_api.cpp \
resetprop/system_property_api.cpp \
...
...
native/jni/magiskhide/hide_policy.cpp
0 → 100644
View file @
8b7b05da
#include <sys/mount.h>
#include <magisk.h>
#include <utils.h>
#include <selinux.h>
#include <resetprop.h>
#include "magiskhide.h"
using
namespace
std
;
static
const
char
*
prop_key
[]
=
{
"ro.boot.vbmeta.device_state"
,
"ro.boot.verifiedbootstate"
,
"ro.boot.flash.locked"
,
"ro.boot.veritymode"
,
"ro.boot.warranty_bit"
,
"ro.warranty_bit"
,
"ro.debuggable"
,
"ro.secure"
,
"ro.build.type"
,
"ro.build.tags"
,
"ro.build.selinux"
,
nullptr
};
static
const
char
*
prop_value
[]
=
{
"locked"
,
"green"
,
"1"
,
"enforcing"
,
"0"
,
"0"
,
"0"
,
"1"
,
"user"
,
"release-keys"
,
"0"
,
nullptr
};
void
manage_selinux
()
{
char
val
;
int
fd
=
xopen
(
SELINUX_ENFORCE
,
O_RDONLY
);
xxread
(
fd
,
&
val
,
sizeof
(
val
));
close
(
fd
);
// Permissive
if
(
val
==
'0'
)
{
chmod
(
SELINUX_ENFORCE
,
0640
);
chmod
(
SELINUX_POLICY
,
0440
);
}
}
void
hide_sensitive_props
()
{
LOGI
(
"hide_policy: Hiding sensitive props
\n
"
);
// Hide all sensitive props
for
(
int
i
=
0
;
prop_key
[
i
];
++
i
)
{
auto
value
=
getprop
(
prop_key
[
i
]);
if
(
!
value
.
empty
()
&&
value
!=
prop_value
[
i
])
setprop
(
prop_key
[
i
],
prop_value
[
i
],
false
);
}
}
static
inline
void
clean_magisk_props
()
{
getprop
([](
const
char
*
name
,
auto
,
auto
)
->
void
{
if
(
strstr
(
name
,
"magisk"
))
deleteprop
(
name
);
},
nullptr
,
false
);
}
static
inline
void
lazy_unmount
(
const
char
*
mountpoint
)
{
if
(
umount2
(
mountpoint
,
MNT_DETACH
)
!=
-
1
)
LOGD
(
"hide_policy: Unmounted (%s)
\n
"
,
mountpoint
);
}
void
hide_daemon
(
int
pid
)
{
RunFinally
fin
([
=
]()
->
void
{
// Send resume signal
tgkill
(
pid
,
pid
,
SIGCONT
);
_exit
(
0
);
});
if
(
switch_mnt_ns
(
pid
))
return
;
LOGD
(
"hide_policy: handling PID=[%d]
\n
"
,
pid
);
manage_selinux
();
clean_magisk_props
();
vector
<
string
>
targets
;
// Unmount dummy skeletons and /sbin links
file_readline
(
"/proc/self/mounts"
,
[
&
](
string_view
s
)
->
bool
{
if
(
str_contains
(
s
,
"tmpfs /system/"
)
||
str_contains
(
s
,
"tmpfs /vendor/"
)
||
str_contains
(
s
,
"tmpfs /sbin"
))
{
char
*
path
=
(
char
*
)
s
.
data
();
// Skip first token
strtok_r
(
nullptr
,
" "
,
&
path
);
targets
.
emplace_back
(
strtok_r
(
nullptr
,
" "
,
&
path
));
}
return
true
;
});
for
(
auto
&
s
:
targets
)
lazy_unmount
(
s
.
data
());
targets
.
clear
();
// Unmount all Magisk created mounts
file_readline
(
"/proc/self/mounts"
,
[
&
](
string_view
s
)
->
bool
{
if
(
str_contains
(
s
,
BLOCKDIR
))
{
char
*
path
=
(
char
*
)
s
.
data
();
// Skip first token
strtok_r
(
nullptr
,
" "
,
&
path
);
targets
.
emplace_back
(
strtok_r
(
nullptr
,
" "
,
&
path
));
}
return
true
;
});
for
(
auto
&
s
:
targets
)
lazy_unmount
(
s
.
data
());
}
native/jni/magiskhide/hide_utils.cpp
View file @
8b7b05da
#include <sys/types.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/stat.h>
#include <sys/mount.h>
#include <stdio.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdlib.h>
#include <unistd.h>
#include <unistd.h>
...
@@ -11,9 +10,7 @@
...
@@ -11,9 +10,7 @@
#include <magisk.h>
#include <magisk.h>
#include <utils.h>
#include <utils.h>
#include <resetprop.h>
#include <db.h>
#include <db.h>
#include <selinux.h>
#include "magiskhide.h"
#include "magiskhide.h"
...
@@ -21,39 +18,6 @@ using namespace std;
...
@@ -21,39 +18,6 @@ using namespace std;
static
pthread_t
proc_monitor_thread
;
static
pthread_t
proc_monitor_thread
;
static
const
char
*
prop_key
[]
=
{
"ro.boot.vbmeta.device_state"
,
"ro.boot.verifiedbootstate"
,
"ro.boot.flash.locked"
,
"ro.boot.veritymode"
,
"ro.boot.warranty_bit"
,
"ro.warranty_bit"
,
"ro.debuggable"
,
"ro.secure"
,
"ro.build.type"
,
"ro.build.tags"
,
"ro.build.selinux"
,
nullptr
};
static
const
char
*
prop_value
[]
=
{
"locked"
,
"green"
,
"1"
,
"enforcing"
,
"0"
,
"0"
,
"0"
,
"1"
,
"user"
,
"release-keys"
,
"0"
,
nullptr
};
void
manage_selinux
()
{
char
val
;
int
fd
=
xopen
(
SELINUX_ENFORCE
,
O_RDONLY
);
xxread
(
fd
,
&
val
,
sizeof
(
val
));
close
(
fd
);
// Permissive
if
(
val
==
'0'
)
{
chmod
(
SELINUX_ENFORCE
,
0640
);
chmod
(
SELINUX_POLICY
,
0440
);
}
}
static
void
hide_sensitive_props
()
{
LOGI
(
"hide_utils: Hiding sensitive props
\n
"
);
// Hide all sensitive props
for
(
int
i
=
0
;
prop_key
[
i
];
++
i
)
{
auto
value
=
getprop
(
prop_key
[
i
]);
if
(
!
value
.
empty
()
&&
value
!=
prop_value
[
i
])
setprop
(
prop_key
[
i
],
prop_value
[
i
],
false
);
}
}
// Leave /proc fd opened as we're going to read from it repeatedly
// Leave /proc fd opened as we're going to read from it repeatedly
static
DIR
*
procfp
;
static
DIR
*
procfp
;
void
crawl_procfs
(
const
function
<
bool
(
int
)
>
&
fn
)
{
void
crawl_procfs
(
const
function
<
bool
(
int
)
>
&
fn
)
{
...
@@ -117,13 +81,6 @@ static void kill_process(const char *name) {
...
@@ -117,13 +81,6 @@ static void kill_process(const char *name) {
});
});
}
}
void
clean_magisk_props
()
{
getprop
([](
const
char
*
name
,
auto
,
auto
)
->
void
{
if
(
strstr
(
name
,
"magisk"
))
deleteprop
(
name
);
},
nullptr
,
false
);
}
static
int
add_list
(
const
char
*
pkg
,
const
char
*
proc
=
""
)
{
static
int
add_list
(
const
char
*
pkg
,
const
char
*
proc
=
""
)
{
if
(
proc
[
0
]
==
'\0'
)
if
(
proc
[
0
]
==
'\0'
)
proc
=
pkg
;
proc
=
pkg
;
...
...
native/jni/magiskhide/magiskhide.h
View file @
8b7b05da
...
@@ -32,11 +32,14 @@ void proc_monitor();
...
@@ -32,11 +32,14 @@ void proc_monitor();
void
update_uid_map
();
void
update_uid_map
();
// Utility functions
// Utility functions
void
manage_selinux
();
void
clean_magisk_props
();
void
crawl_procfs
(
const
std
::
function
<
bool
(
int
)
>
&
fn
);
void
crawl_procfs
(
const
std
::
function
<
bool
(
int
)
>
&
fn
);
void
crawl_procfs
(
DIR
*
dir
,
const
std
::
function
<
bool
(
int
)
>
&
fn
);
void
crawl_procfs
(
DIR
*
dir
,
const
std
::
function
<
bool
(
int
)
>
&
fn
);
// Hide policies
void
hide_daemon
(
int
pid
);
void
hide_sensitive_props
();
void
manage_selinux
();
extern
bool
hide_enabled
;
extern
bool
hide_enabled
;
extern
pthread_mutex_t
monitor_lock
;
extern
pthread_mutex_t
monitor_lock
;
extern
std
::
set
<
std
::
pair
<
std
::
string
,
std
::
string
>>
hide_set
;
extern
std
::
set
<
std
::
pair
<
std
::
string
,
std
::
string
>>
hide_set
;
...
...
native/jni/magiskhide/proc_monitor.cpp
View file @
8b7b05da
...
@@ -49,11 +49,6 @@ static inline int read_ns(const int pid, struct stat *st) {
...
@@ -49,11 +49,6 @@ static inline int read_ns(const int pid, struct stat *st) {
return
stat
(
path
,
st
);
return
stat
(
path
,
st
);
}
}
static
inline
void
lazy_unmount
(
const
char
*
mountpoint
)
{
if
(
umount2
(
mountpoint
,
MNT_DETACH
)
!=
-
1
)
LOGD
(
"hide_daemon: Unmounted (%s)
\n
"
,
mountpoint
);
}
static
int
parse_ppid
(
int
pid
)
{
static
int
parse_ppid
(
int
pid
)
{
char
path
[
32
];
char
path
[
32
];
int
ppid
;
int
ppid
;
...
@@ -177,57 +172,6 @@ static void setup_inotify() {
...
@@ -177,57 +172,6 @@ static void setup_inotify() {
}
}
}
}
/*************************
* The actual hide daemon
*************************/
static
void
hide_daemon
(
int
pid
)
{
RunFinally
fin
([
=
]()
->
void
{
// Send resume signal
tgkill
(
pid
,
pid
,
SIGCONT
);
_exit
(
0
);
});
if
(
switch_mnt_ns
(
pid
))
return
;
LOGD
(
"hide_daemon: handling PID=[%d]
\n
"
,
pid
);
manage_selinux
();
clean_magisk_props
();
vector
<
string
>
targets
;
// Unmount dummy skeletons and /sbin links
file_readline
(
"/proc/self/mounts"
,
[
&
](
string_view
s
)
->
bool
{
if
(
str_contains
(
s
,
"tmpfs /system/"
)
||
str_contains
(
s
,
"tmpfs /vendor/"
)
||
str_contains
(
s
,
"tmpfs /sbin"
))
{
char
*
path
=
(
char
*
)
s
.
data
();
// Skip first token
strtok_r
(
nullptr
,
" "
,
&
path
);
targets
.
emplace_back
(
strtok_r
(
nullptr
,
" "
,
&
path
));
}
return
true
;
});
for
(
auto
&
s
:
targets
)
lazy_unmount
(
s
.
data
());
targets
.
clear
();
// Unmount all Magisk created mounts
file_readline
(
"/proc/self/mounts"
,
[
&
](
string_view
s
)
->
bool
{
if
(
str_contains
(
s
,
BLOCKDIR
))
{
char
*
path
=
(
char
*
)
s
.
data
();
// Skip first token
strtok_r
(
nullptr
,
" "
,
&
path
);
targets
.
emplace_back
(
strtok_r
(
nullptr
,
" "
,
&
path
));
}
return
true
;
});
for
(
auto
&
s
:
targets
)
lazy_unmount
(
s
.
data
());
}
/************************
/************************
* Async signal handlers
* Async signal handlers
************************/
************************/
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment