Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
M
Magisk
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
Magisk
Commits
951273f8
Commit
951273f8
authored
May 24, 2020
by
topjohnwu
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Cleanup some implementations
parent
51eeb89f
Hide whitespace changes
Inline
Side-by-side
Showing
6 changed files
with
246 additions
and
271 deletions
+246
-271
magiskpolicy.hpp
native/jni/include/magiskpolicy.hpp
+17
-17
magiskpolicy.cpp
native/jni/magiskpolicy/magiskpolicy.cpp
+2
-2
policydb.cpp
native/jni/magiskpolicy/policydb.cpp
+4
-4
sepolicy.cpp
native/jni/magiskpolicy/sepolicy.cpp
+212
-235
sepolicy.hpp
native/jni/magiskpolicy/sepolicy.hpp
+10
-12
statement.cpp
native/jni/magiskpolicy/statement.cpp
+1
-1
No files found.
native/jni/include/magiskpolicy.hpp
View file @
951273f8
...
...
@@ -18,35 +18,35 @@ public:
static
sepolicy
*
compile_split
();
// External APIs
int
to_file
(
c_str
file
);
bool
to_file
(
c_str
file
);
void
parse_statement
(
c_str
stmt
);
void
load_rule_file
(
c_str
file
);
// Operation on types
int
create
(
c_str
type
);
int
permissive
(
c_str
type
);
int
enforce
(
c_str
type
);
int
typeattribute
(
c_str
type
,
c_str
attr
);
int
exists
(
c_str
type
);
bool
create
(
c_str
type
);
bool
permissive
(
c_str
type
);
bool
enforce
(
c_str
type
);
bool
typeattribute
(
c_str
type
,
c_str
attr
);
bool
exists
(
c_str
type
);
// Access vector rules
int
allow
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
perm
);
int
deny
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
perm
);
int
auditallow
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
perm
);
int
dontaudit
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
perm
);
bool
allow
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
perm
);
bool
deny
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
perm
);
bool
auditallow
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
perm
);
bool
dontaudit
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
perm
);
// Extended permissions access vector rules
int
allowxperm
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
range
);
int
auditallowxperm
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
range
);
int
dontauditxperm
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
range
);
bool
allowxperm
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
range
);
bool
auditallowxperm
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
range
);
bool
dontauditxperm
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
range
);
// Type rules
int
type_transition
(
c_str
s
,
c_str
t
,
c_str
c
,
c_str
d
,
c_str
o
=
nullptr
);
int
type_change
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
def
);
int
type_member
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
def
);
bool
type_transition
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
def
,
c_str
obj
=
nullptr
);
bool
type_change
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
def
);
bool
type_member
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
def
);
// File system labeling
int
genfscon
(
c_str
fs_name
,
c_str
path
,
c_str
ctx
);
bool
genfscon
(
c_str
fs_name
,
c_str
path
,
c_str
ctx
);
// Magisk
void
magisk_rules
();
...
...
native/jni/magiskpolicy/magiskpolicy.cpp
View file @
951273f8
...
...
@@ -110,12 +110,12 @@ int magiskpolicy_main(int argc, char *argv[]) {
for
(;
i
<
argc
;
++
i
)
sepol
->
parse_statement
(
argv
[
i
]);
if
(
live
&&
sepol
->
to_file
(
SELINUX_LOAD
))
{
if
(
live
&&
!
sepol
->
to_file
(
SELINUX_LOAD
))
{
fprintf
(
stderr
,
"Cannot apply policy
\n
"
);
return
1
;
}
if
(
out_file
&&
sepol
->
to_file
(
out_file
))
{
if
(
out_file
&&
!
sepol
->
to_file
(
out_file
))
{
fprintf
(
stderr
,
"Cannot dump policy to %s
\n
"
,
out_file
);
return
1
;
}
...
...
native/jni/magiskpolicy/policydb.cpp
View file @
951273f8
...
...
@@ -189,7 +189,7 @@ sepolicy::~sepolicy() {
free
(
db
);
}
int
sepolicy
::
to_file
(
const
char
*
file
)
{
bool
sepolicy
::
to_file
(
const
char
*
file
)
{
uint8_t
*
data
;
size_t
len
;
...
...
@@ -205,14 +205,14 @@ int sepolicy::to_file(const char *file) {
pf
.
fp
=
fp
.
get
();
if
(
policydb_write
(
db
,
&
pf
))
{
LOGE
(
"Fail to create policy image
\n
"
);
return
1
;
return
false
;
}
int
fd
=
xopen
(
file
,
O_WRONLY
|
O_CREAT
|
O_TRUNC
|
O_CLOEXEC
,
0644
);
if
(
fd
<
0
)
return
1
;
return
false
;
xwrite
(
fd
,
data
,
len
);
close
(
fd
);
return
0
;
return
true
;
}
native/jni/magiskpolicy/sepolicy.cpp
View file @
951273f8
...
...
@@ -37,7 +37,6 @@ struct auto_cast_wrapper
auto_cast_wrapper
(
T
*
ptr
)
:
ptr
(
ptr
)
{}
template
<
typename
U
>
operator
U
*
()
const
{
return
static_cast
<
U
*>
(
ptr
);
}
private
:
T
*
ptr
;
};
...
...
@@ -152,42 +151,21 @@ avtab_ptr_t sepol_impl::get_avtab_node(avtab_key_t *key, avtab_extended_perms_t
return
node
;
}
int
sepol_impl
::
add_avrule
(
avtab_key_t
*
key
,
int
val
,
bool
n
)
{
avtab_ptr_t
node
=
get_avtab_node
(
key
,
nullptr
);
if
(
n
)
{
if
(
val
<
0
)
node
->
datum
.
data
=
0U
;
else
node
->
datum
.
data
&=
~
(
1U
<<
(
val
-
1
));
}
else
{
if
(
val
<
0
)
node
->
datum
.
data
=
~
0U
;
else
node
->
datum
.
data
|=
1U
<<
(
val
-
1
);
}
check_avtab_node
(
node
);
return
0
;
}
int
sepol_impl
::
add_rule
(
type_datum_t
*
src
,
type_datum_t
*
tgt
,
class_datum_t
*
cls
,
perm_datum_t
*
perm
,
int
effect
,
bool
n
)
{
int
ret
=
0
;
void
sepol_impl
::
add_rule
(
type_datum_t
*
src
,
type_datum_t
*
tgt
,
class_datum_t
*
cls
,
perm_datum_t
*
perm
,
int
effect
,
bool
n
)
{
if
(
src
==
nullptr
)
{
hashtab_for_each
(
db
->
p_types
.
table
,
[
&
](
hashtab_ptr_t
node
)
{
src
=
auto_cast
(
node
->
datum
);
ret
|=
add_rule
(
src
,
tgt
,
cls
,
perm
,
effect
,
n
);
add_rule
(
src
,
tgt
,
cls
,
perm
,
effect
,
n
);
});
}
else
if
(
tgt
==
nullptr
)
{
hashtab_for_each
(
db
->
p_types
.
table
,
[
&
](
hashtab_ptr_t
node
)
{
tgt
=
auto_cast
(
node
->
datum
);
ret
|=
add_rule
(
src
,
tgt
,
cls
,
perm
,
effect
,
n
);
add_rule
(
src
,
tgt
,
cls
,
perm
,
effect
,
n
);
});
}
else
if
(
cls
==
nullptr
)
{
hashtab_for_each
(
db
->
p_classes
.
table
,
[
&
](
hashtab_ptr_t
node
)
{
cls
=
auto_cast
(
node
->
datum
);
ret
|=
add_rule
(
src
,
tgt
,
cls
,
perm
,
effect
,
n
);
add_rule
(
src
,
tgt
,
cls
,
perm
,
effect
,
n
);
});
}
else
{
avtab_key_t
key
;
...
...
@@ -195,13 +173,24 @@ int sepol_impl::add_rule(type_datum_t *src, type_datum_t *tgt, class_datum_t *cl
key
.
target_type
=
tgt
->
s
.
value
;
key
.
target_class
=
cls
->
s
.
value
;
key
.
specified
=
effect
;
return
add_avrule
(
&
key
,
perm
?
perm
->
s
.
value
:
-
1
,
n
);
}
return
ret
;
avtab_ptr_t
node
=
get_avtab_node
(
&
key
,
nullptr
);
if
(
n
)
{
if
(
perm
)
node
->
datum
.
data
&=
~
(
1U
<<
(
perm
->
s
.
value
-
1
));
else
node
->
datum
.
data
=
0U
;
}
else
{
if
(
perm
)
node
->
datum
.
data
|=
1U
<<
(
perm
->
s
.
value
-
1
);
else
node
->
datum
.
data
=
~
0U
;
}
check_avtab_node
(
node
);
}
}
int
sepol_impl
::
add_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
,
int
effect
,
bool
n
)
{
bool
sepol_impl
::
add_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
,
int
effect
,
bool
n
)
{
type_datum_t
*
src
=
nullptr
,
*
tgt
=
nullptr
;
class_datum_t
*
cls
=
nullptr
;
perm_datum_t
*
perm
=
nullptr
;
...
...
@@ -210,7 +199,7 @@ int sepol_impl::add_rule(const char *s, const char *t, const char *c, const char
src
=
hashtab_find
(
db
->
p_types
.
table
,
s
);
if
(
src
==
nullptr
)
{
LOGW
(
"source type %s does not exist
\n
"
,
s
);
return
1
;
return
false
;
}
}
...
...
@@ -218,7 +207,7 @@ int sepol_impl::add_rule(const char *s, const char *t, const char *c, const char
tgt
=
hashtab_find
(
db
->
p_types
.
table
,
t
);
if
(
tgt
==
nullptr
)
{
LOGW
(
"target type %s does not exist
\n
"
,
t
);
return
1
;
return
false
;
}
}
...
...
@@ -226,14 +215,14 @@ int sepol_impl::add_rule(const char *s, const char *t, const char *c, const char
cls
=
hashtab_find
(
db
->
p_classes
.
table
,
c
);
if
(
cls
==
nullptr
)
{
LOGW
(
"class %s does not exist
\n
"
,
c
);
return
1
;
return
false
;
}
}
if
(
p
)
{
if
(
c
==
nullptr
)
{
LOGW
(
"No class is specified, cannot add perm [%s]
\n
"
,
p
);
return
1
;
return
false
;
}
perm
=
hashtab_find
(
cls
->
permissions
.
table
,
p
);
...
...
@@ -242,70 +231,32 @@ int sepol_impl::add_rule(const char *s, const char *t, const char *c, const char
}
if
(
perm
==
nullptr
)
{
LOGW
(
"perm %s does not exist in class %s
\n
"
,
p
,
c
);
return
1
;
return
false
;
}
}
return
add_rule
(
src
,
tgt
,
cls
,
perm
,
effect
,
n
);
add_rule
(
src
,
tgt
,
cls
,
perm
,
effect
,
n
);
return
true
;
}
#define ioctl_driver(x) (x>>8 & 0xFF)
#define ioctl_func(x) (x & 0xFF)
int
sepol_impl
::
add_avxrule
(
avtab_key_t
*
key
,
uint16_t
low
,
uint16_t
high
,
bool
n
)
{
avtab_datum_t
*
datum
;
avtab_extended_perms_t
xperms
;
memset
(
&
xperms
,
0
,
sizeof
(
xperms
));
if
(
ioctl_driver
(
low
)
!=
ioctl_driver
(
high
))
{
xperms
.
specified
=
AVTAB_XPERMS_IOCTLDRIVER
;
xperms
.
driver
=
0
;
}
else
{
xperms
.
specified
=
AVTAB_XPERMS_IOCTLFUNCTION
;
xperms
.
driver
=
ioctl_driver
(
low
);
}
if
(
xperms
.
specified
==
AVTAB_XPERMS_IOCTLDRIVER
)
{
for
(
int
i
=
ioctl_driver
(
low
);
i
<=
ioctl_driver
(
high
);
++
i
)
{
if
(
n
)
xperm_clear
(
i
,
xperms
.
perms
);
else
xperm_set
(
i
,
xperms
.
perms
);
}
}
else
{
for
(
int
i
=
ioctl_func
(
low
);
i
<=
ioctl_func
(
high
);
++
i
)
{
if
(
n
)
xperm_clear
(
i
,
xperms
.
perms
);
else
xperm_set
(
i
,
xperms
.
perms
);
}
}
datum
=
&
get_avtab_node
(
key
,
&
xperms
)
->
datum
;
if
(
datum
->
xperms
==
nullptr
)
datum
->
xperms
=
auto_cast
(
xmalloc
(
sizeof
(
xperms
)));
memcpy
(
datum
->
xperms
,
&
xperms
,
sizeof
(
xperms
));
return
0
;
}
int
sepol_impl
::
add_xperm_rule
(
type_datum_t
*
src
,
type_datum_t
*
tgt
,
void
sepol_impl
::
add_xperm_rule
(
type_datum_t
*
src
,
type_datum_t
*
tgt
,
class_datum_t
*
cls
,
uint16_t
low
,
uint16_t
high
,
int
effect
,
bool
n
)
{
int
ret
=
0
;
if
(
src
==
nullptr
)
{
hashtab_for_each
(
db
->
p_types
.
table
,
[
&
](
hashtab_ptr_t
node
)
{
src
=
auto_cast
(
node
->
datum
);
ret
|=
add_xperm_rule
(
src
,
tgt
,
cls
,
low
,
high
,
effect
,
n
);
add_xperm_rule
(
src
,
tgt
,
cls
,
low
,
high
,
effect
,
n
);
});
}
else
if
(
tgt
==
nullptr
)
{
hashtab_for_each
(
db
->
p_types
.
table
,
[
&
](
hashtab_ptr_t
node
)
{
tgt
=
auto_cast
(
node
->
datum
);
ret
|=
add_xperm_rule
(
src
,
tgt
,
cls
,
low
,
high
,
effect
,
n
);
add_xperm_rule
(
src
,
tgt
,
cls
,
low
,
high
,
effect
,
n
);
});
}
else
if
(
cls
==
nullptr
)
{
hashtab_for_each
(
db
->
p_classes
.
table
,
[
&
](
hashtab_ptr_t
node
)
{
tgt
=
auto_cast
(
node
->
datum
);
ret
|=
add_xperm_rule
(
src
,
tgt
,
cls
,
low
,
high
,
effect
,
n
);
add_xperm_rule
(
src
,
tgt
,
cls
,
low
,
high
,
effect
,
n
);
});
}
else
{
avtab_key_t
key
;
...
...
@@ -313,12 +264,45 @@ int sepol_impl::add_xperm_rule(type_datum_t *src, type_datum_t *tgt,
key
.
target_type
=
tgt
->
s
.
value
;
key
.
target_class
=
cls
->
s
.
value
;
key
.
specified
=
effect
;
return
add_avxrule
(
&
key
,
low
,
high
,
n
);
avtab_datum_t
*
datum
;
avtab_extended_perms_t
xperms
;
memset
(
&
xperms
,
0
,
sizeof
(
xperms
));
if
(
ioctl_driver
(
low
)
!=
ioctl_driver
(
high
))
{
xperms
.
specified
=
AVTAB_XPERMS_IOCTLDRIVER
;
xperms
.
driver
=
0
;
}
else
{
xperms
.
specified
=
AVTAB_XPERMS_IOCTLFUNCTION
;
xperms
.
driver
=
ioctl_driver
(
low
);
}
if
(
xperms
.
specified
==
AVTAB_XPERMS_IOCTLDRIVER
)
{
for
(
int
i
=
ioctl_driver
(
low
);
i
<=
ioctl_driver
(
high
);
++
i
)
{
if
(
n
)
xperm_clear
(
i
,
xperms
.
perms
);
else
xperm_set
(
i
,
xperms
.
perms
);
}
}
else
{
for
(
int
i
=
ioctl_func
(
low
);
i
<=
ioctl_func
(
high
);
++
i
)
{
if
(
n
)
xperm_clear
(
i
,
xperms
.
perms
);
else
xperm_set
(
i
,
xperms
.
perms
);
}
}
datum
=
&
get_avtab_node
(
&
key
,
&
xperms
)
->
datum
;
if
(
datum
->
xperms
==
nullptr
)
datum
->
xperms
=
auto_cast
(
xmalloc
(
sizeof
(
xperms
)));
memcpy
(
datum
->
xperms
,
&
xperms
,
sizeof
(
xperms
));
}
return
ret
;
}
int
sepol_impl
::
add_xperm_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
,
int
effect
,
bool
n
)
{
bool
sepol_impl
::
add_xperm_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
,
int
effect
,
bool
n
)
{
type_datum_t
*
src
=
nullptr
,
*
tgt
=
nullptr
;
class_datum_t
*
cls
=
nullptr
;
...
...
@@ -326,7 +310,7 @@ int sepol_impl::add_xperm_rule(const char *s, const char *t, const char *c, cons
src
=
hashtab_find
(
db
->
p_types
.
table
,
s
);
if
(
src
==
nullptr
)
{
LOGW
(
"source type %s does not exist
\n
"
,
s
);
return
1
;
return
false
;
}
}
...
...
@@ -334,7 +318,7 @@ int sepol_impl::add_xperm_rule(const char *s, const char *t, const char *c, cons
tgt
=
hashtab_find
(
db
->
p_types
.
table
,
t
);
if
(
tgt
==
nullptr
)
{
LOGW
(
"target type %s does not exist
\n
"
,
t
);
return
1
;
return
false
;
}
}
...
...
@@ -342,7 +326,7 @@ int sepol_impl::add_xperm_rule(const char *s, const char *t, const char *c, cons
cls
=
hashtab_find
(
db
->
p_classes
.
table
,
c
);
if
(
cls
==
nullptr
)
{
LOGW
(
"class %s does not exist
\n
"
,
c
);
return
1
;
return
false
;
}
}
...
...
@@ -360,193 +344,97 @@ int sepol_impl::add_xperm_rule(const char *s, const char *t, const char *c, cons
high
=
0xFFFF
;
}
return
add_xperm_rule
(
src
,
tgt
,
cls
,
low
,
high
,
effect
,
n
);
}
int
sepol_impl
::
create_domain
(
const
char
*
type_name
)
{
symtab_datum_t
*
src
=
hashtab_find
(
db
->
p_types
.
table
,
type_name
);
if
(
src
)
{
LOGW
(
"Type %s already exists
\n
"
,
type_name
);
return
0
;
}
type_datum_t
*
type
=
auto_cast
(
xmalloc
(
sizeof
(
type_datum_t
)));
type_datum_init
(
type
);
type
->
primary
=
1
;
type
->
flavor
=
TYPE_TYPE
;
uint32_t
value
=
0
;
symtab_insert
(
db
,
SYM_TYPES
,
strdup
(
type_name
),
type
,
SCOPE_DECL
,
1
,
&
value
);
type
->
s
.
value
=
value
;
if
(
ebitmap_set_bit
(
&
db
->
global
->
branch_list
->
declared
.
scope
[
SYM_TYPES
],
value
-
1
,
1
))
{
return
1
;
}
db
->
type_attr_map
=
auto_cast
(
xrealloc
(
db
->
type_attr_map
,
sizeof
(
ebitmap_t
)
*
db
->
p_types
.
nprim
));
db
->
attr_type_map
=
auto_cast
(
xrealloc
(
db
->
attr_type_map
,
sizeof
(
ebitmap_t
)
*
db
->
p_types
.
nprim
));
ebitmap_init
(
&
db
->
type_attr_map
[
value
-
1
]);
ebitmap_init
(
&
db
->
attr_type_map
[
value
-
1
]);
ebitmap_set_bit
(
&
db
->
type_attr_map
[
value
-
1
],
value
-
1
,
1
);
src
=
hashtab_find
(
db
->
p_types
.
table
,
type_name
);
if
(
!
src
)
return
1
;
if
(
policydb_index_decls
(
nullptr
,
db
))
return
1
;
if
(
policydb_index_classes
(
db
))
return
1
;
if
(
policydb_index_others
(
nullptr
,
db
,
0
))
return
1
;
// Add the domain to all roles
for
(
unsigned
i
=
0
;
i
<
db
->
p_roles
.
nprim
;
++
i
)
{
// Not sure all those three calls are needed
ebitmap_set_bit
(
&
db
->
role_val_to_struct
[
i
]
->
types
.
negset
,
value
-
1
,
0
);
ebitmap_set_bit
(
&
db
->
role_val_to_struct
[
i
]
->
types
.
types
,
value
-
1
,
1
);
type_set_expand
(
&
db
->
role_val_to_struct
[
i
]
->
types
,
&
db
->
role_val_to_struct
[
i
]
->
cache
,
db
,
0
);
}
return
set_attr
(
"domain"
,
value
);
}
int
sepol_impl
::
set_domain_state
(
const
char
*
s
,
bool
permissive
)
{
type_datum_t
*
type
;
if
(
s
==
nullptr
)
{
hashtab_for_each
(
db
->
p_types
.
table
,
[
&
](
hashtab_ptr_t
node
)
{
type
=
auto_cast
(
node
->
datum
);
if
(
ebitmap_set_bit
(
&
db
->
permissive_map
,
type
->
s
.
value
,
permissive
))
LOGW
(
"Could not set bit in permissive map
\n
"
);
});
}
else
{
type
=
hashtab_find
(
db
->
p_types
.
table
,
s
);
if
(
type
==
nullptr
)
{
LOGW
(
"type %s does not exist
\n
"
,
s
);
return
1
;
}
if
(
ebitmap_set_bit
(
&
db
->
permissive_map
,
type
->
s
.
value
,
permissive
))
{
LOGW
(
"Could not set bit in permissive map
\n
"
);
return
1
;
}
}
return
0
;
add_xperm_rule
(
src
,
tgt
,
cls
,
low
,
high
,
effect
,
n
);
return
true
;
}
int
sepol_impl
::
add_filename_trans
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
)
{
bool
sepol_impl
::
add_type_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
int
effect
)
{
type_datum_t
*
src
,
*
tgt
,
*
def
;
class_datum_t
*
cls
;
filename_trans_datum_t
*
trans
;
src
=
hashtab_find
(
db
->
p_types
.
table
,
s
);
if
(
src
==
nullptr
)
{
LOGW
(
"source type %s does not exist
\n
"
,
s
);
return
1
;
return
false
;
}
tgt
=
hashtab_find
(
db
->
p_types
.
table
,
t
);
if
(
tgt
==
nullptr
)
{
LOGW
(
"target type %s does not exist
\n
"
,
t
);
return
1
;
return
false
;
}
cls
=
hashtab_find
(
db
->
p_classes
.
table
,
c
);
if
(
cls
==
nullptr
)
{
LOGW
(
"class %s does not exist
\n
"
,
c
);
return
1
;
return
false
;
}
def
=
hashtab_find
(
db
->
p_types
.
table
,
d
);
if
(
def
==
nullptr
)
{
LOGW
(
"default type %s does not exist
\n
"
,
d
);
return
1
;
return
false
;
}
filename_trans_t
trans_key
;
trans_key
.
stype
=
src
->
s
.
value
;
trans_key
.
ttype
=
tgt
->
s
.
value
;
trans_key
.
tclass
=
cls
->
s
.
value
;
trans_key
.
name
=
(
char
*
)
o
;
trans
=
hashtab_find
(
db
->
filename_trans
,
(
hashtab_key_t
)
&
trans_key
);
if
(
trans
==
nullptr
)
{
trans
=
auto_cast
(
xcalloc
(
sizeof
(
*
trans
),
1
));
hashtab_insert
(
db
->
filename_trans
,
(
hashtab_key_t
)
&
trans_key
,
trans
);
}
// Overwrite existing
trans
->
otype
=
def
->
s
.
value
;
return
0
;
}
int
sepol_impl
::
add_typeattribute
(
const
char
*
type
,
const
char
*
attr
)
{
type_datum_t
*
domain
=
hashtab_find
(
db
->
p_types
.
table
,
type
);
if
(
domain
==
nullptr
)
{
LOGW
(
"type %s does not exist
\n
"
,
type
);
return
1
;
}
avtab_key_t
key
;
key
.
source_type
=
src
->
s
.
value
;
key
.
target_type
=
tgt
->
s
.
value
;
key
.
target_class
=
cls
->
s
.
value
;
key
.
specified
=
effect
;
int
attr_val
=
set_attr
(
attr
,
domain
->
s
.
value
);
if
(
attr_val
<
0
)
return
1
;
avtab_ptr_t
node
=
get_avtab_node
(
&
key
,
nullptr
);
node
->
datum
.
data
=
def
->
s
.
value
;
hashtab_for_each
(
db
->
p_classes
.
table
,
[
&
](
hashtab_ptr_t
node
){
auto
cls
=
static_cast
<
class_datum_t
*>
(
node
->
datum
);
for
(
constraint_node_t
*
n
=
cls
->
constraints
;
n
;
n
=
n
->
next
)
{
for
(
constraint_expr_t
*
e
=
n
->
expr
;
e
;
e
=
e
->
next
)
{
if
(
e
->
expr_type
==
CEXPR_NAMES
&&
ebitmap_get_bit
(
&
e
->
type_names
->
types
,
attr_val
-
1
))
{
ebitmap_set_bit
(
&
e
->
names
,
domain
->
s
.
value
-
1
,
1
);
}
}
}
});
return
0
;
return
true
;
}
int
sepol_impl
::
add_type_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
int
effect
)
{
bool
sepol_impl
::
add_filename_trans
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
)
{
type_datum_t
*
src
,
*
tgt
,
*
def
;
class_datum_t
*
cls
;
filename_trans_datum_t
*
trans
;
src
=
hashtab_find
(
db
->
p_types
.
table
,
s
);
if
(
src
==
nullptr
)
{
LOGW
(
"source type %s does not exist
\n
"
,
s
);
return
1
;
return
false
;
}
tgt
=
hashtab_find
(
db
->
p_types
.
table
,
t
);
if
(
tgt
==
nullptr
)
{
LOGW
(
"target type %s does not exist
\n
"
,
t
);
return
1
;
return
false
;
}
cls
=
hashtab_find
(
db
->
p_classes
.
table
,
c
);
if
(
cls
==
nullptr
)
{
LOGW
(
"class %s does not exist
\n
"
,
c
);
return
1
;
return
false
;
}
def
=
hashtab_find
(
db
->
p_types
.
table
,
d
);
if
(
def
==
nullptr
)
{
LOGW
(
"default type %s does not exist
\n
"
,
d
);
return
1
;
return
false
;
}
avtab_key
_t
key
;
key
.
s
ource_
type
=
src
->
s
.
value
;
key
.
t
arget_
type
=
tgt
->
s
.
value
;
key
.
t
arget_
class
=
cls
->
s
.
value
;
key
.
specified
=
effect
;
filename_trans
_t
key
;
key
.
stype
=
src
->
s
.
value
;
key
.
ttype
=
tgt
->
s
.
value
;
key
.
tclass
=
cls
->
s
.
value
;
key
.
name
=
(
char
*
)
o
;
avtab_ptr_t
node
=
get_avtab_node
(
&
key
,
nullptr
);
node
->
datum
.
data
=
def
->
s
.
value
;
trans
=
hashtab_find
(
db
->
filename_trans
,
(
hashtab_key_t
)
&
key
);
return
0
;
if
(
trans
==
nullptr
)
{
trans
=
auto_cast
(
xcalloc
(
sizeof
(
*
trans
),
1
));
hashtab_insert
(
db
->
filename_trans
,
(
hashtab_key_t
)
&
key
,
trans
);
}
// Overwrite existing
trans
->
otype
=
def
->
s
.
value
;
return
true
;
}
int
sepol_impl
::
add_genfscon
(
const
char
*
fs_name
,
const
char
*
path
,
const
char
*
context
)
{
bool
sepol_impl
::
add_genfscon
(
const
char
*
fs_name
,
const
char
*
path
,
const
char
*
context
)
{
// First try to create context
context_struct_t
*
ctx
;
if
(
context_from_string
(
nullptr
,
db
,
&
ctx
,
context
,
strlen
(
context
)))
{
LOGW
(
"Failed to create context from string [%s]
\n
"
,
context
);
return
1
;
return
false
;
}
// Allocate genfs context
...
...
@@ -598,7 +486,96 @@ int sepol_impl::add_genfscon(const char *fs_name, const char *path, const char *
else
newfs
->
head
=
newc
;
return
0
;
return
true
;
}
bool
sepol_impl
::
create_domain
(
const
char
*
type_name
)
{
type_datum_t
*
type
=
hashtab_find
(
db
->
p_types
.
table
,
type_name
);
if
(
type
)
{
LOGW
(
"Type %s already exists
\n
"
,
type_name
);
return
true
;
}
type
=
auto_cast
(
xmalloc
(
sizeof
(
type_datum_t
)));
type_datum_init
(
type
);
type
->
primary
=
1
;
type
->
flavor
=
TYPE_TYPE
;
uint32_t
value
=
0
;
if
(
symtab_insert
(
db
,
SYM_TYPES
,
strdup
(
type_name
),
type
,
SCOPE_DECL
,
1
,
&
value
))
return
false
;
type
->
s
.
value
=
value
;
ebitmap_set_bit
(
&
db
->
global
->
branch_list
->
declared
.
p_types_scope
,
value
-
1
,
1
);
auto
new_size
=
sizeof
(
ebitmap_t
)
*
db
->
p_types
.
nprim
;
db
->
type_attr_map
=
auto_cast
(
xrealloc
(
db
->
type_attr_map
,
new_size
));
db
->
attr_type_map
=
auto_cast
(
xrealloc
(
db
->
attr_type_map
,
new_size
));
ebitmap_init
(
&
db
->
type_attr_map
[
value
-
1
]);
ebitmap_init
(
&
db
->
attr_type_map
[
value
-
1
]);
ebitmap_set_bit
(
&
db
->
type_attr_map
[
value
-
1
],
value
-
1
,
1
);
// Re-index stuffs
if
(
policydb_index_decls
(
nullptr
,
db
)
||
policydb_index_classes
(
db
)
||
policydb_index_others
(
nullptr
,
db
,
0
))
return
false
;
// Add the type to all roles
for
(
int
i
=
0
;
i
<
db
->
p_roles
.
nprim
;
++
i
)
{
// Not sure all those three calls are needed
ebitmap_set_bit
(
&
db
->
role_val_to_struct
[
i
]
->
types
.
negset
,
value
-
1
,
0
);
ebitmap_set_bit
(
&
db
->
role_val_to_struct
[
i
]
->
types
.
types
,
value
-
1
,
1
);
type_set_expand
(
&
db
->
role_val_to_struct
[
i
]
->
types
,
&
db
->
role_val_to_struct
[
i
]
->
cache
,
db
,
0
);
}
set_attr
(
"domain"
,
value
);
return
true
;
}
bool
sepol_impl
::
set_domain_state
(
const
char
*
s
,
bool
permissive
)
{
type_datum_t
*
type
;
if
(
s
==
nullptr
)
{
hashtab_for_each
(
db
->
p_types
.
table
,
[
&
](
hashtab_ptr_t
node
)
{
type
=
auto_cast
(
node
->
datum
);
if
(
ebitmap_set_bit
(
&
db
->
permissive_map
,
type
->
s
.
value
,
permissive
))
LOGW
(
"Could not set bit in permissive map
\n
"
);
});
}
else
{
type
=
hashtab_find
(
db
->
p_types
.
table
,
s
);
if
(
type
==
nullptr
)
{
LOGW
(
"type %s does not exist
\n
"
,
s
);
return
false
;
}
if
(
ebitmap_set_bit
(
&
db
->
permissive_map
,
type
->
s
.
value
,
permissive
))
{
LOGW
(
"Could not set bit in permissive map
\n
"
);
return
false
;
}
}
return
true
;
}
bool
sepol_impl
::
add_typeattribute
(
const
char
*
type
,
const
char
*
attr
)
{
type_datum_t
*
domain
=
hashtab_find
(
db
->
p_types
.
table
,
type
);
if
(
domain
==
nullptr
)
{
LOGW
(
"type %s does not exist
\n
"
,
type
);
return
false
;
}
int
attr_val
=
set_attr
(
attr
,
domain
->
s
.
value
);
if
(
attr_val
<
0
)
return
false
;
hashtab_for_each
(
db
->
p_classes
.
table
,
[
&
](
hashtab_ptr_t
node
){
auto
cls
=
static_cast
<
class_datum_t
*>
(
node
->
datum
);
for
(
constraint_node_t
*
n
=
cls
->
constraints
;
n
;
n
=
n
->
next
)
{
for
(
constraint_expr_t
*
e
=
n
->
expr
;
e
;
e
=
e
->
next
)
{
if
(
e
->
expr_type
==
CEXPR_NAMES
&&
ebitmap_get_bit
(
&
e
->
type_names
->
types
,
attr_val
-
1
))
{
ebitmap_set_bit
(
&
e
->
names
,
domain
->
s
.
value
-
1
,
1
);
}
}
}
});
return
true
;
}
void
sepol_impl
::
strip_dontaudit
()
{
...
...
@@ -608,52 +585,52 @@ void sepol_impl::strip_dontaudit() {
});
}
int
sepolicy
::
allow
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
bool
sepolicy
::
allow
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
p
);
return
impl
->
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
false
);
}
int
sepolicy
::
deny
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
bool
sepolicy
::
deny
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
p
);
return
impl
->
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
true
);
}
int
sepolicy
::
auditallow
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
bool
sepolicy
::
auditallow
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
p
);
return
impl
->
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITALLOW
,
false
);
}
int
sepolicy
::
dontaudit
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
bool
sepolicy
::
dontaudit
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
p
);
return
impl
->
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITDENY
,
true
);
}
int
sepolicy
::
allowxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
bool
sepolicy
::
allowxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
"ioctl"
,
range
);
return
impl
->
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_ALLOWED
,
false
);
}
int
sepolicy
::
auditallowxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
bool
sepolicy
::
auditallowxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
"ioctl"
,
range
);
return
impl
->
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_AUDITALLOW
,
false
);
}
int
sepolicy
::
dontauditxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
bool
sepolicy
::
dontauditxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
"ioctl"
,
range
);
return
impl
->
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_DONTAUDIT
,
false
);
}
int
sepolicy
::
type_change
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
bool
sepolicy
::
type_change
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
d
);
return
impl
->
add_type_rule
(
s
,
t
,
c
,
d
,
AVTAB_CHANGE
);
}
int
sepolicy
::
type_member
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
bool
sepolicy
::
type_member
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
d
);
return
impl
->
add_type_rule
(
s
,
t
,
c
,
d
,
AVTAB_MEMBER
);
}
int
sepolicy
::
type_transition
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
)
{
bool
sepolicy
::
type_transition
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
)
{
if
(
o
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
d
);
return
impl
->
add_type_rule
(
s
,
t
,
c
,
d
,
AVTAB_TRANSITION
);
...
...
@@ -663,31 +640,31 @@ int sepolicy::type_transition(const char *s, const char *t, const char *c, const
}
}
int
sepolicy
::
permissive
(
const
char
*
s
)
{
bool
sepolicy
::
permissive
(
const
char
*
s
)
{
dprint
(
__FUNCTION__
,
s
);
return
impl
->
set_domain_state
(
s
,
true
);
}
int
sepolicy
::
enforce
(
const
char
*
s
)
{
bool
sepolicy
::
enforce
(
const
char
*
s
)
{
dprint
(
__FUNCTION__
,
s
);
return
impl
->
set_domain_state
(
s
,
false
);
}
int
sepolicy
::
create
(
const
char
*
s
)
{
bool
sepolicy
::
create
(
const
char
*
s
)
{
dprint
(
__FUNCTION__
,
s
);
return
impl
->
create_domain
(
s
);
}
int
sepolicy
::
typeattribute
(
const
char
*
type
,
const
char
*
attr
)
{
bool
sepolicy
::
typeattribute
(
const
char
*
type
,
const
char
*
attr
)
{
dprint
(
__FUNCTION__
,
type
,
attr
);
return
impl
->
add_typeattribute
(
type
,
attr
);
}
int
sepolicy
::
genfscon
(
const
char
*
fs_name
,
const
char
*
path
,
const
char
*
ctx
)
{
bool
sepolicy
::
genfscon
(
const
char
*
fs_name
,
const
char
*
path
,
const
char
*
ctx
)
{
dprint
(
__FUNCTION__
,
fs_name
,
path
,
ctx
);
return
impl
->
add_genfscon
(
fs_name
,
path
,
ctx
);
}
int
sepolicy
::
exists
(
const
char
*
source
)
{
bool
sepolicy
::
exists
(
const
char
*
source
)
{
return
hashtab_search
(
db
->
p_types
.
table
,
source
)
!=
nullptr
;
}
native/jni/magiskpolicy/sepolicy.hpp
View file @
951273f8
...
...
@@ -8,19 +8,17 @@ struct sepol_impl : public sepolicy {
int
set_attr
(
const
char
*
attr_name
,
int
type_val
);
void
check_avtab_node
(
avtab_ptr_t
node
);
avtab_ptr_t
get_avtab_node
(
avtab_key_t
*
key
,
avtab_extended_perms_t
*
xperms
);
int
add_avrule
(
avtab_key_t
*
key
,
int
val
,
bool
n
);
int
add_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
,
int
effect
,
bool
n
);
int
add_rule
(
type_datum_t
*
src
,
type_datum_t
*
tgt
,
class_datum_t
*
cls
,
perm_datum_t
*
perm
,
int
effect
,
bool
n
);
int
add_avxrule
(
avtab_key_t
*
key
,
uint16_t
low
,
uint16_t
high
,
bool
n
);
int
add_xperm_rule
(
type_datum_t
*
src
,
type_datum_t
*
tgt
,
bool
add_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
,
int
effect
,
bool
n
);
void
add_rule
(
type_datum_t
*
src
,
type_datum_t
*
tgt
,
class_datum_t
*
cls
,
perm_datum_t
*
perm
,
int
effect
,
bool
n
);
void
add_xperm_rule
(
type_datum_t
*
src
,
type_datum_t
*
tgt
,
class_datum_t
*
cls
,
uint16_t
low
,
uint16_t
high
,
int
effect
,
bool
n
);
int
add_xperm_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
,
int
effect
,
bool
n
);
int
create_domain
(
const
char
*
type_name
);
int
set_domain_state
(
const
char
*
s
,
bool
permissive
);
int
add_filename_trans
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
);
int
add_typeattribute
(
const
char
*
type
,
const
char
*
attr
);
int
add_type_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
int
effect
);
int
add_genfscon
(
const
char
*
fs_name
,
const
char
*
path
,
const
char
*
context
);
bool
add_xperm_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
,
int
effect
,
bool
n
);
bool
add_type_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
int
effect
);
bool
add_filename_trans
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
);
bool
add_genfscon
(
const
char
*
fs_name
,
const
char
*
path
,
const
char
*
context
);
bool
create_domain
(
const
char
*
type_name
);
bool
set_domain_state
(
const
char
*
s
,
bool
permissive
);
bool
add_typeattribute
(
const
char
*
type
,
const
char
*
attr
);
void
strip_dontaudit
();
void
allow_su_client
(
const
char
*
type
);
};
...
...
native/jni/magiskpolicy/statement.cpp
View file @
951273f8
...
...
@@ -133,7 +133,7 @@ static bool tokenize_and_check(char *stmt, vector<vector<char *>> &arr) {
template
<
typename
Func
,
typename
...
Args
>
static
void
run_and_check
(
const
Func
&
fn
,
const
char
*
action
,
Args
...
args
)
{
if
(
fn
(
args
...))
{
if
(
!
fn
(
args
...))
{
string
s
=
"Error in: %s"
;
for
(
int
i
=
0
;
i
<
sizeof
...(
args
);
++
i
)
s
+=
" %s"
;
s
+=
"
\n
"
;
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment