Commit a65c7ee2 authored by topjohnwu's avatar topjohnwu

Integrate with unified daemon

parent 838b2757
......@@ -2,44 +2,55 @@
#include "sepolicy.h"
int sepol_allow(char *s, char *t, char *c, char *p) {
// printf("allow %s %s %s %s\n", s, t, c, p);
return add_rule(s, t, c, p, AVTAB_ALLOWED, 0);
}
int sepol_deny(char *s, char *t, char *c, char *p) {
// printf("deny %s %s %s %s\n", s, t, c, p);
return add_rule(s, t, c, p, AVTAB_ALLOWED, 1);
}
int sepol_auditallow(char *s, char *t, char *c, char *p) {
// printf("auditallow %s %s %s %s\n", s, t, c, p);
return add_rule(s, t, c, p, AVTAB_AUDITALLOW, 0);
}
int sepol_auditdeny(char *s, char *t, char *c, char *p) {
// printf("auditdeny %s %s %s %s\n", s, t, c, p);
return add_rule(s, t, c, p, AVTAB_AUDITDENY, 0);
}
int sepol_typetrans(char *s, char *t, char *c, char *d, char *o) {
if (o == NULL)
if (o == NULL) {
// printf("add_trans %s %s %s %s\n", s, t, c ,d);
return add_transition(s, t, c, d);
else
} else {
// printf("add_file_trans %s %s %s %s %s\n", s, t, c ,d, o);
return add_file_transition(s, t, c, d, o);
}
}
int sepol_permissive(char *s) {
// printf("permissive %s\n", s);
return set_domain_state(s, 1);
}
int sepol_enforce(char *s) {
// printf("enforce %s\n", s);
return set_domain_state(s, 0);
}
int sepol_create(char *s) {
// printf("create %s\n", s);
return create_domain(s);
}
int sepol_attradd(char *s, char *a) {
// printf("attradd %s %s\n", s, a);
return add_typeattribute(s, a);
}
int sepol_exists(char* source) {
return !! hashtab_search(policy->p_types.table, source);
return !! hashtab_search(policydb->p_types.table, source);
}
......@@ -53,10 +53,10 @@ static void usage(char *arg0) {
"%s [--options...] [policystatements...]\n\n"
"Options:\n"
" --live: directly load patched policy to device\n"
" --magisk: complete (very large!) patches for Magisk and MagiskSU\n"
// " --magisk: complete (very large!) patches for Magisk and MagiskSU\n"
" --minimal: minimal patches, used for boot image patches\n"
" --load <infile>: load policies from <infile>\n"
" (load from current policies if not specified)"
" (load from current policies if not specified)\n"
" --save <outfile>: save policies to <outfile>\n"
, arg0);
statements();
......@@ -270,7 +270,7 @@ static void syntax_error_msg() {
int magiskpolicy_main(int argc, char *argv[]) {
char *infile = NULL, *outfile = NULL, *tok, *saveptr;
int live = 0, minimal = 0, full = 0;
int live = 0, minimal = 0;
struct vector rules;
vec_init(&rules);
......@@ -280,8 +280,6 @@ int magiskpolicy_main(int argc, char *argv[]) {
if (argv[i][0] == '-' && argv[i][1] == '-') {
if (strcmp(argv[i], "--live") == 0)
live = 1;
else if (strcmp(argv[i], "--magisk") == 0)
full = 1;
else if (strcmp(argv[i], "--minimal") == 0)
minimal = 1;
else if (strcmp(argv[i], "--load") == 0) {
......@@ -298,28 +296,17 @@ int magiskpolicy_main(int argc, char *argv[]) {
vec_push_back(&rules, argv[i]);
}
policydb_t policydb;
sidtab_t sidtab;
policy = &policydb;
// Use current policy if not specified
if(!infile)
infile = "/sys/fs/selinux/policy";
sepol_set_policydb(&policydb);
sepol_set_sidtab(&sidtab);
if (load_policy(infile)) {
if (load_policydb(infile)) {
fprintf(stderr, "Could not load policy\n");
return 1;
}
if (policydb_load_isids(&policydb, &sidtab))
return 1;
if (full) sepol_full_rules();
else if (minimal) sepol_min_rules();
if (minimal)
sepol_min_rules();
for (int i = 0; i < rules.size; ++i) {
// Since strtok will modify the origin string, copy the policy for error messages
......@@ -363,15 +350,15 @@ int magiskpolicy_main(int argc, char *argv[]) {
vec_destroy(&rules);
if (live)
if (dump_policy("/sys/fs/selinux/load"))
if (dump_policydb("/sys/fs/selinux/load"))
return 1;
if (outfile) {
unlink(outfile);
if (dump_policy(outfile))
if (dump_policydb(outfile))
return 1;
}
policydb_destroy(&policydb);
destroy_policydb();
return 0;
}
......@@ -8,6 +8,11 @@
#define ALL NULL
// policydb functions
int load_policydb(const char *filename);
int dump_policydb(const char *filename);
void destroy_policydb();
// Handy functions
int sepol_allow(char *s, char *t, char *c, char *p);
int sepol_deny(char *s, char *t, char *c, char *p);
......@@ -21,7 +26,8 @@ int sepol_attradd(char *s, char *a);
int sepol_exists(char *source);
// Built in rules
void sepol_full_rules();
void sepol_min_rules();
void sepol_med_rules();
void sepol_full_rules();
#endif
......@@ -65,14 +65,16 @@ void samsung() {
}
void allowSuClient(char *target) {
sepol_allow(target, "rootfs", "file", "execute_no_trans");
sepol_allow(target, "rootfs", "file", "execute");
sepol_allow(target, "rootfs", "file", ALL);
sepol_allow(target, "rootfs", "lnk_file", ALL);
sepol_allow(target, "su", "unix_stream_socket", "connectto");
sepol_allow(target, "su", "unix_stream_socket", "getopt");
sepol_allow(target, "su_device", "dir", "search");
sepol_allow(target, "su_device", "dir", "read");
sepol_allow(target, "su_device", "sock_file", "read");
sepol_allow(target, "su_device", "sock_file", "write");
sepol_allow("su", target, "fd", "use");
sepol_allow("su", target, "fifo_file", ALL);
}
void suRights() {
......@@ -83,6 +85,16 @@ void suRights() {
sepol_allow("servicemanager", "su", "process", "getattr");
sepol_allow("servicemanager", "su", "binder", "transfer");
sepol_allow("system_server", "su", "binder", "call");
sepol_allow("su", "servicemanager", "dir", "search");
sepol_allow("su", "servicemanager", "dir", "read");
sepol_allow("su", "servicemanager", "file", "open");
sepol_allow("su", "servicemanager", "file", "read");
sepol_allow("su", "servicemanager", "process", "getattr");
sepol_allow("su", "servicemanager", "binder", "transfer");
sepol_allow("su", "servicemanager", "binder", "call");
sepol_allow("su", "system_server", "binder", "transfer");
sepol_allow("su", "system_server", "binder", "call");
}
void otherToSU() {
......@@ -129,61 +141,17 @@ void otherToSU() {
sepol_allow("audioserver", "audioserver", "process", "execmem");
}
void sepol_full_rules() {
// Samsung specific
// Prevent system from loading policy
if(sepol_exists("knox_system_app"))
samsung();
// Min rules first
sepol_min_rules();
// Create domains if they don't exist
if (!sepol_exists("su_device"))
sepol_create("su_device");
sepol_enforce("su_device");
// Patch su to everything
sepol_allow("su", ALL, ALL, ALL);
// Autotransition su's socket to su_device
sepol_typetrans("su", "device", "file", "su_device", NULL);
sepol_typetrans("su", "device", "dir", "su_device", NULL);
sepol_allow("su_device", "tmpfs", "filesystem", "associate");
// Transition from untrusted_app to su_client
allowSuClient("shell");
allowSuClient("untrusted_app");
allowSuClient("system_app");
allowSuClient("platform_app");
if (sepol_exists("priv_app"))
allowSuClient("priv_app");
if (sepol_exists("ssd_tool"))
allowSuClient("ssd_tool");
// Allow init to execute su daemon/transition
sepol_allow("init", "su", "process", "transition");
sepol_allow("init", "su", "process", "rlimitinh");
sepol_allow("init", "su", "process", "siginh");
sepol_allow("init", "su", "process", "noatsecure");
suRights();
otherToSU();
// Need to set su_device/su as trusted to be accessible from other categories
sepol_attradd("su_device", "mlstrustedobject");
sepol_attradd("su", "mlstrustedsubject");
}
// Minimal to run Magisk script before live patching
// Minimal boot image patch, Samsung requires these patches
void sepol_min_rules() {
if (!sepol_exists("su"))
sepol_create("su");
if (!sepol_exists("su_device"))
sepol_create("su_device");
sepol_permissive("su");
sepol_permissive("init");
sepol_attradd("su", "mlstrustedsubject");
sepol_attradd("su_device", "mlstrustedobject");
// Let init run stuffs in su context
sepol_allow("kernel", "su", "fd", "use");
......@@ -192,11 +160,27 @@ void sepol_min_rules() {
sepol_allow("init", "system_file", "lnk_file", ALL);
sepol_allow("init", "system_file", "file", ALL);
// Misc: basic shell scripts, prop management etc.
// Samsung specific
// Prevent system from loading policy
if(sepol_exists("knox_system_app"))
samsung();
// Shell, prop management, simple su rights
sepol_allow("su", "property_socket", "sock_file", "write");
if (sepol_exists("default_prop"))
sepol_allow("su", "default_prop", "property_service", "set");
sepol_allow("su", "init", "unix_stream_socket", "connectto");
sepol_allow("su", "rootfs", "file", "entrypoint");
sepol_allow("su", "devpts", "chr_file", ALL);
sepol_allow("su", "untrusted_app_devpts", "chr_file", ALL);
sepol_allow("su", "su_device", "dir", ALL);
sepol_allow("su", "su_device", "sock_file", ALL);
sepol_allow("su", "zygote_exec", "file", ALL);
sepol_allow("su", "zygote_exec", "lnk_file", ALL);
sepol_allow("su", "app_data_file", "dir", ALL);
sepol_allow("su", "app_data_file", "file", ALL);
sepol_allow("su", "toolbox_exec", "file", ALL);
sepol_allow("su", "shell_exec", "file", ALL);
sepol_allow("su", "su", "unix_dgram_socket", ALL);
sepol_allow("su", "su", "unix_stream_socket", ALL);
sepol_allow("su", "su", "process", ALL);
......@@ -206,10 +190,10 @@ void sepol_min_rules() {
sepol_allow("su", "su", "lnk_file", ALL);
sepol_allow("su", "su", "dir", ALL);
// Allow su to do anything to files/dir/links
sepol_allow("su", ALL, "file", ALL);
sepol_allow("su", ALL, "dir", ALL);
sepol_allow("su", ALL, "lnk_file", ALL);
// Autotransition su socket to su_device
sepol_typetrans("su", "device", "file", "su_device", NULL);
sepol_typetrans("su", "device", "dir", "su_device", NULL);
sepol_allow("su_device", "tmpfs", "filesystem", "associate");
// For sepolicy live patching
sepol_allow("su", "kernel", "security", "read_policy");
......@@ -226,5 +210,32 @@ void sepol_min_rules() {
// Xposed
sepol_allow("untrusted_app", "untrusted_app", "capability", "setgid");
sepol_allow("system_server", "dex2oat_exec", "file", ALL);
}
void sepol_med_rules() {
sepol_min_rules();
// Allow su to do anything to any files/dir/links
sepol_allow("su", ALL, "file", ALL);
sepol_allow("su", ALL, "dir", ALL);
sepol_allow("su", ALL, "lnk_file", ALL);
// Allow these client to access su
allowSuClient("shell");
allowSuClient("untrusted_app");
allowSuClient("system_app");
allowSuClient("platform_app");
if (sepol_exists("priv_app"))
allowSuClient("priv_app");
if (sepol_exists("ssd_tool"))
allowSuClient("ssd_tool");
suRights();
otherToSU();
}
void sepol_full_rules() {
// Patch su to everything
sepol_allow("su", ALL, ALL, ALL);
}
This diff is collapsed.
......@@ -33,11 +33,9 @@
for (*ptr = table->htable[_i]; *ptr != NULL; *ptr = (*ptr)->next)
// Global policydb
policydb_t *policy;
extern policydb_t *policydb;
// sepolicy manipulation functions
int load_policy(const char *filename);
int dump_policy(const char *filename);
int create_domain(char *d);
int set_domain_state(char* s, int state);
int add_transition(char *s, char *t, char *c, char *d);
......@@ -45,4 +43,6 @@ int add_file_transition(char *s, char *t, char *c, char *d, char* filename);
int add_typeattribute(char *domainS, char *attr);
int add_rule(char *s, char *t, char *c, char *p, int effect, int not);
extern int policydb_index_decls(sepol_handle_t * handle, policydb_t * p);
#endif
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment