Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
M
Magisk
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
Magisk
Commits
a65c7ee2
Commit
a65c7ee2
authored
Apr 15, 2017
by
topjohnwu
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Integrate with unified daemon
parent
838b2757
Expand all
Hide whitespace changes
Inline
Side-by-side
Showing
6 changed files
with
173 additions
and
145 deletions
+173
-145
api.c
api.c
+14
-3
magiskpolicy.c
magiskpolicy.c
+9
-22
magiskpolicy.h
magiskpolicy.h
+7
-1
rules.c
rules.c
+66
-55
sepolicy.c
sepolicy.c
+74
-61
sepolicy.h
sepolicy.h
+3
-3
No files found.
api.c
View file @
a65c7ee2
...
...
@@ -2,44 +2,55 @@
#include "sepolicy.h"
int
sepol_allow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
// printf("allow %s %s %s %s\n", s, t, c, p);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
0
);
}
int
sepol_deny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
// printf("deny %s %s %s %s\n", s, t, c, p);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
1
);
}
int
sepol_auditallow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
// printf("auditallow %s %s %s %s\n", s, t, c, p);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITALLOW
,
0
);
}
int
sepol_auditdeny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
)
{
// printf("auditdeny %s %s %s %s\n", s, t, c, p);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITDENY
,
0
);
}
int
sepol_typetrans
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
,
char
*
o
)
{
if
(
o
==
NULL
)
if
(
o
==
NULL
)
{
// printf("add_trans %s %s %s %s\n", s, t, c ,d);
return
add_transition
(
s
,
t
,
c
,
d
);
else
}
else
{
// printf("add_file_trans %s %s %s %s %s\n", s, t, c ,d, o);
return
add_file_transition
(
s
,
t
,
c
,
d
,
o
);
}
}
int
sepol_permissive
(
char
*
s
)
{
// printf("permissive %s\n", s);
return
set_domain_state
(
s
,
1
);
}
int
sepol_enforce
(
char
*
s
)
{
// printf("enforce %s\n", s);
return
set_domain_state
(
s
,
0
);
}
int
sepol_create
(
char
*
s
)
{
// printf("create %s\n", s);
return
create_domain
(
s
);
}
int
sepol_attradd
(
char
*
s
,
char
*
a
)
{
// printf("attradd %s %s\n", s, a);
return
add_typeattribute
(
s
,
a
);
}
int
sepol_exists
(
char
*
source
)
{
return
!!
hashtab_search
(
policy
->
p_types
.
table
,
source
);
return
!!
hashtab_search
(
policy
db
->
p_types
.
table
,
source
);
}
magiskpolicy.c
View file @
a65c7ee2
...
...
@@ -53,10 +53,10 @@ static void usage(char *arg0) {
"%s [--options...] [policystatements...]
\n\n
"
"Options:
\n
"
" --live: directly load patched policy to device
\n
"
" --magisk: complete (very large!) patches for Magisk and MagiskSU
\n
"
//
" --magisk: complete (very large!) patches for Magisk and MagiskSU\n"
" --minimal: minimal patches, used for boot image patches
\n
"
" --load <infile>: load policies from <infile>
\n
"
" (load from current policies if not specified)"
" (load from current policies if not specified)
\n
"
" --save <outfile>: save policies to <outfile>
\n
"
,
arg0
);
statements
();
...
...
@@ -270,7 +270,7 @@ static void syntax_error_msg() {
int
magiskpolicy_main
(
int
argc
,
char
*
argv
[])
{
char
*
infile
=
NULL
,
*
outfile
=
NULL
,
*
tok
,
*
saveptr
;
int
live
=
0
,
minimal
=
0
,
full
=
0
;
int
live
=
0
,
minimal
=
0
;
struct
vector
rules
;
vec_init
(
&
rules
);
...
...
@@ -280,8 +280,6 @@ int magiskpolicy_main(int argc, char *argv[]) {
if
(
argv
[
i
][
0
]
==
'-'
&&
argv
[
i
][
1
]
==
'-'
)
{
if
(
strcmp
(
argv
[
i
],
"--live"
)
==
0
)
live
=
1
;
else
if
(
strcmp
(
argv
[
i
],
"--magisk"
)
==
0
)
full
=
1
;
else
if
(
strcmp
(
argv
[
i
],
"--minimal"
)
==
0
)
minimal
=
1
;
else
if
(
strcmp
(
argv
[
i
],
"--load"
)
==
0
)
{
...
...
@@ -298,28 +296,17 @@ int magiskpolicy_main(int argc, char *argv[]) {
vec_push_back
(
&
rules
,
argv
[
i
]);
}
policydb_t
policydb
;
sidtab_t
sidtab
;
policy
=
&
policydb
;
// Use current policy if not specified
if
(
!
infile
)
infile
=
"/sys/fs/selinux/policy"
;
sepol_set_policydb
(
&
policydb
);
sepol_set_sidtab
(
&
sidtab
);
if
(
load_policy
(
infile
))
{
if
(
load_policydb
(
infile
))
{
fprintf
(
stderr
,
"Could not load policy
\n
"
);
return
1
;
}
if
(
policydb_load_isids
(
&
policydb
,
&
sidtab
))
return
1
;
if
(
full
)
sepol_full_rules
();
else
if
(
minimal
)
sepol_min_rules
();
if
(
minimal
)
sepol_min_rules
();
for
(
int
i
=
0
;
i
<
rules
.
size
;
++
i
)
{
// Since strtok will modify the origin string, copy the policy for error messages
...
...
@@ -363,15 +350,15 @@ int magiskpolicy_main(int argc, char *argv[]) {
vec_destroy
(
&
rules
);
if
(
live
)
if
(
dump_policy
(
"/sys/fs/selinux/load"
))
if
(
dump_policy
db
(
"/sys/fs/selinux/load"
))
return
1
;
if
(
outfile
)
{
unlink
(
outfile
);
if
(
dump_policy
(
outfile
))
if
(
dump_policy
db
(
outfile
))
return
1
;
}
policydb_destroy
(
&
policydb
);
destroy_policydb
(
);
return
0
;
}
magiskpolicy.h
View file @
a65c7ee2
...
...
@@ -8,6 +8,11 @@
#define ALL NULL
// policydb functions
int
load_policydb
(
const
char
*
filename
);
int
dump_policydb
(
const
char
*
filename
);
void
destroy_policydb
();
// Handy functions
int
sepol_allow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
sepol_deny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
...
...
@@ -21,7 +26,8 @@ int sepol_attradd(char *s, char *a);
int
sepol_exists
(
char
*
source
);
// Built in rules
void
sepol_full_rules
();
void
sepol_min_rules
();
void
sepol_med_rules
();
void
sepol_full_rules
();
#endif
rules.c
View file @
a65c7ee2
...
...
@@ -65,14 +65,16 @@ void samsung() {
}
void
allowSuClient
(
char
*
target
)
{
sepol_allow
(
target
,
"rootfs"
,
"file"
,
"execute_no_trans"
);
sepol_allow
(
target
,
"rootfs"
,
"
file"
,
"execute"
);
sepol_allow
(
target
,
"rootfs"
,
"file"
,
ALL
);
sepol_allow
(
target
,
"rootfs"
,
"
lnk_file"
,
ALL
);
sepol_allow
(
target
,
"su"
,
"unix_stream_socket"
,
"connectto"
);
sepol_allow
(
target
,
"su"
,
"unix_stream_socket"
,
"getopt"
);
sepol_allow
(
target
,
"su_device"
,
"dir"
,
"search"
);
sepol_allow
(
target
,
"su_device"
,
"dir"
,
"read"
);
sepol_allow
(
target
,
"su_device"
,
"sock_file"
,
"read"
);
sepol_allow
(
target
,
"su_device"
,
"sock_file"
,
"write"
);
sepol_allow
(
"su"
,
target
,
"fd"
,
"use"
);
sepol_allow
(
"su"
,
target
,
"fifo_file"
,
ALL
);
}
void
suRights
()
{
...
...
@@ -83,6 +85,16 @@ void suRights() {
sepol_allow
(
"servicemanager"
,
"su"
,
"process"
,
"getattr"
);
sepol_allow
(
"servicemanager"
,
"su"
,
"binder"
,
"transfer"
);
sepol_allow
(
"system_server"
,
"su"
,
"binder"
,
"call"
);
sepol_allow
(
"su"
,
"servicemanager"
,
"dir"
,
"search"
);
sepol_allow
(
"su"
,
"servicemanager"
,
"dir"
,
"read"
);
sepol_allow
(
"su"
,
"servicemanager"
,
"file"
,
"open"
);
sepol_allow
(
"su"
,
"servicemanager"
,
"file"
,
"read"
);
sepol_allow
(
"su"
,
"servicemanager"
,
"process"
,
"getattr"
);
sepol_allow
(
"su"
,
"servicemanager"
,
"binder"
,
"transfer"
);
sepol_allow
(
"su"
,
"servicemanager"
,
"binder"
,
"call"
);
sepol_allow
(
"su"
,
"system_server"
,
"binder"
,
"transfer"
);
sepol_allow
(
"su"
,
"system_server"
,
"binder"
,
"call"
);
}
void
otherToSU
()
{
...
...
@@ -129,61 +141,17 @@ void otherToSU() {
sepol_allow
(
"audioserver"
,
"audioserver"
,
"process"
,
"execmem"
);
}
void
sepol_full_rules
()
{
// Samsung specific
// Prevent system from loading policy
if
(
sepol_exists
(
"knox_system_app"
))
samsung
();
// Min rules first
sepol_min_rules
();
// Create domains if they don't exist
if
(
!
sepol_exists
(
"su_device"
))
sepol_create
(
"su_device"
);
sepol_enforce
(
"su_device"
);
// Patch su to everything
sepol_allow
(
"su"
,
ALL
,
ALL
,
ALL
);
// Autotransition su's socket to su_device
sepol_typetrans
(
"su"
,
"device"
,
"file"
,
"su_device"
,
NULL
);
sepol_typetrans
(
"su"
,
"device"
,
"dir"
,
"su_device"
,
NULL
);
sepol_allow
(
"su_device"
,
"tmpfs"
,
"filesystem"
,
"associate"
);
// Transition from untrusted_app to su_client
allowSuClient
(
"shell"
);
allowSuClient
(
"untrusted_app"
);
allowSuClient
(
"system_app"
);
allowSuClient
(
"platform_app"
);
if
(
sepol_exists
(
"priv_app"
))
allowSuClient
(
"priv_app"
);
if
(
sepol_exists
(
"ssd_tool"
))
allowSuClient
(
"ssd_tool"
);
// Allow init to execute su daemon/transition
sepol_allow
(
"init"
,
"su"
,
"process"
,
"transition"
);
sepol_allow
(
"init"
,
"su"
,
"process"
,
"rlimitinh"
);
sepol_allow
(
"init"
,
"su"
,
"process"
,
"siginh"
);
sepol_allow
(
"init"
,
"su"
,
"process"
,
"noatsecure"
);
suRights
();
otherToSU
();
// Need to set su_device/su as trusted to be accessible from other categories
sepol_attradd
(
"su_device"
,
"mlstrustedobject"
);
sepol_attradd
(
"su"
,
"mlstrustedsubject"
);
}
// Minimal to run Magisk script before live patching
// Minimal boot image patch, Samsung requires these patches
void
sepol_min_rules
()
{
if
(
!
sepol_exists
(
"su"
))
sepol_create
(
"su"
);
if
(
!
sepol_exists
(
"su_device"
))
sepol_create
(
"su_device"
);
sepol_permissive
(
"su"
);
sepol_permissive
(
"init"
);
sepol_attradd
(
"su"
,
"mlstrustedsubject"
);
sepol_attradd
(
"su_device"
,
"mlstrustedobject"
);
// Let init run stuffs in su context
sepol_allow
(
"kernel"
,
"su"
,
"fd"
,
"use"
);
...
...
@@ -192,11 +160,27 @@ void sepol_min_rules() {
sepol_allow
(
"init"
,
"system_file"
,
"lnk_file"
,
ALL
);
sepol_allow
(
"init"
,
"system_file"
,
"file"
,
ALL
);
// Misc: basic shell scripts, prop management etc.
// Samsung specific
// Prevent system from loading policy
if
(
sepol_exists
(
"knox_system_app"
))
samsung
();
// Shell, prop management, simple su rights
sepol_allow
(
"su"
,
"property_socket"
,
"sock_file"
,
"write"
);
if
(
sepol_exists
(
"default_prop"
))
sepol_allow
(
"su"
,
"default_prop"
,
"property_service"
,
"set"
);
sepol_allow
(
"su"
,
"init"
,
"unix_stream_socket"
,
"connectto"
);
sepol_allow
(
"su"
,
"rootfs"
,
"file"
,
"entrypoint"
);
sepol_allow
(
"su"
,
"devpts"
,
"chr_file"
,
ALL
);
sepol_allow
(
"su"
,
"untrusted_app_devpts"
,
"chr_file"
,
ALL
);
sepol_allow
(
"su"
,
"su_device"
,
"dir"
,
ALL
);
sepol_allow
(
"su"
,
"su_device"
,
"sock_file"
,
ALL
);
sepol_allow
(
"su"
,
"zygote_exec"
,
"file"
,
ALL
);
sepol_allow
(
"su"
,
"zygote_exec"
,
"lnk_file"
,
ALL
);
sepol_allow
(
"su"
,
"app_data_file"
,
"dir"
,
ALL
);
sepol_allow
(
"su"
,
"app_data_file"
,
"file"
,
ALL
);
sepol_allow
(
"su"
,
"toolbox_exec"
,
"file"
,
ALL
);
sepol_allow
(
"su"
,
"shell_exec"
,
"file"
,
ALL
);
sepol_allow
(
"su"
,
"su"
,
"unix_dgram_socket"
,
ALL
);
sepol_allow
(
"su"
,
"su"
,
"unix_stream_socket"
,
ALL
);
sepol_allow
(
"su"
,
"su"
,
"process"
,
ALL
);
...
...
@@ -206,10 +190,10 @@ void sepol_min_rules() {
sepol_allow
(
"su"
,
"su"
,
"lnk_file"
,
ALL
);
sepol_allow
(
"su"
,
"su"
,
"dir"
,
ALL
);
// A
llow su to do anything to files/dir/links
sepol_
allow
(
"su"
,
ALL
,
"file"
,
A
LL
);
sepol_
allow
(
"su"
,
ALL
,
"dir"
,
A
LL
);
sepol_allow
(
"su
"
,
ALL
,
"lnk_file"
,
ALL
);
// A
utotransition su socket to su_device
sepol_
typetrans
(
"su"
,
"device"
,
"file"
,
"su_device"
,
NU
LL
);
sepol_
typetrans
(
"su"
,
"device"
,
"dir"
,
"su_device"
,
NU
LL
);
sepol_allow
(
"su
_device"
,
"tmpfs"
,
"filesystem"
,
"associate"
);
// For sepolicy live patching
sepol_allow
(
"su"
,
"kernel"
,
"security"
,
"read_policy"
);
...
...
@@ -226,5 +210,32 @@ void sepol_min_rules() {
// Xposed
sepol_allow
(
"untrusted_app"
,
"untrusted_app"
,
"capability"
,
"setgid"
);
sepol_allow
(
"system_server"
,
"dex2oat_exec"
,
"file"
,
ALL
);
}
void
sepol_med_rules
()
{
sepol_min_rules
();
// Allow su to do anything to any files/dir/links
sepol_allow
(
"su"
,
ALL
,
"file"
,
ALL
);
sepol_allow
(
"su"
,
ALL
,
"dir"
,
ALL
);
sepol_allow
(
"su"
,
ALL
,
"lnk_file"
,
ALL
);
// Allow these client to access su
allowSuClient
(
"shell"
);
allowSuClient
(
"untrusted_app"
);
allowSuClient
(
"system_app"
);
allowSuClient
(
"platform_app"
);
if
(
sepol_exists
(
"priv_app"
))
allowSuClient
(
"priv_app"
);
if
(
sepol_exists
(
"ssd_tool"
))
allowSuClient
(
"ssd_tool"
);
suRights
();
otherToSU
();
}
void
sepol_full_rules
()
{
// Patch su to everything
sepol_allow
(
"su"
,
ALL
,
ALL
,
ALL
);
}
sepolicy.c
View file @
a65c7ee2
This diff is collapsed.
Click to expand it.
sepolicy.h
View file @
a65c7ee2
...
...
@@ -33,11 +33,9 @@
for (*ptr = table->htable[_i]; *ptr != NULL; *ptr = (*ptr)->next)
// Global policydb
policydb_t
*
policy
;
extern
policydb_t
*
policydb
;
// sepolicy manipulation functions
int
load_policy
(
const
char
*
filename
);
int
dump_policy
(
const
char
*
filename
);
int
create_domain
(
char
*
d
);
int
set_domain_state
(
char
*
s
,
int
state
);
int
add_transition
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
);
...
...
@@ -45,4 +43,6 @@ int add_file_transition(char *s, char *t, char *c, char *d, char* filename);
int
add_typeattribute
(
char
*
domainS
,
char
*
attr
);
int
add_rule
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
,
int
effect
,
int
not
);
extern
int
policydb_index_decls
(
sepol_handle_t
*
handle
,
policydb_t
*
p
);
#endif
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment