Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
M
Magisk
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
Magisk
Commits
a8978a0d
Commit
a8978a0d
authored
Nov 14, 2015
by
Pierre-Hugues Husson
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Update README
parent
10712c5e
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
15 additions
and
23 deletions
+15
-23
README.txt
README.txt
+15
-23
No files found.
README.txt
View file @
a8978a0d
Injects allow rules into binary SELinux kernel policies
Injecting a rule:
$ ./sepolicy-inject -s shell -t system -c file -p read -P sepolicy -o sepolicy2
libsepol.policydb_index_others: security: 1 users, 2 roles, 518 types, 14 bools
libsepol.policydb_index_others: security: 1 sens, 1024 cats
libsepol.policydb_index_others: security: 84 classes, 4539 rules, 162 cond rules
$ ./sepolicy-inject -s shell -t system -c file -p read -P sepolicy
$ sesearch -A -s shell -t system -c file sepolicy
Found 1 semantic av rules:
allow appdomain domain : file { ioctl read getattr lock open } ;
Injecting multiple permissions:
$ ./sepolicy-inject -s shell -t system -c file -p read,write,open -P sepolicy
$ sesearch -A -s shell -t system -c file sepolicy2
Found 2 semantic av rules:
allow shell system : file read ;
allow appdomain domain : file { ioctl read getattr lock open } ;
Add a type_attribute to a domain:
$ ./sepolicy-inject -s su -a mlstrustedsubject -P sepolicy
Injecting a permissive domain:
$ ./sepolicy-inject -Z shell -P sepolicy -o sepolicy2
$ seinfo sepolicy | grep Permissive
Permissives: 0 Polcap: 2
$ seinfo sepolicy2 | grep Permissive
Permissives: 1 Polcap: 2
$ ./sepolicy-inject -Z shell -P sepolicy
Change a permissive domain to non-permissive:
$ ./sepolicy-inject -z shell -P sepolicy
-o sepolicy2
$ ./sepolicy-inject -z shell -P sepolicy
Test a SELinux type exists:
$ ./sepolicy-inject -e -s shell -P sepolicy
TODO:
Test a SELinux class exists:
$ ./sepolicy-inject -e -c service_manager -P sepolicy
Insert multiple rules at the same time
Remove rules
Use attributes
Add a transition:
$ ./sepolicy-inject -s su_daemon -f device -c file -t su_device -P sepolicy
Add a filename transition:
$ ./sepolicy-inject -s su_daemon -f device -c file -g "socket" -t su_device -P sepolicy
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment