Commit c69dc0f0 authored by topjohnwu's avatar topjohnwu

Update rules

parent c6947761
...@@ -16,6 +16,17 @@ void allowSuClient(char *target) { ...@@ -16,6 +16,17 @@ void allowSuClient(char *target) {
sepol_allow(target, SEPOL_FILE_DOMAIN, "sock_file", "write"); sepol_allow(target, SEPOL_FILE_DOMAIN, "sock_file", "write");
sepol_allow(target, SEPOL_FILE_DOMAIN, "file", ALL); sepol_allow(target, SEPOL_FILE_DOMAIN, "file", ALL);
sepol_allow(target, SEPOL_FILE_DOMAIN, "dir", ALL); sepol_allow(target, SEPOL_FILE_DOMAIN, "dir", ALL);
// Fix several terminal apps running root shell
if (policydb->policyvers >= POLICYDB_VERSION_XPERMS_IOCTL) {
sepol_allowxperm(target, "devpts", "chr_file", "0x5400-0x54FF");
if (sepol_exists("untrusted_app_devpts"))
sepol_allowxperm(target, "untrusted_app_devpts", "chr_file", "0x5400-0x54FF");
if (sepol_exists("untrusted_app_25_devpts"))
sepol_allowxperm(target, "untrusted_app_25_devpts", "chr_file", "0x5400-0x54FF");
if (sepol_exists("untrusted_app_all_devpts"))
sepol_allowxperm(target, "untrusted_app_all_devpts", "chr_file", "0x5400-0x54FF");
}
} }
void suRights() { void suRights() {
...@@ -110,10 +121,10 @@ void sepol_magisk_rules() { ...@@ -110,10 +121,10 @@ void sepol_magisk_rules() {
// Allow these client to access su // Allow these client to access su
allowSuClient("init"); allowSuClient("init");
allowSuClient("shell"); allowSuClient("shell");
allowSuClient("untrusted_app");
allowSuClient("system_app"); allowSuClient("system_app");
allowSuClient("platform_app");
allowSuClient("priv_app"); allowSuClient("priv_app");
allowSuClient("platform_app");
allowSuClient("untrusted_app");
allowSuClient("untrusted_app_25"); allowSuClient("untrusted_app_25");
allowSuClient("untrusted_app_27"); allowSuClient("untrusted_app_27");
...@@ -146,13 +157,4 @@ void sepol_magisk_rules() { ...@@ -146,13 +157,4 @@ void sepol_magisk_rules() {
// Xposed // Xposed
sepol_allow("untrusted_app", "untrusted_app", "capability", "setgid"); sepol_allow("untrusted_app", "untrusted_app", "capability", "setgid");
sepol_allow("system_server", "dex2oat_exec", "file", ALL); sepol_allow("system_server", "dex2oat_exec", "file", ALL);
// xperms
if (policydb->policyvers >= POLICYDB_VERSION_XPERMS_IOCTL) {
sepol_allowxperm("domain", "devpts", "chr_file", "0x5400-0x54FF");
if (sepol_exists("untrusted_app_25_devpts"))
sepol_allowxperm("domain", "untrusted_app_25_devpts", "chr_file", "0x5400-0x54FF");
if (sepol_exists("untrusted_app_devpts"))
sepol_allowxperm("domain", "untrusted_app_devpts", "chr_file", "0x5400-0x54FF");
}
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment