Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
M
Magisk
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
Magisk
Commits
d6fb9868
Commit
d6fb9868
authored
Nov 19, 2019
by
topjohnwu
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Small sepolicy refactor and fixes
parent
9aff1a57
Hide whitespace changes
Inline
Side-by-side
Showing
6 changed files
with
152 additions
and
173 deletions
+152
-173
api.cpp
native/jni/magiskpolicy/api.cpp
+20
-17
magiskpolicy.cpp
native/jni/magiskpolicy/magiskpolicy.cpp
+1
-1
policydb.cpp
native/jni/magiskpolicy/policydb.cpp
+10
-12
rules.cpp
native/jni/magiskpolicy/rules.cpp
+3
-7
sepolicy.c
native/jni/magiskpolicy/sepolicy.c
+115
-116
sepolicy.h
native/jni/magiskpolicy/sepolicy.h
+3
-20
No files found.
native/jni/magiskpolicy/api.cpp
View file @
d6fb9868
#include "magiskpolicy.h"
#include "magiskpolicy.h"
#include "sepolicy.h"
#include "sepolicy.h"
//#define vprint(fmt, ...) printf(fmt, __VA_ARGS__)
#define vprint(...)
int
sepol_allow
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
int
sepol_allow
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
// printf
("allow %s %s %s %s\n", s, t, c, p);
vprint
(
"allow %s %s %s %s
\n
"
,
s
,
t
,
c
,
p
);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
0
);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
0
);
}
}
int
sepol_deny
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
int
sepol_deny
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
// printf
("deny %s %s %s %s\n", s, t, c, p);
vprint
(
"deny %s %s %s %s
\n
"
,
s
,
t
,
c
,
p
);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
1
);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
1
);
}
}
int
sepol_auditallow
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
int
sepol_auditallow
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
// printf
("auditallow %s %s %s %s\n", s, t, c, p);
vprint
(
"auditallow %s %s %s %s
\n
"
,
s
,
t
,
c
,
p
);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITALLOW
,
0
);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITALLOW
,
0
);
}
}
int
sepol_dontaudit
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
int
sepol_dontaudit
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
// printf
("dontaudit %s %s %s %s\n", s, t, c, p);
vprint
(
"dontaudit %s %s %s %s
\n
"
,
s
,
t
,
c
,
p
);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITDENY
,
0
);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITDENY
,
1
);
}
}
int
sepol_allowxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
int
sepol_allowxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
// printf
("allowxperm %s %s %s %s\n", s, t, c, range);
vprint
(
"allowxperm %s %s %s %s
\n
"
,
s
,
t
,
c
,
range
);
return
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_ALLOWED
,
0
);
return
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_ALLOWED
,
0
);
}
}
int
sepol_auditallowxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
int
sepol_auditallowxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
// printf
("auditallowxperm %s %s %s %s\n", s, t, c, range);
vprint
(
"auditallowxperm %s %s %s %s
\n
"
,
s
,
t
,
c
,
range
);
return
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_AUDITALLOW
,
0
);
return
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_AUDITALLOW
,
0
);
}
}
int
sepol_dontauditxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
int
sepol_dontauditxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
// printf
("dontauditxperm %s %s %s %s\n", s, t, c, range);
vprint
(
"dontauditxperm %s %s %s %s
\n
"
,
s
,
t
,
c
,
range
);
return
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_DONTAUDIT
,
0
);
return
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_DONTAUDIT
,
0
);
}
}
int
sepol_typetrans
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
int
sepol_typetrans
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
// printf
("type_transition %s %s %s %s\n", s, t, c, d);
vprint
(
"type_transition %s %s %s %s
\n
"
,
s
,
t
,
c
,
d
);
return
add_type_rule
(
s
,
t
,
c
,
d
,
AVTAB_TRANSITION
);
return
add_type_rule
(
s
,
t
,
c
,
d
,
AVTAB_TRANSITION
);
}
}
int
sepol_typechange
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
int
sepol_typechange
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
// printf
("type_change %s %s %s %s\n", s, t, c, d);
vprint
(
"type_change %s %s %s %s
\n
"
,
s
,
t
,
c
,
d
);
return
add_type_rule
(
s
,
t
,
c
,
d
,
AVTAB_CHANGE
);
return
add_type_rule
(
s
,
t
,
c
,
d
,
AVTAB_CHANGE
);
}
}
int
sepol_typemember
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
int
sepol_typemember
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
// printf
("type_member %s %s %s %s\n", s, t, c, d);
vprint
(
"type_member %s %s %s %s
\n
"
,
s
,
t
,
c
,
d
);
return
add_type_rule
(
s
,
t
,
c
,
d
,
AVTAB_MEMBER
);
return
add_type_rule
(
s
,
t
,
c
,
d
,
AVTAB_MEMBER
);
}
}
int
sepol_nametrans
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
)
{
int
sepol_nametrans
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
)
{
// printf
("name_trans %s %s %s %s %s\n", s, t, c, d, o);
vprint
(
"name_trans %s %s %s %s %s
\n
"
,
s
,
t
,
c
,
d
,
o
);
return
add_filename_trans
(
s
,
t
,
c
,
d
,
o
);
return
add_filename_trans
(
s
,
t
,
c
,
d
,
o
);
}
}
int
sepol_permissive
(
const
char
*
s
)
{
int
sepol_permissive
(
const
char
*
s
)
{
// printf
("permissive %s\n", s);
vprint
(
"permissive %s
\n
"
,
s
);
return
set_domain_state
(
s
,
1
);
return
set_domain_state
(
s
,
1
);
}
}
int
sepol_enforce
(
const
char
*
s
)
{
int
sepol_enforce
(
const
char
*
s
)
{
// printf
("enforce %s\n", s);
vprint
(
"enforce %s
\n
"
,
s
);
return
set_domain_state
(
s
,
0
);
return
set_domain_state
(
s
,
0
);
}
}
int
sepol_create
(
const
char
*
s
)
{
int
sepol_create
(
const
char
*
s
)
{
// printf
("create %s\n", s);
vprint
(
"create %s
\n
"
,
s
);
return
create_domain
(
s
);
return
create_domain
(
s
);
}
}
int
sepol_attradd
(
const
char
*
s
,
const
char
*
a
)
{
int
sepol_attradd
(
const
char
*
s
,
const
char
*
a
)
{
// printf
("attradd %s %s\n", s, a);
vprint
(
"attradd %s %s
\n
"
,
s
,
a
);
return
add_typeattribute
(
s
,
a
);
return
add_typeattribute
(
s
,
a
);
}
}
int
sepol_exists
(
const
char
*
source
)
{
int
sepol_exists
(
const
char
*
source
)
{
return
hashtab_search
(
policydb
->
p_types
.
table
,
source
)
!=
nullptr
;
return
hashtab_search
(
magisk_
policydb
->
p_types
.
table
,
source
)
!=
nullptr
;
}
}
native/jni/magiskpolicy/magiskpolicy.cpp
View file @
d6fb9868
...
@@ -487,7 +487,7 @@ int magiskpolicy_main(int argc, char *argv[]) {
...
@@ -487,7 +487,7 @@ int magiskpolicy_main(int argc, char *argv[]) {
}
}
// Use current policy if nothing is loaded
// Use current policy if nothing is loaded
if
(
policydb
==
nullptr
&&
load_policydb
(
SELINUX_POLICY
))
{
if
(
magisk_
policydb
==
nullptr
&&
load_policydb
(
SELINUX_POLICY
))
{
fprintf
(
stderr
,
"Cannot load policy from "
SELINUX_POLICY
"
\n
"
);
fprintf
(
stderr
,
"Cannot load policy from "
SELINUX_POLICY
"
\n
"
);
return
1
;
return
1
;
}
}
...
...
native/jni/magiskpolicy/policydb.cpp
View file @
d6fb9868
...
@@ -11,10 +11,8 @@
...
@@ -11,10 +11,8 @@
#include "magiskpolicy.h"
#include "magiskpolicy.h"
#include "sepolicy.h"
#include "sepolicy.h"
policydb_t
*
policydb
=
nullptr
;
int
load_policydb
(
const
char
*
file
)
{
int
load_policydb
(
const
char
*
file
)
{
if
(
policydb
)
if
(
magisk_
policydb
)
destroy_policydb
();
destroy_policydb
();
struct
policy_file
pf
;
struct
policy_file
pf
;
...
@@ -22,8 +20,8 @@ int load_policydb(const char *file) {
...
@@ -22,8 +20,8 @@ int load_policydb(const char *file) {
pf
.
fp
=
xfopen
(
file
,
"re"
);
pf
.
fp
=
xfopen
(
file
,
"re"
);
pf
.
type
=
PF_USE_STDIO
;
pf
.
type
=
PF_USE_STDIO
;
policydb
=
new
policydb_t
(
);
magisk_policydb
=
static_cast
<
policydb_t
*>
(
xmalloc
(
sizeof
(
policydb_t
))
);
if
(
policydb_init
(
policydb
)
||
policydb_read
(
policydb
,
&
pf
,
0
))
if
(
policydb_init
(
magisk_policydb
)
||
policydb_read
(
magisk_
policydb
,
&
pf
,
0
))
return
1
;
return
1
;
fclose
(
pf
.
fp
);
fclose
(
pf
.
fp
);
...
@@ -169,7 +167,7 @@ int compile_split_cil() {
...
@@ -169,7 +167,7 @@ int compile_split_cil() {
return
1
;
return
1
;
cil_db_destroy
(
&
db
);
cil_db_destroy
(
&
db
);
policydb
=
&
pdb
->
p
;
magisk_
policydb
=
&
pdb
->
p
;
return
0
;
return
0
;
}
}
...
@@ -177,7 +175,7 @@ int dump_policydb(const char *file) {
...
@@ -177,7 +175,7 @@ int dump_policydb(const char *file) {
int
fd
,
ret
;
int
fd
,
ret
;
void
*
data
=
nullptr
;
void
*
data
=
nullptr
;
size_t
len
;
size_t
len
;
policydb_to_image
(
nullptr
,
policydb
,
&
data
,
&
len
);
policydb_to_image
(
nullptr
,
magisk_
policydb
,
&
data
,
&
len
);
if
(
data
==
nullptr
)
{
if
(
data
==
nullptr
)
{
LOGE
(
"Fail to dump policy image!
\n
"
);
LOGE
(
"Fail to dump policy image!
\n
"
);
return
1
;
return
1
;
...
@@ -194,9 +192,9 @@ int dump_policydb(const char *file) {
...
@@ -194,9 +192,9 @@ int dump_policydb(const char *file) {
}
}
void
destroy_policydb
()
{
void
destroy_policydb
()
{
if
(
policydb
)
{
if
(
magisk_
policydb
)
{
policydb_destroy
(
policydb
);
policydb_destroy
(
magisk_
policydb
);
delete
policydb
;
free
(
magisk_policydb
)
;
policydb
=
nullptr
;
magisk_
policydb
=
nullptr
;
}
}
}
}
\ No newline at end of file
native/jni/magiskpolicy/rules.cpp
View file @
d6fb9868
...
@@ -21,7 +21,7 @@ static void allowSuClient(const char *target) {
...
@@ -21,7 +21,7 @@ static void allowSuClient(const char *target) {
sepol_allow
(
target
,
"untrusted_app_devpts"
,
"chr_file"
,
"ioctl"
);
sepol_allow
(
target
,
"untrusted_app_devpts"
,
"chr_file"
,
"ioctl"
);
sepol_allow
(
target
,
"untrusted_app_25_devpts"
,
"chr_file"
,
"ioctl"
);
sepol_allow
(
target
,
"untrusted_app_25_devpts"
,
"chr_file"
,
"ioctl"
);
sepol_allow
(
target
,
"untrusted_app_all_devpts"
,
"chr_file"
,
"ioctl"
);
sepol_allow
(
target
,
"untrusted_app_all_devpts"
,
"chr_file"
,
"ioctl"
);
if
(
policydb
->
policyvers
>=
POLICYDB_VERSION_XPERMS_IOCTL
)
{
if
(
magisk_
policydb
->
policyvers
>=
POLICYDB_VERSION_XPERMS_IOCTL
)
{
sepol_allowxperm
(
target
,
"devpts"
,
"chr_file"
,
"0x5400-0x54FF"
);
sepol_allowxperm
(
target
,
"devpts"
,
"chr_file"
,
"0x5400-0x54FF"
);
sepol_allowxperm
(
target
,
"untrusted_app_devpts"
,
"chr_file"
,
"0x5400-0x54FF"
);
sepol_allowxperm
(
target
,
"untrusted_app_devpts"
,
"chr_file"
,
"0x5400-0x54FF"
);
sepol_allowxperm
(
target
,
"untrusted_app_25_devpts"
,
"chr_file"
,
"0x5400-0x54FF"
);
sepol_allowxperm
(
target
,
"untrusted_app_25_devpts"
,
"chr_file"
,
"0x5400-0x54FF"
);
...
@@ -166,7 +166,7 @@ void sepol_magisk_rules() {
...
@@ -166,7 +166,7 @@ void sepol_magisk_rules() {
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"fifo_file"
,
ALL
);
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"fifo_file"
,
ALL
);
// Allow us to do any ioctl on all block devices
// Allow us to do any ioctl on all block devices
if
(
policydb
->
policyvers
>=
POLICYDB_VERSION_XPERMS_IOCTL
)
if
(
magisk_
policydb
->
policyvers
>=
POLICYDB_VERSION_XPERMS_IOCTL
)
sepol_allowxperm
(
SEPOL_PROC_DOMAIN
,
ALL
,
"blk_file"
,
"0x0000-0xFFFF"
);
sepol_allowxperm
(
SEPOL_PROC_DOMAIN
,
ALL
,
"blk_file"
,
"0x0000-0xFFFF"
);
// Allow all binder transactions
// Allow all binder transactions
...
@@ -198,11 +198,7 @@ void sepol_magisk_rules() {
...
@@ -198,11 +198,7 @@ void sepol_magisk_rules() {
#ifdef MAGISK_DEBUG
#ifdef MAGISK_DEBUG
// Remove all dontaudit in debug mode
// Remove all dontaudit in debug mode
avtab_ptr_t
av
;
strip_dontaudit
();
avtab_for_each
(
&
policydb
->
te_avtab
,
av
,
{
if
(
av
->
key
.
specified
==
AVTAB_AUDITDENY
||
av
->
key
.
specified
==
AVTAB_XPERMS_DONTAUDIT
)
avtab_remove_node
(
&
policydb
->
te_avtab
,
av
);
})
#endif
#endif
log_cb
.
w
=
bak
;
log_cb
.
w
=
bak
;
...
...
native/jni/magiskpolicy/sepolicy.c
View file @
d6fb9868
...
@@ -5,47 +5,44 @@
...
@@ -5,47 +5,44 @@
#include "sepolicy.h"
#include "sepolicy.h"
policydb_t
*
magisk_policydb
=
NULL
;
#define mpdb magisk_policydb
extern
void
*
xmalloc
(
size_t
size
);
extern
void
*
xmalloc
(
size_t
size
);
extern
void
*
xcalloc
(
size_t
nmemb
,
size_t
size
);
extern
void
*
xcalloc
(
size_t
nmemb
,
size_t
size
);
extern
void
*
xrealloc
(
void
*
ptr
,
size_t
size
);
extern
void
*
xrealloc
(
void
*
ptr
,
size_t
size
);
extern
int
policydb_index_decls
(
sepol_handle_t
*
handle
,
policydb_t
*
p
);
extern
int
policydb_index_decls
(
sepol_handle_t
*
handle
,
policydb_t
*
p
);
static
int
get_attr
(
const
char
*
type
,
int
value
)
{
// Generic hash table traversal
type_datum_t
*
attr
=
hashtab_search
(
policydb
->
p_types
.
table
,
type
);
#define hash_for_each(node_ptr, n_slots, table, block) \
if
(
!
attr
)
for (int __i = 0; __i < (table)->n_slots; ++__i) { \
return
1
;
__typeof__(*(table)->node_ptr) node; \
__typeof__(node) __next; \
if
(
attr
->
flavor
!=
TYPE_ATTRIB
)
for (node = (table)->node_ptr[__i]; node; node = __next) { \
return
1
;
__next = node->next; \
block \
return
ebitmap_get_bit
(
&
policydb
->
attr_type_map
[
attr
->
s
.
value
-
1
],
value
-
1
)
!=
0
;
} \
}
} \
static
int
get_attr_id
(
const
char
*
type
)
{
// hashtab traversal
type_datum_t
*
attr
=
hashtab_search
(
policydb
->
p_types
.
table
,
type
);
#define hashtab_for_each(hashtab, block) \
if
(
!
attr
)
hash_for_each(htable, size, hashtab, block)
return
1
;
// avtab traversal
if
(
attr
->
flavor
!=
TYPE_ATTRIB
)
#define avtab_for_each(avtab, block) \
return
1
;
hash_for_each(htable, nslot, avtab, block)
return
attr
->
s
.
value
;
}
static
int
set_attr
(
const
char
*
type
,
int
value
)
{
static
int
set_attr
(
const
char
*
type
,
int
value
)
{
type_datum_t
*
attr
=
hashtab_search
(
policy
db
->
p_types
.
table
,
type
);
type_datum_t
*
attr
=
hashtab_search
(
mp
db
->
p_types
.
table
,
type
);
if
(
!
attr
)
if
(
!
attr
||
attr
->
flavor
!=
TYPE_ATTRIB
)
return
1
;
return
-
1
;
if
(
attr
->
flavor
!=
TYPE_ATTRIB
)
if
(
ebitmap_set_bit
(
&
mpdb
->
type_attr_map
[
value
-
1
],
attr
->
s
.
value
-
1
,
1
))
return
1
;
return
-
1
;
if
(
ebitmap_set_bit
(
&
mpdb
->
attr_type_map
[
attr
->
s
.
value
-
1
],
value
-
1
,
1
))
return
-
1
;
if
(
ebitmap_set_bit
(
&
policydb
->
type_attr_map
[
value
-
1
],
attr
->
s
.
value
-
1
,
1
))
return
attr
->
s
.
value
;
return
1
;
if
(
ebitmap_set_bit
(
&
policydb
->
attr_type_map
[
attr
->
s
.
value
-
1
],
value
-
1
,
1
))
return
1
;
return
0
;
}
}
static
void
check_avtab_node
(
avtab_ptr_t
node
)
{
static
void
check_avtab_node
(
avtab_ptr_t
node
)
{
...
@@ -57,7 +54,7 @@ static void check_avtab_node(avtab_ptr_t node) {
...
@@ -57,7 +54,7 @@ static void check_avtab_node(avtab_ptr_t node) {
else
else
redundant
=
node
->
datum
.
data
==
0U
;
redundant
=
node
->
datum
.
data
==
0U
;
if
(
redundant
)
if
(
redundant
)
avtab_remove_node
(
&
policy
db
->
te_avtab
,
node
);
avtab_remove_node
(
&
mp
db
->
te_avtab
,
node
);
}
}
static
avtab_ptr_t
get_avtab_node
(
avtab_key_t
*
key
,
avtab_extended_perms_t
*
xperms
)
{
static
avtab_ptr_t
get_avtab_node
(
avtab_key_t
*
key
,
avtab_extended_perms_t
*
xperms
)
{
...
@@ -67,7 +64,7 @@ static avtab_ptr_t get_avtab_node(avtab_key_t *key, avtab_extended_perms_t *xper
...
@@ -67,7 +64,7 @@ static avtab_ptr_t get_avtab_node(avtab_key_t *key, avtab_extended_perms_t *xper
/* AVTAB_XPERMS entries are not necessarily unique */
/* AVTAB_XPERMS entries are not necessarily unique */
if
(
key
->
specified
&
AVTAB_XPERMS
)
{
if
(
key
->
specified
&
AVTAB_XPERMS
)
{
node
=
avtab_search_node
(
&
policy
db
->
te_avtab
,
key
);
node
=
avtab_search_node
(
&
mp
db
->
te_avtab
,
key
);
while
(
node
)
{
while
(
node
)
{
if
((
node
->
datum
.
xperms
->
specified
==
xperms
->
specified
)
&&
if
((
node
->
datum
.
xperms
->
specified
==
xperms
->
specified
)
&&
(
node
->
datum
.
xperms
->
driver
==
xperms
->
driver
))
{
(
node
->
datum
.
xperms
->
driver
==
xperms
->
driver
))
{
...
@@ -79,7 +76,7 @@ static avtab_ptr_t get_avtab_node(avtab_key_t *key, avtab_extended_perms_t *xper
...
@@ -79,7 +76,7 @@ static avtab_ptr_t get_avtab_node(avtab_key_t *key, avtab_extended_perms_t *xper
if
(
!
match
)
if
(
!
match
)
node
=
NULL
;
node
=
NULL
;
}
else
{
}
else
{
node
=
avtab_search_node
(
&
policy
db
->
te_avtab
,
key
);
node
=
avtab_search_node
(
&
mp
db
->
te_avtab
,
key
);
}
}
if
(
!
node
)
{
if
(
!
node
)
{
...
@@ -90,26 +87,27 @@ static avtab_ptr_t get_avtab_node(avtab_key_t *key, avtab_extended_perms_t *xper
...
@@ -90,26 +87,27 @@ static avtab_ptr_t get_avtab_node(avtab_key_t *key, avtab_extended_perms_t *xper
*/
*/
avdatum
.
data
=
key
->
specified
==
AVTAB_AUDITDENY
?
~
0U
:
0U
;
avdatum
.
data
=
key
->
specified
==
AVTAB_AUDITDENY
?
~
0U
:
0U
;
/* this is used to get the node - insertion is actually unique */
/* this is used to get the node - insertion is actually unique */
node
=
avtab_insert_nonunique
(
&
policy
db
->
te_avtab
,
key
,
&
avdatum
);
node
=
avtab_insert_nonunique
(
&
mp
db
->
te_avtab
,
key
,
&
avdatum
);
}
}
return
node
;
return
node
;
}
}
static
int
add_avrule
(
avtab_key_t
*
key
,
int
p
,
int
not
)
{
static
int
add_avrule
(
avtab_key_t
*
key
,
int
val
,
int
not
)
{
avtab_ptr_t
node
=
get_avtab_node
(
key
,
NULL
);
avtab_ptr_t
node
=
get_avtab_node
(
key
,
NULL
);
// Support DONTAUDIT (AUDITDENY is inverted)
if
(
AVTAB_AUDITDENY
==
node
->
key
.
specified
==
!
not
)
{
if
(
not
)
{
if
(
p
<
0
)
if
(
val
<
0
)
node
->
datum
.
data
=
0U
;
node
->
datum
.
data
=
0U
;
else
else
node
->
datum
.
data
&=
~
(
1U
<<
(
p
-
1
));
node
->
datum
.
data
&=
~
(
1U
<<
(
val
-
1
));
}
else
{
}
else
{
if
(
p
<
0
)
if
(
val
<
0
)
node
->
datum
.
data
=
~
0U
;
node
->
datum
.
data
=
~
0U
;
else
else
node
->
datum
.
data
|=
1U
<<
(
p
-
1
);
node
->
datum
.
data
|=
1U
<<
(
val
-
1
);
}
}
check_avtab_node
(
node
);
check_avtab_node
(
node
);
return
0
;
return
0
;
}
}
...
@@ -117,22 +115,21 @@ static int add_avrule(avtab_key_t *key, int p, int not) {
...
@@ -117,22 +115,21 @@ static int add_avrule(avtab_key_t *key, int p, int not) {
static
int
add_rule_auto
(
type_datum_t
*
src
,
type_datum_t
*
tgt
,
class_datum_t
*
cls
,
static
int
add_rule_auto
(
type_datum_t
*
src
,
type_datum_t
*
tgt
,
class_datum_t
*
cls
,
perm_datum_t
*
perm
,
int
effect
,
int
not
)
{
perm_datum_t
*
perm
,
int
effect
,
int
not
)
{
avtab_key_t
key
;
avtab_key_t
key
;
hashtab_ptr_t
cur
;
int
ret
=
0
;
int
ret
=
0
;
if
(
src
==
NULL
)
{
if
(
src
==
NULL
)
{
hashtab_for_each
(
policydb
->
p_types
.
table
,
cur
,
{
hashtab_for_each
(
mpdb
->
p_types
.
table
,
{
src
=
cur
->
datum
;
src
=
node
->
datum
;
ret
|=
add_rule_auto
(
src
,
tgt
,
cls
,
perm
,
effect
,
not
);
ret
|=
add_rule_auto
(
src
,
tgt
,
cls
,
perm
,
effect
,
not
);
})
})
}
else
if
(
tgt
==
NULL
)
{
}
else
if
(
tgt
==
NULL
)
{
hashtab_for_each
(
policydb
->
p_types
.
table
,
cur
,
{
hashtab_for_each
(
mpdb
->
p_types
.
table
,
{
tgt
=
cur
->
datum
;
tgt
=
node
->
datum
;
ret
|=
add_rule_auto
(
src
,
tgt
,
cls
,
perm
,
effect
,
not
);
ret
|=
add_rule_auto
(
src
,
tgt
,
cls
,
perm
,
effect
,
not
);
})
})
}
else
if
(
cls
==
NULL
)
{
}
else
if
(
cls
==
NULL
)
{
hashtab_for_each
(
policydb
->
p_classes
.
table
,
cur
,
{
hashtab_for_each
(
mpdb
->
p_classes
.
table
,
{
cls
=
cur
->
datum
;
cls
=
node
->
datum
;
ret
|=
add_rule_auto
(
src
,
tgt
,
cls
,
perm
,
effect
,
not
);
ret
|=
add_rule_auto
(
src
,
tgt
,
cls
,
perm
,
effect
,
not
);
})
})
}
else
{
}
else
{
...
@@ -189,22 +186,21 @@ static int add_avxrule(avtab_key_t *key, uint16_t low, uint16_t high, int not) {
...
@@ -189,22 +186,21 @@ static int add_avxrule(avtab_key_t *key, uint16_t low, uint16_t high, int not) {
static
int
add_xperm_rule_auto
(
type_datum_t
*
src
,
type_datum_t
*
tgt
,
class_datum_t
*
cls
,
static
int
add_xperm_rule_auto
(
type_datum_t
*
src
,
type_datum_t
*
tgt
,
class_datum_t
*
cls
,
uint16_t
low
,
uint16_t
high
,
int
effect
,
int
not
)
{
uint16_t
low
,
uint16_t
high
,
int
effect
,
int
not
)
{
avtab_key_t
key
;
avtab_key_t
key
;
hashtab_ptr_t
cur
;
int
ret
=
0
;
int
ret
=
0
;
if
(
src
==
NULL
)
{
if
(
src
==
NULL
)
{
hashtab_for_each
(
policydb
->
p_types
.
table
,
cur
,
{
hashtab_for_each
(
mpdb
->
p_types
.
table
,
{
src
=
cur
->
datum
;
src
=
node
->
datum
;
ret
|=
add_xperm_rule_auto
(
src
,
tgt
,
cls
,
low
,
high
,
effect
,
not
);
ret
|=
add_xperm_rule_auto
(
src
,
tgt
,
cls
,
low
,
high
,
effect
,
not
);
})
})
}
else
if
(
tgt
==
NULL
)
{
}
else
if
(
tgt
==
NULL
)
{
hashtab_for_each
(
policydb
->
p_types
.
table
,
cur
,
{
hashtab_for_each
(
mpdb
->
p_types
.
table
,
{
tgt
=
cur
->
datum
;
tgt
=
node
->
datum
;
ret
|=
add_xperm_rule_auto
(
src
,
tgt
,
cls
,
low
,
high
,
effect
,
not
);
ret
|=
add_xperm_rule_auto
(
src
,
tgt
,
cls
,
low
,
high
,
effect
,
not
);
})
})
}
else
if
(
cls
==
NULL
)
{
}
else
if
(
cls
==
NULL
)
{
hashtab_for_each
(
policydb
->
p_classes
.
table
,
cur
,
{
hashtab_for_each
(
mpdb
->
p_classes
.
table
,
{
cls
=
cur
->
datum
;
cls
=
node
->
datum
;
ret
|=
add_xperm_rule_auto
(
src
,
tgt
,
cls
,
low
,
high
,
effect
,
not
);
ret
|=
add_xperm_rule_auto
(
src
,
tgt
,
cls
,
low
,
high
,
effect
,
not
);
})
})
}
else
{
}
else
{
...
@@ -218,50 +214,50 @@ static int add_xperm_rule_auto(type_datum_t *src, type_datum_t *tgt, class_datum
...
@@ -218,50 +214,50 @@ static int add_xperm_rule_auto(type_datum_t *src, type_datum_t *tgt, class_datum
}
}
int
create_domain
(
const
char
*
d
)
{
int
create_domain
(
const
char
*
d
)
{
symtab_datum_t
*
src
=
hashtab_search
(
policy
db
->
p_types
.
table
,
d
);
symtab_datum_t
*
src
=
hashtab_search
(
mp
db
->
p_types
.
table
,
d
);
if
(
src
)
{
if
(
src
)
{
LOGW
(
"Domain %s already exists
\n
"
,
d
);
LOGW
(
"Domain %s already exists
\n
"
,
d
);
return
0
;
return
0
;
}
}
type_datum_t
*
typedatum
=
(
type_datum_t
*
)
xmalloc
(
sizeof
(
type_datum_t
));
type_datum_t
*
typedatum
=
xmalloc
(
sizeof
(
type_datum_t
));
type_datum_init
(
typedatum
);
type_datum_init
(
typedatum
);
typedatum
->
primary
=
1
;
typedatum
->
primary
=
1
;
typedatum
->
flavor
=
TYPE_TYPE
;
typedatum
->
flavor
=
TYPE_TYPE
;
uint32_t
value
=
0
;
uint32_t
value
=
0
;
symtab_insert
(
policy
db
,
SYM_TYPES
,
strdup
(
d
),
typedatum
,
SCOPE_DECL
,
1
,
&
value
);
symtab_insert
(
mp
db
,
SYM_TYPES
,
strdup
(
d
),
typedatum
,
SCOPE_DECL
,
1
,
&
value
);
typedatum
->
s
.
value
=
value
;
typedatum
->
s
.
value
=
value
;
if
(
ebitmap_set_bit
(
&
policy
db
->
global
->
branch_list
->
declared
.
scope
[
SYM_TYPES
],
value
-
1
,
1
))
{
if
(
ebitmap_set_bit
(
&
mp
db
->
global
->
branch_list
->
declared
.
scope
[
SYM_TYPES
],
value
-
1
,
1
))
{
return
1
;
return
1
;
}
}
policydb
->
type_attr_map
=
xrealloc
(
policydb
->
type_attr_map
,
sizeof
(
ebitmap_t
)
*
policy
db
->
p_types
.
nprim
);
mpdb
->
type_attr_map
=
xrealloc
(
mpdb
->
type_attr_map
,
sizeof
(
ebitmap_t
)
*
mp
db
->
p_types
.
nprim
);
policydb
->
attr_type_map
=
xrealloc
(
policydb
->
attr_type_map
,
sizeof
(
ebitmap_t
)
*
policy
db
->
p_types
.
nprim
);
mpdb
->
attr_type_map
=
xrealloc
(
mpdb
->
attr_type_map
,
sizeof
(
ebitmap_t
)
*
mp
db
->
p_types
.
nprim
);
ebitmap_init
(
&
policy
db
->
type_attr_map
[
value
-
1
]);
ebitmap_init
(
&
mp
db
->
type_attr_map
[
value
-
1
]);
ebitmap_init
(
&
policy
db
->
attr_type_map
[
value
-
1
]);
ebitmap_init
(
&
mp
db
->
attr_type_map
[
value
-
1
]);
ebitmap_set_bit
(
&
policy
db
->
type_attr_map
[
value
-
1
],
value
-
1
,
1
);
ebitmap_set_bit
(
&
mp
db
->
type_attr_map
[
value
-
1
],
value
-
1
,
1
);
src
=
hashtab_search
(
policy
db
->
p_types
.
table
,
d
);
src
=
hashtab_search
(
mp
db
->
p_types
.
table
,
d
);
if
(
!
src
)
if
(
!
src
)
return
1
;
return
1
;
if
(
policydb_index_decls
(
NULL
,
policy
db
))
if
(
policydb_index_decls
(
NULL
,
mp
db
))
return
1
;
return
1
;
if
(
policydb_index_classes
(
policy
db
))
if
(
policydb_index_classes
(
mp
db
))
return
1
;
return
1
;
if
(
policydb_index_others
(
NULL
,
policy
db
,
0
))
if
(
policydb_index_others
(
NULL
,
mp
db
,
0
))
return
1
;
return
1
;
//Add the domain to all roles
//Add the domain to all roles
for
(
unsigned
i
=
0
;
i
<
policy
db
->
p_roles
.
nprim
;
++
i
)
{
for
(
unsigned
i
=
0
;
i
<
mp
db
->
p_roles
.
nprim
;
++
i
)
{
//Not sure all those three calls are needed
//Not sure all those three calls are needed
ebitmap_set_bit
(
&
policydb
->
role_val_to_struct
[
i
]
->
types
.
negset
,
value
-
1
,
0
);
ebitmap_set_bit
(
&
mpdb
->
role_val_to_struct
[
i
]
->
types
.
negset
,
value
-
1
,
0
);
ebitmap_set_bit
(
&
policydb
->
role_val_to_struct
[
i
]
->
types
.
types
,
value
-
1
,
1
);
ebitmap_set_bit
(
&
mpdb
->
role_val_to_struct
[
i
]
->
types
.
types
,
value
-
1
,
1
);
type_set_expand
(
&
policydb
->
role_val_to_struct
[
i
]
->
types
,
&
policydb
->
role_val_to_struct
[
i
]
->
cache
,
policy
db
,
0
);
type_set_expand
(
&
mpdb
->
role_val_to_struct
[
i
]
->
types
,
&
mpdb
->
role_val_to_struct
[
i
]
->
cache
,
mp
db
,
0
);
}
}
return
set_attr
(
"domain"
,
value
);
return
set_attr
(
"domain"
,
value
);
...
@@ -269,22 +265,21 @@ int create_domain(const char *d) {
...
@@ -269,22 +265,21 @@ int create_domain(const char *d) {
int
set_domain_state
(
const
char
*
s
,
int
state
)
{
int
set_domain_state
(
const
char
*
s
,
int
state
)
{
type_datum_t
*
type
;
type_datum_t
*
type
;
hashtab_ptr_t
cur
;
if
(
s
==
NULL
)
{
if
(
s
==
NULL
)
{
hashtab_for_each
(
policydb
->
p_types
.
table
,
cur
,
{
hashtab_for_each
(
mpdb
->
p_types
.
table
,
{
type
=
cur
->
datum
;
type
=
node
->
datum
;
if
(
ebitmap_set_bit
(
&
policy
db
->
permissive_map
,
type
->
s
.
value
,
state
))
{
if
(
ebitmap_set_bit
(
&
mp
db
->
permissive_map
,
type
->
s
.
value
,
state
))
{
LOGW
(
"Could not set bit in permissive map
\n
"
);
LOGW
(
"Could not set bit in permissive map
\n
"
);
return
1
;
return
1
;
}
}
})
})
}
else
{
}
else
{
type
=
hashtab_search
(
policy
db
->
p_types
.
table
,
s
);
type
=
hashtab_search
(
mp
db
->
p_types
.
table
,
s
);
if
(
type
==
NULL
)
{
if
(
type
==
NULL
)
{
LOGW
(
"type %s does not exist
\n
"
,
s
);
LOGW
(
"type %s does not exist
\n
"
,
s
);
return
1
;
return
1
;
}
}
if
(
ebitmap_set_bit
(
&
policy
db
->
permissive_map
,
type
->
s
.
value
,
state
))
{
if
(
ebitmap_set_bit
(
&
mp
db
->
permissive_map
,
type
->
s
.
value
,
state
))
{
LOGW
(
"Could not set bit in permissive map
\n
"
);
LOGW
(
"Could not set bit in permissive map
\n
"
);
return
1
;
return
1
;
}
}
...
@@ -297,22 +292,22 @@ int add_filename_trans(const char *s, const char *t, const char *c, const char *
...
@@ -297,22 +292,22 @@ int add_filename_trans(const char *s, const char *t, const char *c, const char *
type_datum_t
*
src
,
*
tgt
,
*
def
;
type_datum_t
*
src
,
*
tgt
,
*
def
;
class_datum_t
*
cls
;
class_datum_t
*
cls
;
src
=
hashtab_search
(
policy
db
->
p_types
.
table
,
s
);
src
=
hashtab_search
(
mp
db
->
p_types
.
table
,
s
);
if
(
src
==
NULL
)
{
if
(
src
==
NULL
)
{
LOGW
(
"source type %s does not exist
\n
"
,
s
);
LOGW
(
"source type %s does not exist
\n
"
,
s
);
return
1
;
return
1
;
}
}
tgt
=
hashtab_search
(
policy
db
->
p_types
.
table
,
t
);
tgt
=
hashtab_search
(
mp
db
->
p_types
.
table
,
t
);
if
(
tgt
==
NULL
)
{
if
(
tgt
==
NULL
)
{
LOGW
(
"target type %s does not exist
\n
"
,
t
);
LOGW
(
"target type %s does not exist
\n
"
,
t
);
return
1
;
return
1
;
}
}
cls
=
hashtab_search
(
policy
db
->
p_classes
.
table
,
c
);
cls
=
hashtab_search
(
mp
db
->
p_classes
.
table
,
c
);
if
(
cls
==
NULL
)
{
if
(
cls
==
NULL
)
{
LOGW
(
"class %s does not exist
\n
"
,
c
);
LOGW
(
"class %s does not exist
\n
"
,
c
);
return
1
;
return
1
;
}
}
def
=
hashtab_search
(
policy
db
->
p_types
.
table
,
d
);
def
=
hashtab_search
(
mp
db
->
p_types
.
table
,
d
);
if
(
def
==
NULL
)
{
if
(
def
==
NULL
)
{
LOGW
(
"default type %s does not exist
\n
"
,
d
);
LOGW
(
"default type %s does not exist
\n
"
,
d
);
return
1
;
return
1
;
...
@@ -325,11 +320,11 @@ int add_filename_trans(const char *s, const char *t, const char *c, const char *
...
@@ -325,11 +320,11 @@ int add_filename_trans(const char *s, const char *t, const char *c, const char *
trans_key
.
name
=
(
char
*
)
o
;
trans_key
.
name
=
(
char
*
)
o
;
filename_trans_datum_t
*
trans_datum
;
filename_trans_datum_t
*
trans_datum
;
trans_datum
=
hashtab_search
(
policydb
->
p_types
.
table
,
(
hashtab_key_t
)
&
trans_key
);
trans_datum
=
hashtab_search
(
mpdb
->
filename_trans
,
(
hashtab_key_t
)
&
trans_key
);
if
(
trans_datum
==
NULL
)
{
if
(
trans_datum
==
NULL
)
{
trans_datum
=
xcalloc
(
sizeof
(
*
trans_datum
),
1
);
trans_datum
=
xcalloc
(
sizeof
(
*
trans_datum
),
1
);
hashtab_insert
(
policy
db
->
filename_trans
,
(
hashtab_key_t
)
&
trans_key
,
trans_datum
);
hashtab_insert
(
mp
db
->
filename_trans
,
(
hashtab_key_t
)
&
trans_key
,
trans_datum
);
}
}
// Overwrite existing
// Overwrite existing
...
@@ -337,32 +332,29 @@ int add_filename_trans(const char *s, const char *t, const char *c, const char *
...
@@ -337,32 +332,29 @@ int add_filename_trans(const char *s, const char *t, const char *c, const char *
return
0
;
return
0
;
}
}
int
add_typeattribute
(
const
char
*
domainS
,
const
char
*
attr
)
{
int
add_typeattribute
(
const
char
*
type
,
const
char
*
attr
)
{
type_datum_t
*
domain
;
type_datum_t
*
domain
=
hashtab_search
(
mpdb
->
p_types
.
table
,
type
);
domain
=
hashtab_search
(
policydb
->
p_types
.
table
,
domainS
);
if
(
domain
==
NULL
)
{
if
(
domain
==
NULL
)
{
LOGW
(
"
source type %s does not exist
\n
"
,
domainS
);
LOGW
(
"
type %s does not exist
\n
"
,
type
);
return
1
;
return
1
;
}
}
set_attr
(
attr
,
domain
->
s
.
value
);
int
attr_id
=
set_attr
(
attr
,
domain
->
s
.
value
);
if
(
attr_id
<
0
)
int
typeId
=
get_attr_id
(
attr
);
return
1
;
//Now let's update all constraints!
//(kernel doesn't support (yet?) type_names rules)
hashtab_for_each
(
mpdb
->
p_classes
.
table
,
{
for
(
int
i
=
0
;
i
<
policydb
->
p_classes
.
nprim
;
++
i
)
{
class_datum_t
*
cls
=
node
->
datum
;
class_datum_t
*
cl
=
policydb
->
class_val_to_struct
[
i
];
for
(
constraint_node_t
*
n
=
cls
->
constraints
;
n
;
n
=
n
->
next
)
{
for
(
constraint_node_t
*
n
=
cl
->
constraints
;
n
;
n
=
n
->
next
)
{
for
(
constraint_expr_t
*
e
=
n
->
expr
;
e
;
e
=
e
->
next
)
{
for
(
constraint_expr_t
*
e
=
n
->
expr
;
e
;
e
=
e
->
next
)
{
if
(
e
->
expr_type
==
CEXPR_NAMES
&&
if
(
e
->
expr_type
==
CEXPR_NAMES
)
{
ebitmap_get_bit
(
&
e
->
type_names
->
types
,
attr_id
-
1
))
{
if
(
ebitmap_get_bit
(
&
e
->
type_names
->
types
,
typeId
-
1
))
{
ebitmap_set_bit
(
&
e
->
names
,
domain
->
s
.
value
-
1
,
1
);
ebitmap_set_bit
(
&
e
->
names
,
domain
->
s
.
value
-
1
,
1
);
}
}
}
}
}
}
}
}
})
return
0
;
return
0
;
}
}
...
@@ -372,7 +364,7 @@ int add_rule(const char *s, const char *t, const char *c, const char *p, int eff
...
@@ -372,7 +364,7 @@ int add_rule(const char *s, const char *t, const char *c, const char *p, int eff
perm_datum_t
*
perm
=
NULL
;
perm_datum_t
*
perm
=
NULL
;
if
(
s
)
{
if
(
s
)
{
src
=
hashtab_search
(
policy
db
->
p_types
.
table
,
s
);
src
=
hashtab_search
(
mp
db
->
p_types
.
table
,
s
);
if
(
src
==
NULL
)
{
if
(
src
==
NULL
)
{
LOGW
(
"source type %s does not exist
\n
"
,
s
);
LOGW
(
"source type %s does not exist
\n
"
,
s
);
return
1
;
return
1
;
...
@@ -380,7 +372,7 @@ int add_rule(const char *s, const char *t, const char *c, const char *p, int eff
...
@@ -380,7 +372,7 @@ int add_rule(const char *s, const char *t, const char *c, const char *p, int eff
}
}
if
(
t
)
{
if
(
t
)
{
tgt
=
hashtab_search
(
policy
db
->
p_types
.
table
,
t
);
tgt
=
hashtab_search
(
mp
db
->
p_types
.
table
,
t
);
if
(
tgt
==
NULL
)
{
if
(
tgt
==
NULL
)
{
LOGW
(
"target type %s does not exist
\n
"
,
t
);
LOGW
(
"target type %s does not exist
\n
"
,
t
);
return
1
;
return
1
;
...
@@ -388,7 +380,7 @@ int add_rule(const char *s, const char *t, const char *c, const char *p, int eff
...
@@ -388,7 +380,7 @@ int add_rule(const char *s, const char *t, const char *c, const char *p, int eff
}
}
if
(
c
)
{
if
(
c
)
{
cls
=
hashtab_search
(
policy
db
->
p_classes
.
table
,
c
);
cls
=
hashtab_search
(
mp
db
->
p_classes
.
table
,
c
);
if
(
cls
==
NULL
)
{
if
(
cls
==
NULL
)
{
LOGW
(
"class %s does not exist
\n
"
,
c
);
LOGW
(
"class %s does not exist
\n
"
,
c
);
return
1
;
return
1
;
...
@@ -419,7 +411,7 @@ int add_xperm_rule(const char *s, const char *t, const char *c, const char *rang
...
@@ -419,7 +411,7 @@ int add_xperm_rule(const char *s, const char *t, const char *c, const char *rang
class_datum_t
*
cls
=
NULL
;
class_datum_t
*
cls
=
NULL
;
if
(
s
)
{
if
(
s
)
{
src
=
hashtab_search
(
policy
db
->
p_types
.
table
,
s
);
src
=
hashtab_search
(
mp
db
->
p_types
.
table
,
s
);
if
(
src
==
NULL
)
{
if
(
src
==
NULL
)
{
LOGW
(
"source type %s does not exist
\n
"
,
s
);
LOGW
(
"source type %s does not exist
\n
"
,
s
);
return
1
;
return
1
;
...
@@ -427,7 +419,7 @@ int add_xperm_rule(const char *s, const char *t, const char *c, const char *rang
...
@@ -427,7 +419,7 @@ int add_xperm_rule(const char *s, const char *t, const char *c, const char *rang
}
}
if
(
t
)
{
if
(
t
)
{
tgt
=
hashtab_search
(
policy
db
->
p_types
.
table
,
t
);
tgt
=
hashtab_search
(
mp
db
->
p_types
.
table
,
t
);
if
(
tgt
==
NULL
)
{
if
(
tgt
==
NULL
)
{
LOGW
(
"target type %s does not exist
\n
"
,
t
);
LOGW
(
"target type %s does not exist
\n
"
,
t
);
return
1
;
return
1
;
...
@@ -435,7 +427,7 @@ int add_xperm_rule(const char *s, const char *t, const char *c, const char *rang
...
@@ -435,7 +427,7 @@ int add_xperm_rule(const char *s, const char *t, const char *c, const char *rang
}
}
if
(
c
)
{
if
(
c
)
{
cls
=
hashtab_search
(
policy
db
->
p_classes
.
table
,
c
);
cls
=
hashtab_search
(
mp
db
->
p_classes
.
table
,
c
);
if
(
cls
==
NULL
)
{
if
(
cls
==
NULL
)
{
LOGW
(
"class %s does not exist
\n
"
,
c
);
LOGW
(
"class %s does not exist
\n
"
,
c
);
return
1
;
return
1
;
...
@@ -463,22 +455,22 @@ int add_type_rule(const char *s, const char *t, const char *c, const char *d, in
...
@@ -463,22 +455,22 @@ int add_type_rule(const char *s, const char *t, const char *c, const char *d, in
type_datum_t
*
src
,
*
tgt
,
*
def
;
type_datum_t
*
src
,
*
tgt
,
*
def
;
class_datum_t
*
cls
;
class_datum_t
*
cls
;
src
=
hashtab_search
(
policy
db
->
p_types
.
table
,
s
);
src
=
hashtab_search
(
mp
db
->
p_types
.
table
,
s
);
if
(
src
==
NULL
)
{
if
(
src
==
NULL
)
{
LOGW
(
"source type %s does not exist
\n
"
,
s
);
LOGW
(
"source type %s does not exist
\n
"
,
s
);
return
1
;
return
1
;
}
}
tgt
=
hashtab_search
(
policy
db
->
p_types
.
table
,
t
);
tgt
=
hashtab_search
(
mp
db
->
p_types
.
table
,
t
);
if
(
tgt
==
NULL
)
{
if
(
tgt
==
NULL
)
{
LOGW
(
"target type %s does not exist
\n
"
,
t
);
LOGW
(
"target type %s does not exist
\n
"
,
t
);
return
1
;
return
1
;
}
}
cls
=
hashtab_search
(
policy
db
->
p_classes
.
table
,
c
);
cls
=
hashtab_search
(
mp
db
->
p_classes
.
table
,
c
);
if
(
cls
==
NULL
)
{
if
(
cls
==
NULL
)
{
LOGW
(
"class %s does not exist
\n
"
,
c
);
LOGW
(
"class %s does not exist
\n
"
,
c
);
return
1
;
return
1
;
}
}
def
=
hashtab_search
(
policy
db
->
p_types
.
table
,
d
);
def
=
hashtab_search
(
mp
db
->
p_types
.
table
,
d
);
if
(
def
==
NULL
)
{
if
(
def
==
NULL
)
{
LOGW
(
"default type %s does not exist
\n
"
,
d
);
LOGW
(
"default type %s does not exist
\n
"
,
d
);
return
1
;
return
1
;
...
@@ -495,3 +487,10 @@ int add_type_rule(const char *s, const char *t, const char *c, const char *d, in
...
@@ -495,3 +487,10 @@ int add_type_rule(const char *s, const char *t, const char *c, const char *d, in
return
0
;
return
0
;
}
}
void
strip_dontaudit
()
{
avtab_for_each
(
&
mpdb
->
te_avtab
,
{
if
(
node
->
key
.
specified
==
AVTAB_AUDITDENY
||
node
->
key
.
specified
==
AVTAB_XPERMS_DONTAUDIT
)
avtab_remove_node
(
&
magisk_policydb
->
te_avtab
,
node
);
})
}
native/jni/magiskpolicy/sepolicy.h
View file @
d6fb9868
...
@@ -5,32 +5,15 @@
...
@@ -5,32 +5,15 @@
__BEGIN_DECLS
__BEGIN_DECLS
// Global policydb
// Global policydb
extern
policydb_t
*
policydb
;
extern
policydb_t
*
magisk_policydb
;
// General hash table traversal
#define hash_for_each(table, slots, tab, cur, block) \
for (int __i = 0; __i < (tab)->slots; ++__i) { \
__typeof__(cur) __next; \
for (cur = (tab)->table[__i]; cur; cur = __next) { \
__next = cur->next; \
block \
} \
} \
// hashtab traversal
#define hashtab_for_each(hashtab, cur, block) \
hash_for_each(htable, size, hashtab, cur, block)
// avtab traversal
#define avtab_for_each(avtab, cur, block) \
hash_for_each(htable, nslot, avtab, cur, block)
int
create_domain
(
const
char
*
d
);
int
create_domain
(
const
char
*
d
);
int
set_domain_state
(
const
char
*
s
,
int
state
);
int
set_domain_state
(
const
char
*
s
,
int
state
);
int
add_typeattribute
(
const
char
*
domainS
,
const
char
*
attr
);
int
add_typeattribute
(
const
char
*
type
,
const
char
*
attr
);
int
add_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
,
int
effect
,
int
n
);
int
add_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
,
int
effect
,
int
n
);
int
add_xperm_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
,
int
effect
,
int
n
);
int
add_xperm_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
,
int
effect
,
int
n
);
int
add_type_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
int
effect
);
int
add_type_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
int
effect
);
int
add_filename_trans
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
);
int
add_filename_trans
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
);
void
strip_dontaudit
();
__END_DECLS
__END_DECLS
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment