Commit d6fb9868 authored by topjohnwu's avatar topjohnwu

Small sepolicy refactor and fixes

parent 9aff1a57
#include "magiskpolicy.h"
#include "sepolicy.h"
//#define vprint(fmt, ...) printf(fmt, __VA_ARGS__)
#define vprint(...)
int sepol_allow(const char *s, const char *t, const char *c, const char *p) {
// printf("allow %s %s %s %s\n", s, t, c, p);
vprint("allow %s %s %s %s\n", s, t, c, p);
return add_rule(s, t, c, p, AVTAB_ALLOWED, 0);
}
int sepol_deny(const char *s, const char *t, const char *c, const char *p) {
// printf("deny %s %s %s %s\n", s, t, c, p);
vprint("deny %s %s %s %s\n", s, t, c, p);
return add_rule(s, t, c, p, AVTAB_ALLOWED, 1);
}
int sepol_auditallow(const char *s, const char *t, const char *c, const char *p) {
// printf("auditallow %s %s %s %s\n", s, t, c, p);
vprint("auditallow %s %s %s %s\n", s, t, c, p);
return add_rule(s, t, c, p, AVTAB_AUDITALLOW, 0);
}
int sepol_dontaudit(const char *s, const char *t, const char *c, const char *p) {
// printf("dontaudit %s %s %s %s\n", s, t, c, p);
return add_rule(s, t, c, p, AVTAB_AUDITDENY, 0);
vprint("dontaudit %s %s %s %s\n", s, t, c, p);
return add_rule(s, t, c, p, AVTAB_AUDITDENY, 1);
}
int sepol_allowxperm(const char *s, const char *t, const char *c, const char *range) {
// printf("allowxperm %s %s %s %s\n", s, t, c, range);
vprint("allowxperm %s %s %s %s\n", s, t, c, range);
return add_xperm_rule(s, t, c, range, AVTAB_XPERMS_ALLOWED, 0);
}
int sepol_auditallowxperm(const char *s, const char *t, const char *c, const char *range) {
// printf("auditallowxperm %s %s %s %s\n", s, t, c, range);
vprint("auditallowxperm %s %s %s %s\n", s, t, c, range);
return add_xperm_rule(s, t, c, range, AVTAB_XPERMS_AUDITALLOW, 0);
}
int sepol_dontauditxperm(const char *s, const char *t, const char *c, const char *range) {
// printf("dontauditxperm %s %s %s %s\n", s, t, c, range);
vprint("dontauditxperm %s %s %s %s\n", s, t, c, range);
return add_xperm_rule(s, t, c, range, AVTAB_XPERMS_DONTAUDIT, 0);
}
int sepol_typetrans(const char *s, const char *t, const char *c, const char *d) {
// printf("type_transition %s %s %s %s\n", s, t, c, d);
vprint("type_transition %s %s %s %s\n", s, t, c, d);
return add_type_rule(s, t, c, d, AVTAB_TRANSITION);
}
int sepol_typechange(const char *s, const char *t, const char *c, const char *d) {
// printf("type_change %s %s %s %s\n", s, t, c, d);
vprint("type_change %s %s %s %s\n", s, t, c, d);
return add_type_rule(s, t, c, d, AVTAB_CHANGE);
}
int sepol_typemember(const char *s, const char *t, const char *c, const char *d) {
// printf("type_member %s %s %s %s\n", s, t, c, d);
vprint("type_member %s %s %s %s\n", s, t, c, d);
return add_type_rule(s, t, c, d, AVTAB_MEMBER);
}
int sepol_nametrans(const char *s, const char *t, const char *c, const char *d, const char *o) {
// printf("name_trans %s %s %s %s %s\n", s, t, c, d, o);
vprint("name_trans %s %s %s %s %s\n", s, t, c, d, o);
return add_filename_trans(s, t, c, d, o);
}
int sepol_permissive(const char *s) {
// printf("permissive %s\n", s);
vprint("permissive %s\n", s);
return set_domain_state(s, 1);
}
int sepol_enforce(const char *s) {
// printf("enforce %s\n", s);
vprint("enforce %s\n", s);
return set_domain_state(s, 0);
}
int sepol_create(const char *s) {
// printf("create %s\n", s);
vprint("create %s\n", s);
return create_domain(s);
}
int sepol_attradd(const char *s, const char *a) {
// printf("attradd %s %s\n", s, a);
vprint("attradd %s %s\n", s, a);
return add_typeattribute(s, a);
}
int sepol_exists(const char *source) {
return hashtab_search(policydb->p_types.table, source) != nullptr;
return hashtab_search(magisk_policydb->p_types.table, source) != nullptr;
}
......@@ -487,7 +487,7 @@ int magiskpolicy_main(int argc, char *argv[]) {
}
// Use current policy if nothing is loaded
if (policydb == nullptr && load_policydb(SELINUX_POLICY)) {
if (magisk_policydb == nullptr && load_policydb(SELINUX_POLICY)) {
fprintf(stderr, "Cannot load policy from " SELINUX_POLICY "\n");
return 1;
}
......
......@@ -11,10 +11,8 @@
#include "magiskpolicy.h"
#include "sepolicy.h"
policydb_t *policydb = nullptr;
int load_policydb(const char *file) {
if (policydb)
if (magisk_policydb)
destroy_policydb();
struct policy_file pf;
......@@ -22,8 +20,8 @@ int load_policydb(const char *file) {
pf.fp = xfopen(file, "re");
pf.type = PF_USE_STDIO;
policydb = new policydb_t();
if (policydb_init(policydb) || policydb_read(policydb, &pf, 0))
magisk_policydb = static_cast<policydb_t *>(xmalloc(sizeof(policydb_t)));
if (policydb_init(magisk_policydb) || policydb_read(magisk_policydb, &pf, 0))
return 1;
fclose(pf.fp);
......@@ -169,7 +167,7 @@ int compile_split_cil() {
return 1;
cil_db_destroy(&db);
policydb = &pdb->p;
magisk_policydb = &pdb->p;
return 0;
}
......@@ -177,7 +175,7 @@ int dump_policydb(const char *file) {
int fd, ret;
void *data = nullptr;
size_t len;
policydb_to_image(nullptr, policydb, &data, &len);
policydb_to_image(nullptr, magisk_policydb, &data, &len);
if (data == nullptr) {
LOGE("Fail to dump policy image!\n");
return 1;
......@@ -194,9 +192,9 @@ int dump_policydb(const char *file) {
}
void destroy_policydb() {
if (policydb) {
policydb_destroy(policydb);
delete policydb;
policydb = nullptr;
if (magisk_policydb) {
policydb_destroy(magisk_policydb);
free(magisk_policydb);
magisk_policydb = nullptr;
}
}
\ No newline at end of file
}
......@@ -21,7 +21,7 @@ static void allowSuClient(const char *target) {
sepol_allow(target, "untrusted_app_devpts", "chr_file", "ioctl");
sepol_allow(target, "untrusted_app_25_devpts", "chr_file", "ioctl");
sepol_allow(target, "untrusted_app_all_devpts", "chr_file", "ioctl");
if (policydb->policyvers >= POLICYDB_VERSION_XPERMS_IOCTL) {
if (magisk_policydb->policyvers >= POLICYDB_VERSION_XPERMS_IOCTL) {
sepol_allowxperm(target, "devpts", "chr_file", "0x5400-0x54FF");
sepol_allowxperm(target, "untrusted_app_devpts", "chr_file", "0x5400-0x54FF");
sepol_allowxperm(target, "untrusted_app_25_devpts", "chr_file", "0x5400-0x54FF");
......@@ -166,7 +166,7 @@ void sepol_magisk_rules() {
sepol_allow(SEPOL_PROC_DOMAIN, ALL, "fifo_file", ALL);
// Allow us to do any ioctl on all block devices
if (policydb->policyvers >= POLICYDB_VERSION_XPERMS_IOCTL)
if (magisk_policydb->policyvers >= POLICYDB_VERSION_XPERMS_IOCTL)
sepol_allowxperm(SEPOL_PROC_DOMAIN, ALL, "blk_file", "0x0000-0xFFFF");
// Allow all binder transactions
......@@ -198,11 +198,7 @@ void sepol_magisk_rules() {
#ifdef MAGISK_DEBUG
// Remove all dontaudit in debug mode
avtab_ptr_t av;
avtab_for_each(&policydb->te_avtab, av, {
if (av->key.specified == AVTAB_AUDITDENY || av->key.specified == AVTAB_XPERMS_DONTAUDIT)
avtab_remove_node(&policydb->te_avtab, av);
})
strip_dontaudit();
#endif
log_cb.w = bak;
......
This diff is collapsed.
......@@ -5,32 +5,15 @@
__BEGIN_DECLS
// Global policydb
extern policydb_t *policydb;
// General hash table traversal
#define hash_for_each(table, slots, tab, cur, block) \
for (int __i = 0; __i < (tab)->slots; ++__i) { \
__typeof__(cur) __next; \
for (cur = (tab)->table[__i]; cur; cur = __next) { \
__next = cur->next; \
block \
} \
} \
// hashtab traversal
#define hashtab_for_each(hashtab, cur, block) \
hash_for_each(htable, size, hashtab, cur, block)
// avtab traversal
#define avtab_for_each(avtab, cur, block) \
hash_for_each(htable, nslot, avtab, cur, block)
extern policydb_t *magisk_policydb;
int create_domain(const char *d);
int set_domain_state(const char *s, int state);
int add_typeattribute(const char *domainS, const char *attr);
int add_typeattribute(const char *type, const char *attr);
int add_rule(const char *s, const char *t, const char *c, const char *p, int effect, int n);
int add_xperm_rule(const char *s, const char *t, const char *c, const char *range, int effect, int n);
int add_type_rule(const char *s, const char *t, const char *c, const char *d, int effect);
int add_filename_trans(const char *s, const char *t, const char *c, const char *d, const char *o);
void strip_dontaudit();
__END_DECLS
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment