Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
M
Magisk
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
Magisk
Commits
d6fb9868
Commit
d6fb9868
authored
Nov 19, 2019
by
topjohnwu
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Small sepolicy refactor and fixes
parent
9aff1a57
Expand all
Hide whitespace changes
Inline
Side-by-side
Showing
6 changed files
with
152 additions
and
173 deletions
+152
-173
api.cpp
native/jni/magiskpolicy/api.cpp
+20
-17
magiskpolicy.cpp
native/jni/magiskpolicy/magiskpolicy.cpp
+1
-1
policydb.cpp
native/jni/magiskpolicy/policydb.cpp
+10
-12
rules.cpp
native/jni/magiskpolicy/rules.cpp
+3
-7
sepolicy.c
native/jni/magiskpolicy/sepolicy.c
+115
-116
sepolicy.h
native/jni/magiskpolicy/sepolicy.h
+3
-20
No files found.
native/jni/magiskpolicy/api.cpp
View file @
d6fb9868
#include "magiskpolicy.h"
#include "sepolicy.h"
//#define vprint(fmt, ...) printf(fmt, __VA_ARGS__)
#define vprint(...)
int
sepol_allow
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
// printf
("allow %s %s %s %s\n", s, t, c, p);
vprint
(
"allow %s %s %s %s
\n
"
,
s
,
t
,
c
,
p
);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
0
);
}
int
sepol_deny
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
// printf
("deny %s %s %s %s\n", s, t, c, p);
vprint
(
"deny %s %s %s %s
\n
"
,
s
,
t
,
c
,
p
);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
1
);
}
int
sepol_auditallow
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
// printf
("auditallow %s %s %s %s\n", s, t, c, p);
vprint
(
"auditallow %s %s %s %s
\n
"
,
s
,
t
,
c
,
p
);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITALLOW
,
0
);
}
int
sepol_dontaudit
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
// printf
("dontaudit %s %s %s %s\n", s, t, c, p);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITDENY
,
0
);
vprint
(
"dontaudit %s %s %s %s
\n
"
,
s
,
t
,
c
,
p
);
return
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITDENY
,
1
);
}
int
sepol_allowxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
// printf
("allowxperm %s %s %s %s\n", s, t, c, range);
vprint
(
"allowxperm %s %s %s %s
\n
"
,
s
,
t
,
c
,
range
);
return
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_ALLOWED
,
0
);
}
int
sepol_auditallowxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
// printf
("auditallowxperm %s %s %s %s\n", s, t, c, range);
vprint
(
"auditallowxperm %s %s %s %s
\n
"
,
s
,
t
,
c
,
range
);
return
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_AUDITALLOW
,
0
);
}
int
sepol_dontauditxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
// printf
("dontauditxperm %s %s %s %s\n", s, t, c, range);
vprint
(
"dontauditxperm %s %s %s %s
\n
"
,
s
,
t
,
c
,
range
);
return
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_DONTAUDIT
,
0
);
}
int
sepol_typetrans
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
// printf
("type_transition %s %s %s %s\n", s, t, c, d);
vprint
(
"type_transition %s %s %s %s
\n
"
,
s
,
t
,
c
,
d
);
return
add_type_rule
(
s
,
t
,
c
,
d
,
AVTAB_TRANSITION
);
}
int
sepol_typechange
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
// printf
("type_change %s %s %s %s\n", s, t, c, d);
vprint
(
"type_change %s %s %s %s
\n
"
,
s
,
t
,
c
,
d
);
return
add_type_rule
(
s
,
t
,
c
,
d
,
AVTAB_CHANGE
);
}
int
sepol_typemember
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
// printf
("type_member %s %s %s %s\n", s, t, c, d);
vprint
(
"type_member %s %s %s %s
\n
"
,
s
,
t
,
c
,
d
);
return
add_type_rule
(
s
,
t
,
c
,
d
,
AVTAB_MEMBER
);
}
int
sepol_nametrans
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
)
{
// printf
("name_trans %s %s %s %s %s\n", s, t, c, d, o);
vprint
(
"name_trans %s %s %s %s %s
\n
"
,
s
,
t
,
c
,
d
,
o
);
return
add_filename_trans
(
s
,
t
,
c
,
d
,
o
);
}
int
sepol_permissive
(
const
char
*
s
)
{
// printf
("permissive %s\n", s);
vprint
(
"permissive %s
\n
"
,
s
);
return
set_domain_state
(
s
,
1
);
}
int
sepol_enforce
(
const
char
*
s
)
{
// printf
("enforce %s\n", s);
vprint
(
"enforce %s
\n
"
,
s
);
return
set_domain_state
(
s
,
0
);
}
int
sepol_create
(
const
char
*
s
)
{
// printf
("create %s\n", s);
vprint
(
"create %s
\n
"
,
s
);
return
create_domain
(
s
);
}
int
sepol_attradd
(
const
char
*
s
,
const
char
*
a
)
{
// printf
("attradd %s %s\n", s, a);
vprint
(
"attradd %s %s
\n
"
,
s
,
a
);
return
add_typeattribute
(
s
,
a
);
}
int
sepol_exists
(
const
char
*
source
)
{
return
hashtab_search
(
policydb
->
p_types
.
table
,
source
)
!=
nullptr
;
return
hashtab_search
(
magisk_
policydb
->
p_types
.
table
,
source
)
!=
nullptr
;
}
native/jni/magiskpolicy/magiskpolicy.cpp
View file @
d6fb9868
...
...
@@ -487,7 +487,7 @@ int magiskpolicy_main(int argc, char *argv[]) {
}
// Use current policy if nothing is loaded
if
(
policydb
==
nullptr
&&
load_policydb
(
SELINUX_POLICY
))
{
if
(
magisk_
policydb
==
nullptr
&&
load_policydb
(
SELINUX_POLICY
))
{
fprintf
(
stderr
,
"Cannot load policy from "
SELINUX_POLICY
"
\n
"
);
return
1
;
}
...
...
native/jni/magiskpolicy/policydb.cpp
View file @
d6fb9868
...
...
@@ -11,10 +11,8 @@
#include "magiskpolicy.h"
#include "sepolicy.h"
policydb_t
*
policydb
=
nullptr
;
int
load_policydb
(
const
char
*
file
)
{
if
(
policydb
)
if
(
magisk_
policydb
)
destroy_policydb
();
struct
policy_file
pf
;
...
...
@@ -22,8 +20,8 @@ int load_policydb(const char *file) {
pf
.
fp
=
xfopen
(
file
,
"re"
);
pf
.
type
=
PF_USE_STDIO
;
policydb
=
new
policydb_t
(
);
if
(
policydb_init
(
policydb
)
||
policydb_read
(
policydb
,
&
pf
,
0
))
magisk_policydb
=
static_cast
<
policydb_t
*>
(
xmalloc
(
sizeof
(
policydb_t
))
);
if
(
policydb_init
(
magisk_policydb
)
||
policydb_read
(
magisk_
policydb
,
&
pf
,
0
))
return
1
;
fclose
(
pf
.
fp
);
...
...
@@ -169,7 +167,7 @@ int compile_split_cil() {
return
1
;
cil_db_destroy
(
&
db
);
policydb
=
&
pdb
->
p
;
magisk_
policydb
=
&
pdb
->
p
;
return
0
;
}
...
...
@@ -177,7 +175,7 @@ int dump_policydb(const char *file) {
int
fd
,
ret
;
void
*
data
=
nullptr
;
size_t
len
;
policydb_to_image
(
nullptr
,
policydb
,
&
data
,
&
len
);
policydb_to_image
(
nullptr
,
magisk_
policydb
,
&
data
,
&
len
);
if
(
data
==
nullptr
)
{
LOGE
(
"Fail to dump policy image!
\n
"
);
return
1
;
...
...
@@ -194,9 +192,9 @@ int dump_policydb(const char *file) {
}
void
destroy_policydb
()
{
if
(
policydb
)
{
policydb_destroy
(
policydb
);
delete
policydb
;
policydb
=
nullptr
;
if
(
magisk_
policydb
)
{
policydb_destroy
(
magisk_
policydb
);
free
(
magisk_policydb
)
;
magisk_
policydb
=
nullptr
;
}
}
\ No newline at end of file
}
native/jni/magiskpolicy/rules.cpp
View file @
d6fb9868
...
...
@@ -21,7 +21,7 @@ static void allowSuClient(const char *target) {
sepol_allow
(
target
,
"untrusted_app_devpts"
,
"chr_file"
,
"ioctl"
);
sepol_allow
(
target
,
"untrusted_app_25_devpts"
,
"chr_file"
,
"ioctl"
);
sepol_allow
(
target
,
"untrusted_app_all_devpts"
,
"chr_file"
,
"ioctl"
);
if
(
policydb
->
policyvers
>=
POLICYDB_VERSION_XPERMS_IOCTL
)
{
if
(
magisk_
policydb
->
policyvers
>=
POLICYDB_VERSION_XPERMS_IOCTL
)
{
sepol_allowxperm
(
target
,
"devpts"
,
"chr_file"
,
"0x5400-0x54FF"
);
sepol_allowxperm
(
target
,
"untrusted_app_devpts"
,
"chr_file"
,
"0x5400-0x54FF"
);
sepol_allowxperm
(
target
,
"untrusted_app_25_devpts"
,
"chr_file"
,
"0x5400-0x54FF"
);
...
...
@@ -166,7 +166,7 @@ void sepol_magisk_rules() {
sepol_allow
(
SEPOL_PROC_DOMAIN
,
ALL
,
"fifo_file"
,
ALL
);
// Allow us to do any ioctl on all block devices
if
(
policydb
->
policyvers
>=
POLICYDB_VERSION_XPERMS_IOCTL
)
if
(
magisk_
policydb
->
policyvers
>=
POLICYDB_VERSION_XPERMS_IOCTL
)
sepol_allowxperm
(
SEPOL_PROC_DOMAIN
,
ALL
,
"blk_file"
,
"0x0000-0xFFFF"
);
// Allow all binder transactions
...
...
@@ -198,11 +198,7 @@ void sepol_magisk_rules() {
#ifdef MAGISK_DEBUG
// Remove all dontaudit in debug mode
avtab_ptr_t
av
;
avtab_for_each
(
&
policydb
->
te_avtab
,
av
,
{
if
(
av
->
key
.
specified
==
AVTAB_AUDITDENY
||
av
->
key
.
specified
==
AVTAB_XPERMS_DONTAUDIT
)
avtab_remove_node
(
&
policydb
->
te_avtab
,
av
);
})
strip_dontaudit
();
#endif
log_cb
.
w
=
bak
;
...
...
native/jni/magiskpolicy/sepolicy.c
View file @
d6fb9868
This diff is collapsed.
Click to expand it.
native/jni/magiskpolicy/sepolicy.h
View file @
d6fb9868
...
...
@@ -5,32 +5,15 @@
__BEGIN_DECLS
// Global policydb
extern
policydb_t
*
policydb
;
// General hash table traversal
#define hash_for_each(table, slots, tab, cur, block) \
for (int __i = 0; __i < (tab)->slots; ++__i) { \
__typeof__(cur) __next; \
for (cur = (tab)->table[__i]; cur; cur = __next) { \
__next = cur->next; \
block \
} \
} \
// hashtab traversal
#define hashtab_for_each(hashtab, cur, block) \
hash_for_each(htable, size, hashtab, cur, block)
// avtab traversal
#define avtab_for_each(avtab, cur, block) \
hash_for_each(htable, nslot, avtab, cur, block)
extern
policydb_t
*
magisk_policydb
;
int
create_domain
(
const
char
*
d
);
int
set_domain_state
(
const
char
*
s
,
int
state
);
int
add_typeattribute
(
const
char
*
domainS
,
const
char
*
attr
);
int
add_typeattribute
(
const
char
*
type
,
const
char
*
attr
);
int
add_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
,
int
effect
,
int
n
);
int
add_xperm_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
,
int
effect
,
int
n
);
int
add_type_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
int
effect
);
int
add_filename_trans
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
);
void
strip_dontaudit
();
__END_DECLS
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment