Commit d6fb9868 authored by topjohnwu's avatar topjohnwu

Small sepolicy refactor and fixes

parent 9aff1a57
#include "magiskpolicy.h" #include "magiskpolicy.h"
#include "sepolicy.h" #include "sepolicy.h"
//#define vprint(fmt, ...) printf(fmt, __VA_ARGS__)
#define vprint(...)
int sepol_allow(const char *s, const char *t, const char *c, const char *p) { int sepol_allow(const char *s, const char *t, const char *c, const char *p) {
// printf("allow %s %s %s %s\n", s, t, c, p); vprint("allow %s %s %s %s\n", s, t, c, p);
return add_rule(s, t, c, p, AVTAB_ALLOWED, 0); return add_rule(s, t, c, p, AVTAB_ALLOWED, 0);
} }
int sepol_deny(const char *s, const char *t, const char *c, const char *p) { int sepol_deny(const char *s, const char *t, const char *c, const char *p) {
// printf("deny %s %s %s %s\n", s, t, c, p); vprint("deny %s %s %s %s\n", s, t, c, p);
return add_rule(s, t, c, p, AVTAB_ALLOWED, 1); return add_rule(s, t, c, p, AVTAB_ALLOWED, 1);
} }
int sepol_auditallow(const char *s, const char *t, const char *c, const char *p) { int sepol_auditallow(const char *s, const char *t, const char *c, const char *p) {
// printf("auditallow %s %s %s %s\n", s, t, c, p); vprint("auditallow %s %s %s %s\n", s, t, c, p);
return add_rule(s, t, c, p, AVTAB_AUDITALLOW, 0); return add_rule(s, t, c, p, AVTAB_AUDITALLOW, 0);
} }
int sepol_dontaudit(const char *s, const char *t, const char *c, const char *p) { int sepol_dontaudit(const char *s, const char *t, const char *c, const char *p) {
// printf("dontaudit %s %s %s %s\n", s, t, c, p); vprint("dontaudit %s %s %s %s\n", s, t, c, p);
return add_rule(s, t, c, p, AVTAB_AUDITDENY, 0); return add_rule(s, t, c, p, AVTAB_AUDITDENY, 1);
} }
int sepol_allowxperm(const char *s, const char *t, const char *c, const char *range) { int sepol_allowxperm(const char *s, const char *t, const char *c, const char *range) {
// printf("allowxperm %s %s %s %s\n", s, t, c, range); vprint("allowxperm %s %s %s %s\n", s, t, c, range);
return add_xperm_rule(s, t, c, range, AVTAB_XPERMS_ALLOWED, 0); return add_xperm_rule(s, t, c, range, AVTAB_XPERMS_ALLOWED, 0);
} }
int sepol_auditallowxperm(const char *s, const char *t, const char *c, const char *range) { int sepol_auditallowxperm(const char *s, const char *t, const char *c, const char *range) {
// printf("auditallowxperm %s %s %s %s\n", s, t, c, range); vprint("auditallowxperm %s %s %s %s\n", s, t, c, range);
return add_xperm_rule(s, t, c, range, AVTAB_XPERMS_AUDITALLOW, 0); return add_xperm_rule(s, t, c, range, AVTAB_XPERMS_AUDITALLOW, 0);
} }
int sepol_dontauditxperm(const char *s, const char *t, const char *c, const char *range) { int sepol_dontauditxperm(const char *s, const char *t, const char *c, const char *range) {
// printf("dontauditxperm %s %s %s %s\n", s, t, c, range); vprint("dontauditxperm %s %s %s %s\n", s, t, c, range);
return add_xperm_rule(s, t, c, range, AVTAB_XPERMS_DONTAUDIT, 0); return add_xperm_rule(s, t, c, range, AVTAB_XPERMS_DONTAUDIT, 0);
} }
int sepol_typetrans(const char *s, const char *t, const char *c, const char *d) { int sepol_typetrans(const char *s, const char *t, const char *c, const char *d) {
// printf("type_transition %s %s %s %s\n", s, t, c, d); vprint("type_transition %s %s %s %s\n", s, t, c, d);
return add_type_rule(s, t, c, d, AVTAB_TRANSITION); return add_type_rule(s, t, c, d, AVTAB_TRANSITION);
} }
int sepol_typechange(const char *s, const char *t, const char *c, const char *d) { int sepol_typechange(const char *s, const char *t, const char *c, const char *d) {
// printf("type_change %s %s %s %s\n", s, t, c, d); vprint("type_change %s %s %s %s\n", s, t, c, d);
return add_type_rule(s, t, c, d, AVTAB_CHANGE); return add_type_rule(s, t, c, d, AVTAB_CHANGE);
} }
int sepol_typemember(const char *s, const char *t, const char *c, const char *d) { int sepol_typemember(const char *s, const char *t, const char *c, const char *d) {
// printf("type_member %s %s %s %s\n", s, t, c, d); vprint("type_member %s %s %s %s\n", s, t, c, d);
return add_type_rule(s, t, c, d, AVTAB_MEMBER); return add_type_rule(s, t, c, d, AVTAB_MEMBER);
} }
int sepol_nametrans(const char *s, const char *t, const char *c, const char *d, const char *o) { int sepol_nametrans(const char *s, const char *t, const char *c, const char *d, const char *o) {
// printf("name_trans %s %s %s %s %s\n", s, t, c, d, o); vprint("name_trans %s %s %s %s %s\n", s, t, c, d, o);
return add_filename_trans(s, t, c, d, o); return add_filename_trans(s, t, c, d, o);
} }
int sepol_permissive(const char *s) { int sepol_permissive(const char *s) {
// printf("permissive %s\n", s); vprint("permissive %s\n", s);
return set_domain_state(s, 1); return set_domain_state(s, 1);
} }
int sepol_enforce(const char *s) { int sepol_enforce(const char *s) {
// printf("enforce %s\n", s); vprint("enforce %s\n", s);
return set_domain_state(s, 0); return set_domain_state(s, 0);
} }
int sepol_create(const char *s) { int sepol_create(const char *s) {
// printf("create %s\n", s); vprint("create %s\n", s);
return create_domain(s); return create_domain(s);
} }
int sepol_attradd(const char *s, const char *a) { int sepol_attradd(const char *s, const char *a) {
// printf("attradd %s %s\n", s, a); vprint("attradd %s %s\n", s, a);
return add_typeattribute(s, a); return add_typeattribute(s, a);
} }
int sepol_exists(const char *source) { int sepol_exists(const char *source) {
return hashtab_search(policydb->p_types.table, source) != nullptr; return hashtab_search(magisk_policydb->p_types.table, source) != nullptr;
} }
...@@ -487,7 +487,7 @@ int magiskpolicy_main(int argc, char *argv[]) { ...@@ -487,7 +487,7 @@ int magiskpolicy_main(int argc, char *argv[]) {
} }
// Use current policy if nothing is loaded // Use current policy if nothing is loaded
if (policydb == nullptr && load_policydb(SELINUX_POLICY)) { if (magisk_policydb == nullptr && load_policydb(SELINUX_POLICY)) {
fprintf(stderr, "Cannot load policy from " SELINUX_POLICY "\n"); fprintf(stderr, "Cannot load policy from " SELINUX_POLICY "\n");
return 1; return 1;
} }
......
...@@ -11,10 +11,8 @@ ...@@ -11,10 +11,8 @@
#include "magiskpolicy.h" #include "magiskpolicy.h"
#include "sepolicy.h" #include "sepolicy.h"
policydb_t *policydb = nullptr;
int load_policydb(const char *file) { int load_policydb(const char *file) {
if (policydb) if (magisk_policydb)
destroy_policydb(); destroy_policydb();
struct policy_file pf; struct policy_file pf;
...@@ -22,8 +20,8 @@ int load_policydb(const char *file) { ...@@ -22,8 +20,8 @@ int load_policydb(const char *file) {
pf.fp = xfopen(file, "re"); pf.fp = xfopen(file, "re");
pf.type = PF_USE_STDIO; pf.type = PF_USE_STDIO;
policydb = new policydb_t(); magisk_policydb = static_cast<policydb_t *>(xmalloc(sizeof(policydb_t)));
if (policydb_init(policydb) || policydb_read(policydb, &pf, 0)) if (policydb_init(magisk_policydb) || policydb_read(magisk_policydb, &pf, 0))
return 1; return 1;
fclose(pf.fp); fclose(pf.fp);
...@@ -169,7 +167,7 @@ int compile_split_cil() { ...@@ -169,7 +167,7 @@ int compile_split_cil() {
return 1; return 1;
cil_db_destroy(&db); cil_db_destroy(&db);
policydb = &pdb->p; magisk_policydb = &pdb->p;
return 0; return 0;
} }
...@@ -177,7 +175,7 @@ int dump_policydb(const char *file) { ...@@ -177,7 +175,7 @@ int dump_policydb(const char *file) {
int fd, ret; int fd, ret;
void *data = nullptr; void *data = nullptr;
size_t len; size_t len;
policydb_to_image(nullptr, policydb, &data, &len); policydb_to_image(nullptr, magisk_policydb, &data, &len);
if (data == nullptr) { if (data == nullptr) {
LOGE("Fail to dump policy image!\n"); LOGE("Fail to dump policy image!\n");
return 1; return 1;
...@@ -194,9 +192,9 @@ int dump_policydb(const char *file) { ...@@ -194,9 +192,9 @@ int dump_policydb(const char *file) {
} }
void destroy_policydb() { void destroy_policydb() {
if (policydb) { if (magisk_policydb) {
policydb_destroy(policydb); policydb_destroy(magisk_policydb);
delete policydb; free(magisk_policydb);
policydb = nullptr; magisk_policydb = nullptr;
} }
} }
...@@ -21,7 +21,7 @@ static void allowSuClient(const char *target) { ...@@ -21,7 +21,7 @@ static void allowSuClient(const char *target) {
sepol_allow(target, "untrusted_app_devpts", "chr_file", "ioctl"); sepol_allow(target, "untrusted_app_devpts", "chr_file", "ioctl");
sepol_allow(target, "untrusted_app_25_devpts", "chr_file", "ioctl"); sepol_allow(target, "untrusted_app_25_devpts", "chr_file", "ioctl");
sepol_allow(target, "untrusted_app_all_devpts", "chr_file", "ioctl"); sepol_allow(target, "untrusted_app_all_devpts", "chr_file", "ioctl");
if (policydb->policyvers >= POLICYDB_VERSION_XPERMS_IOCTL) { if (magisk_policydb->policyvers >= POLICYDB_VERSION_XPERMS_IOCTL) {
sepol_allowxperm(target, "devpts", "chr_file", "0x5400-0x54FF"); sepol_allowxperm(target, "devpts", "chr_file", "0x5400-0x54FF");
sepol_allowxperm(target, "untrusted_app_devpts", "chr_file", "0x5400-0x54FF"); sepol_allowxperm(target, "untrusted_app_devpts", "chr_file", "0x5400-0x54FF");
sepol_allowxperm(target, "untrusted_app_25_devpts", "chr_file", "0x5400-0x54FF"); sepol_allowxperm(target, "untrusted_app_25_devpts", "chr_file", "0x5400-0x54FF");
...@@ -166,7 +166,7 @@ void sepol_magisk_rules() { ...@@ -166,7 +166,7 @@ void sepol_magisk_rules() {
sepol_allow(SEPOL_PROC_DOMAIN, ALL, "fifo_file", ALL); sepol_allow(SEPOL_PROC_DOMAIN, ALL, "fifo_file", ALL);
// Allow us to do any ioctl on all block devices // Allow us to do any ioctl on all block devices
if (policydb->policyvers >= POLICYDB_VERSION_XPERMS_IOCTL) if (magisk_policydb->policyvers >= POLICYDB_VERSION_XPERMS_IOCTL)
sepol_allowxperm(SEPOL_PROC_DOMAIN, ALL, "blk_file", "0x0000-0xFFFF"); sepol_allowxperm(SEPOL_PROC_DOMAIN, ALL, "blk_file", "0x0000-0xFFFF");
// Allow all binder transactions // Allow all binder transactions
...@@ -198,11 +198,7 @@ void sepol_magisk_rules() { ...@@ -198,11 +198,7 @@ void sepol_magisk_rules() {
#ifdef MAGISK_DEBUG #ifdef MAGISK_DEBUG
// Remove all dontaudit in debug mode // Remove all dontaudit in debug mode
avtab_ptr_t av; strip_dontaudit();
avtab_for_each(&policydb->te_avtab, av, {
if (av->key.specified == AVTAB_AUDITDENY || av->key.specified == AVTAB_XPERMS_DONTAUDIT)
avtab_remove_node(&policydb->te_avtab, av);
})
#endif #endif
log_cb.w = bak; log_cb.w = bak;
......
This diff is collapsed.
...@@ -5,32 +5,15 @@ ...@@ -5,32 +5,15 @@
__BEGIN_DECLS __BEGIN_DECLS
// Global policydb // Global policydb
extern policydb_t *policydb; extern policydb_t *magisk_policydb;
// General hash table traversal
#define hash_for_each(table, slots, tab, cur, block) \
for (int __i = 0; __i < (tab)->slots; ++__i) { \
__typeof__(cur) __next; \
for (cur = (tab)->table[__i]; cur; cur = __next) { \
__next = cur->next; \
block \
} \
} \
// hashtab traversal
#define hashtab_for_each(hashtab, cur, block) \
hash_for_each(htable, size, hashtab, cur, block)
// avtab traversal
#define avtab_for_each(avtab, cur, block) \
hash_for_each(htable, nslot, avtab, cur, block)
int create_domain(const char *d); int create_domain(const char *d);
int set_domain_state(const char *s, int state); int set_domain_state(const char *s, int state);
int add_typeattribute(const char *domainS, const char *attr); int add_typeattribute(const char *type, const char *attr);
int add_rule(const char *s, const char *t, const char *c, const char *p, int effect, int n); int add_rule(const char *s, const char *t, const char *c, const char *p, int effect, int n);
int add_xperm_rule(const char *s, const char *t, const char *c, const char *range, int effect, int n); int add_xperm_rule(const char *s, const char *t, const char *c, const char *range, int effect, int n);
int add_type_rule(const char *s, const char *t, const char *c, const char *d, int effect); int add_type_rule(const char *s, const char *t, const char *c, const char *d, int effect);
int add_filename_trans(const char *s, const char *t, const char *c, const char *d, const char *o); int add_filename_trans(const char *s, const char *t, const char *c, const char *d, const char *o);
void strip_dontaudit();
__END_DECLS __END_DECLS
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment