Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
M
Magisk
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
Magisk
Commits
d7a61272
Commit
d7a61272
authored
Nov 28, 2017
by
topjohnwu
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Remove Samsung sepcific patches and small refactoring
parent
8ee9984e
Show whitespace changes
Inline
Side-by-side
Showing
4 changed files
with
87 additions
and
120 deletions
+87
-120
magiskpolicy.c
magiskpolicy.c
+18
-17
magiskpolicy.h
magiskpolicy.h
+34
-0
rules.c
rules.c
+34
-102
sepolicy.c
sepolicy.c
+1
-1
No files found.
magiskpolicy.c
View file @
d7a61272
...
...
@@ -58,14 +58,15 @@ static void statements() {
static
void
usage
(
char
*
arg0
)
{
fprintf
(
stderr
,
"MagiskPolicy v"
xstr
(
MAGISK_VERSION
)
"("
xstr
(
MAGISK_VER_CODE
)
") (by topjohnwu
& phh) - sepolicy Modification Tool
\n\n
"
"MagiskPolicy v"
xstr
(
MAGISK_VERSION
)
"("
xstr
(
MAGISK_VER_CODE
)
") (by topjohnwu
)
\n\n
"
"Usage: %s [--options...] [policystatements...]
\n\n
"
"Options:
\n
"
" --live directly load patched policy to device
\n
"
" --minimal minimal patches, used for boot image patches
\n
"
" --load <infile> load policies from <infile>
\n
"
" (load from live policies if not specified)
\n
"
" --save <outfile> save policies to <outfile>
\n\n
"
" --live directly apply patched policy live
\n
"
" --magisk built-in rules for a Magisk selinux environment
\n
"
" --load FILE load policies from <infile>
\n
"
" --save FILE save policies to <outfile>
\n\n
"
"If no input file is specified, it will load from current policies
\n
"
"If neither --live nor --save is specified, nothing will happen
\n\n
"
,
arg0
);
statements
();
exit
(
1
);
...
...
@@ -381,7 +382,7 @@ static void syntax_error_msg() {
int
magiskpolicy_main
(
int
argc
,
char
*
argv
[])
{
char
*
infile
=
NULL
,
*
outfile
=
NULL
,
*
tok
,
*
saveptr
;
int
live
=
0
,
m
inimal
=
0
;
int
live
=
0
,
m
agisk
=
0
;
struct
vector
rules
;
vec_init
(
&
rules
);
...
...
@@ -391,8 +392,8 @@ int magiskpolicy_main(int argc, char *argv[]) {
if
(
argv
[
i
][
0
]
==
'-'
&&
argv
[
i
][
1
]
==
'-'
)
{
if
(
strcmp
(
argv
[
i
],
"--live"
)
==
0
)
live
=
1
;
else
if
(
strcmp
(
argv
[
i
],
"--m
inimal
"
)
==
0
)
m
inimal
=
1
;
else
if
(
strcmp
(
argv
[
i
],
"--m
agisk
"
)
==
0
)
m
agisk
=
1
;
else
if
(
strcmp
(
argv
[
i
],
"--load"
)
==
0
)
{
if
(
i
+
1
>=
argc
)
usage
(
argv
[
0
]);
infile
=
argv
[
i
+
1
];
...
...
@@ -403,9 +404,10 @@ int magiskpolicy_main(int argc, char *argv[]) {
i
+=
1
;
}
else
usage
(
argv
[
0
]);
}
else
}
else
{
vec_push_back
(
&
rules
,
argv
[
i
]);
}
}
// Use current policy if not specified
if
(
!
infile
)
...
...
@@ -416,8 +418,8 @@ int magiskpolicy_main(int argc, char *argv[]) {
return
1
;
}
if
(
m
inimal
)
sepol_m
in
_rules
();
if
(
m
agisk
)
sepol_m
agisk
_rules
();
for
(
int
i
=
0
;
i
<
rules
.
size
;
++
i
)
{
// Since strtok will modify the origin string, copy the policy for error messages
...
...
@@ -472,8 +474,7 @@ int magiskpolicy_main(int argc, char *argv[]) {
if
(
live
)
outfile
=
SELINUX_LOAD
;
if
(
outfile
)
if
(
dump_policydb
(
outfile
))
{
if
(
outfile
&&
dump_policydb
(
outfile
))
{
fprintf
(
stderr
,
"Cannot dump policy to %s
\n
"
,
outfile
);
return
1
;
}
...
...
magiskpolicy.h
0 → 100644
View file @
d7a61272
/* magiskpolicy.h - Public API for policy patching
*/
#ifndef _MAGISKPOLICY_H
#define _MAGISKPOLICY_H
#include <stdlib.h>
#define ALL NULL
// policydb functions
int
load_policydb
(
const
char
*
filename
);
int
dump_policydb
(
const
char
*
filename
);
void
destroy_policydb
();
// Handy functions
int
sepol_allow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
sepol_deny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
sepol_auditallow
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
sepol_auditdeny
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
p
);
int
sepol_typetrans
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
d
,
char
*
o
);
int
sepol_allowxperm
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
range
);
int
sepol_auditallowxperm
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
range
);
int
sepol_dontauditxperm
(
char
*
s
,
char
*
t
,
char
*
c
,
char
*
range
);
int
sepol_create
(
char
*
s
);
int
sepol_permissive
(
char
*
s
);
int
sepol_enforce
(
char
*
s
);
int
sepol_attradd
(
char
*
s
,
char
*
a
);
int
sepol_exists
(
char
*
source
);
// Built in rules
void
sepol_magisk_rules
();
#endif
rules.c
View file @
d7a61272
#include "magiskpolicy.h"
#include "sepolicy.h"
void
samsung
()
{
sepol_deny
(
"init"
,
"kernel"
,
"security"
,
"load_policy"
);
sepol_deny
(
"policyloader_app"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_deny
(
"policyloader_app"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_deny
(
"policyloader_app"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_deny
(
"policyloader_app"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_deny
(
"system_server"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_deny
(
"system_server"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_deny
(
"system_server"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_deny
(
"system_server"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_deny
(
"system_app"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_deny
(
"system_app"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_deny
(
"system_app"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_deny
(
"system_app"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_deny
(
"installd"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_deny
(
"installd"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_deny
(
"installd"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_deny
(
"installd"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_deny
(
"init"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_deny
(
"init"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_deny
(
"init"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_deny
(
"init"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_deny
(
"ueventd"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_deny
(
"ueventd"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_deny
(
"ueventd"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_deny
(
"ueventd"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_deny
(
"runas"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_deny
(
"runas"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_deny
(
"runas"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_deny
(
"runas"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_deny
(
"drsd"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_deny
(
"drsd"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_deny
(
"drsd"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_deny
(
"drsd"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_deny
(
"debuggerd"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_deny
(
"debuggerd"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_deny
(
"debuggerd"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_deny
(
"debuggerd"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_deny
(
"vold"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_deny
(
"vold"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_deny
(
"vold"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_deny
(
"vold"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_deny
(
"zygote"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_deny
(
"zygote"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_deny
(
"zygote"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_deny
(
"zygote"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_deny
(
"auditd"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_deny
(
"auditd"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_deny
(
"auditd"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_deny
(
"auditd"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_deny
(
"servicemanager"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_deny
(
"servicemanager"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_deny
(
"servicemanager"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_deny
(
"servicemanager"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_deny
(
"itsonbs"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_deny
(
"itsonbs"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_deny
(
"itsonbs"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_deny
(
"itsonbs"
,
"security_spota_file"
,
"file"
,
"write"
);
sepol_deny
(
"commonplatformappdomain"
,
"security_spota_file"
,
"dir"
,
"read"
);
sepol_deny
(
"commonplatformappdomain"
,
"security_spota_file"
,
"dir"
,
"write"
);
sepol_deny
(
"commonplatformappdomain"
,
"security_spota_file"
,
"file"
,
"read"
);
sepol_deny
(
"commonplatformappdomain"
,
"security_spota_file"
,
"file"
,
"write"
);
}
void
allowSuClient
(
char
*
target
)
{
sepol_allow
(
target
,
"rootfs"
,
"file"
,
ALL
);
sepol_allow
(
target
,
"rootfs"
,
"lnk_file"
,
ALL
);
...
...
@@ -149,10 +85,19 @@ void otherToSU() {
sepol_allow
(
"surfaceflinger"
,
"su"
,
"binder"
,
"call"
);
sepol_allow
(
"surfaceflinger"
,
"su"
,
"fd"
,
"use"
);
sepol_allow
(
"debuggerd"
,
"su"
,
"process"
,
"ptrace"
);
// dumpsys
sepol_allow
(
ALL
,
"su"
,
"fd"
,
"use"
);
sepol_allow
(
ALL
,
"su"
,
"fifo_file"
,
"write"
);
sepol_allow
(
ALL
,
"su"
,
"fifo_file"
,
"read"
);
sepol_allow
(
ALL
,
"su"
,
"fifo_file"
,
"open"
);
sepol_allow
(
ALL
,
"su"
,
"fifo_file"
,
"getattr"
);
}
// Minimal boot image patch, Samsung requires these patches
void
sepol_min_rules
()
{
void
sepol_magisk_rules
()
{
// First prevent anything to change sepolicy except ourselves
sepol_deny
(
ALL
,
"kernel"
,
"security"
,
"load_policy"
);
if
(
!
sepol_exists
(
"su"
))
sepol_create
(
"su"
);
if
(
!
sepol_exists
(
"su_device"
))
...
...
@@ -163,7 +108,7 @@ void sepol_min_rules() {
sepol_attradd
(
"su"
,
"mlstrustedsubject"
);
sepol_attradd
(
"su_device"
,
"mlstrustedobject"
);
//
Let magiskinit daemon monitor and transit to su
//
Allow magiskinit daemon to run and run in su context
sepol_allow
(
"kernel"
,
"device"
,
"dir"
,
ALL
);
sepol_allow
(
"kernel"
,
"device"
,
"file"
,
ALL
);
sepol_allow
(
"kernel"
,
"su"
,
"unix_stream_socket"
,
"connectto"
);
...
...
@@ -177,11 +122,6 @@ void sepol_min_rules() {
sepol_allow
(
"init"
,
"system_file"
,
"lnk_file"
,
ALL
);
sepol_allow
(
"init"
,
"system_file"
,
"file"
,
ALL
);
// Samsung specific
// Prevent system from loading policy
if
(
sepol_exists
(
"knox_system_app"
))
samsung
();
// Shell, prop management, simple su rights, logs
sepol_allow
(
"su"
,
"property_socket"
,
"sock_file"
,
"write"
);
sepol_allow
(
"su"
,
"properties_device"
,
"file"
,
"write"
);
...
...
@@ -228,12 +168,34 @@ void sepol_min_rules() {
sepol_allow
(
"su"
,
"selinuxfs"
,
"file"
,
"open"
);
sepol_allow
(
"su"
,
"selinuxfs"
,
"file"
,
"write"
);
// Allow these client to access su
allowSuClient
(
"shell"
);
allowSuClient
(
"untrusted_app"
);
allowSuClient
(
"system_app"
);
allowSuClient
(
"platform_app"
);
if
(
sepol_exists
(
"priv_app"
))
allowSuClient
(
"priv_app"
);
if
(
sepol_exists
(
"ssd_tool"
))
allowSuClient
(
"ssd_tool"
);
if
(
sepol_exists
(
"untrusted_app_25"
))
allowSuClient
(
"untrusted_app_25"
);
// Some superuser stuffs
suRights
();
otherToSU
();
// For mounting loop devices and mirrors
sepol_allow
(
"su"
,
"kernel"
,
"process"
,
"setsched"
);
sepol_allow
(
"su"
,
"labeledfs"
,
"filesystem"
,
"mount"
);
sepol_allow
(
"su"
,
"labeledfs"
,
"filesystem"
,
"unmount"
);
sepol_allow
(
"kernel"
,
ALL
,
"file"
,
"read"
);
// Allow su to do anything to any files/dir/links
sepol_allow
(
"su"
,
ALL
,
"file"
,
ALL
);
sepol_allow
(
"su"
,
ALL
,
"dir"
,
ALL
);
sepol_allow
(
"su"
,
ALL
,
"lnk_file"
,
ALL
);
sepol_allow
(
"su"
,
ALL
,
"blk_file"
,
ALL
);
// For changing attributes
sepol_allow
(
"rootfs"
,
"tmpfs"
,
"filesystem"
,
"associate"
);
...
...
@@ -248,33 +210,3 @@ void sepol_min_rules() {
}
}
void
sepol_med_rules
()
{
sepol_min_rules
();
// Allow su to do anything to any files/dir/links
sepol_allow
(
"su"
,
ALL
,
"file"
,
ALL
);
sepol_allow
(
"su"
,
ALL
,
"dir"
,
ALL
);
sepol_allow
(
"su"
,
ALL
,
"lnk_file"
,
ALL
);
sepol_allow
(
"su"
,
ALL
,
"blk_file"
,
ALL
);
// Allow these client to access su
allowSuClient
(
"shell"
);
allowSuClient
(
"untrusted_app"
);
allowSuClient
(
"system_app"
);
allowSuClient
(
"platform_app"
);
if
(
sepol_exists
(
"priv_app"
))
allowSuClient
(
"priv_app"
);
if
(
sepol_exists
(
"ssd_tool"
))
allowSuClient
(
"ssd_tool"
);
if
(
sepol_exists
(
"untrusted_app_25"
))
allowSuClient
(
"untrusted_app_25"
);
suRights
();
otherToSU
();
}
void
sepol_full_rules
()
{
// Patch su to everything
sepol_allow
(
"su"
,
ALL
,
ALL
,
ALL
);
}
sepolicy.c
View file @
d7a61272
...
...
@@ -255,7 +255,7 @@ int dump_policydb(const char *filename) {
return
1
;
}
fd
=
open
(
filename
,
O_RDWR
|
O_CREAT
,
0644
);
fd
=
creat
(
filename
,
0644
);
if
(
fd
<
0
)
{
fprintf
(
stderr
,
"Can't open '%s': %s
\n
"
,
filename
,
strerror
(
errno
));
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment