Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
M
Magisk
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
Magisk
Commits
ea61d5c1
Commit
ea61d5c1
authored
Feb 01, 2017
by
topjohnwu
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Remove su_daemon domain
parent
9a149311
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
8 additions
and
139 deletions
+8
-139
rules.c
rules.c
+8
-139
No files found.
rules.c
View file @
ea61d5c1
...
@@ -67,140 +67,15 @@ void samsung() {
...
@@ -67,140 +67,15 @@ void samsung() {
void
allowSuClient
(
char
*
target
)
{
void
allowSuClient
(
char
*
target
)
{
allow
(
target
,
"rootfs"
,
"file"
,
"execute_no_trans"
);
allow
(
target
,
"rootfs"
,
"file"
,
"execute_no_trans"
);
allow
(
target
,
"rootfs"
,
"file"
,
"execute"
);
allow
(
target
,
"rootfs"
,
"file"
,
"execute"
);
allow
(
target
,
"su
_daemon
"
,
"unix_stream_socket"
,
"connectto"
);
allow
(
target
,
"su"
,
"unix_stream_socket"
,
"connectto"
);
allow
(
target
,
"su
_daemon
"
,
"unix_stream_socket"
,
"getopt"
);
allow
(
target
,
"su"
,
"unix_stream_socket"
,
"getopt"
);
allow
(
target
,
"su_device"
,
"dir"
,
"search"
);
allow
(
target
,
"su_device"
,
"dir"
,
"search"
);
allow
(
target
,
"su_device"
,
"dir"
,
"read"
);
allow
(
target
,
"su_device"
,
"dir"
,
"read"
);
allow
(
target
,
"su_device"
,
"sock_file"
,
"read"
);
allow
(
target
,
"su_device"
,
"sock_file"
,
"read"
);
allow
(
target
,
"su_device"
,
"sock_file"
,
"write"
);
allow
(
target
,
"su_device"
,
"sock_file"
,
"write"
);
allow
(
"su_daemon"
,
target
,
"fd"
,
"use"
);
allow
(
"su_daemon"
,
target
,
"fifo_file"
,
"read"
);
allow
(
"su_daemon"
,
target
,
"fifo_file"
,
"write"
);
allow
(
"su_daemon"
,
target
,
"fifo_file"
,
"getattr"
);
allow
(
"su_daemon"
,
target
,
"fifo_file"
,
"ioctl"
);
allow
(
"su_daemon"
,
target
,
"dir"
,
"search"
);
allow
(
"su_daemon"
,
target
,
"file"
,
"read"
);
allow
(
"su_daemon"
,
target
,
"file"
,
"open"
);
allow
(
"su_daemon"
,
target
,
"lnk_file"
,
"read"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"capability"
,
"sys_ptrace"
);
}
void
suDaemonRights
()
{
allow
(
"su_daemon"
,
"rootfs"
,
"file"
,
"entrypoint"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"dir"
,
"search"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"dir"
,
"read"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"file"
,
"read"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"file"
,
"write"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"file"
,
"open"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"lnk_file"
,
"read"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"unix_dgram_socket"
,
"create"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"unix_dgram_socket"
,
"connect"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"unix_dgram_socket"
,
"write"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"unix_stream_socket"
,
"create"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"unix_stream_socket"
,
"ioctl"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"unix_stream_socket"
,
"read"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"unix_stream_socket"
,
"getattr"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"unix_stream_socket"
,
"write"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"unix_stream_socket"
,
"setattr"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"unix_stream_socket"
,
"lock"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"unix_stream_socket"
,
"append"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"unix_stream_socket"
,
"bind"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"unix_stream_socket"
,
"connect"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"unix_stream_socket"
,
"getopt"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"unix_stream_socket"
,
"setopt"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"unix_stream_socket"
,
"shutdown"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"unix_stream_socket"
,
"listen"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"unix_stream_socket"
,
"accept"
);
allow
(
"su_daemon"
,
"devpts"
,
"chr_file"
,
"read"
);
allow
(
"su_daemon"
,
"devpts"
,
"chr_file"
,
"write"
);
allow
(
"su_daemon"
,
"devpts"
,
"chr_file"
,
"open"
);
allow
(
"su_daemon"
,
"devpts"
,
"chr_file"
,
"getattr"
);
allow
(
"su_daemon"
,
"untrusted_app_devpts"
,
"chr_file"
,
"read"
);
allow
(
"su_daemon"
,
"untrusted_app_devpts"
,
"chr_file"
,
"write"
);
allow
(
"su_daemon"
,
"untrusted_app_devpts"
,
"chr_file"
,
"open"
);
allow
(
"su_daemon"
,
"untrusted_app_devpts"
,
"chr_file"
,
"getattr"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"capability"
,
"setuid"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"capability"
,
"setgid"
);
allow
(
"su_daemon"
,
"app_data_file"
,
"dir"
,
"getattr"
);
allow
(
"su_daemon"
,
"app_data_file"
,
"dir"
,
"search"
);
allow
(
"su_daemon"
,
"app_data_file"
,
"dir"
,
"write"
);
allow
(
"su_daemon"
,
"app_data_file"
,
"dir"
,
"add_name"
);
allow
(
"su_daemon"
,
"app_data_file"
,
"file"
,
"getattr"
);
allow
(
"su_daemon"
,
"app_data_file"
,
"file"
,
"read"
);
allow
(
"su_daemon"
,
"app_data_file"
,
"file"
,
"open"
);
allow
(
"su_daemon"
,
"app_data_file"
,
"file"
,
"lock"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"capability"
,
"dac_override"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"process"
,
"fork"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"process"
,
"sigchld"
);
allow
(
"su_daemon"
,
"toolbox_exec"
,
"file"
,
"execute"
);
allow
(
"su_daemon"
,
"toolbox_exec"
,
"file"
,
"read"
);
allow
(
"su_daemon"
,
"toolbox_exec"
,
"file"
,
"open"
);
allow
(
"su_daemon"
,
"toolbox_exec"
,
"file"
,
"execute_no_trans"
);
allow
(
"su_daemon"
,
"device"
,
"dir"
,
"write"
);
allow
(
"su_daemon"
,
"device"
,
"dir"
,
"add_name"
);
allow
(
"su_daemon"
,
"su_device"
,
"dir"
,
"create"
);
allow
(
"su_daemon"
,
"su_device"
,
"dir"
,
"setattr"
);
allow
(
"su_daemon"
,
"su_device"
,
"dir"
,
"remove_name"
);
allow
(
"su_daemon"
,
"su_device"
,
"dir"
,
"add_name"
);
allow
(
"su_daemon"
,
"su_device"
,
"sock_file"
,
"create"
);
allow
(
"su_daemon"
,
"su_device"
,
"sock_file"
,
"unlink"
);
allow
(
"su_daemon"
,
"zygote_exec"
,
"file"
,
"execute"
);
allow
(
"su_daemon"
,
"zygote_exec"
,
"file"
,
"read"
);
allow
(
"su_daemon"
,
"zygote_exec"
,
"file"
,
"open"
);
allow
(
"su_daemon"
,
"zygote_exec"
,
"file"
,
"execute_no_trans"
);
allow
(
"su_daemon"
,
"zygote_exec"
,
"lnk_file"
,
"read"
);
allow
(
"su_daemon"
,
"zygote_exec"
,
"lnk_file"
,
"getattr"
);
allow
(
"su_daemon"
,
"su_device"
,
"dir"
,
"search"
);
allow
(
"su_daemon"
,
"su_device"
,
"dir"
,
"write"
);
allow
(
"su_daemon"
,
"su_device"
,
"dir"
,
"add_name"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"process"
,
"setexec"
);
allow
(
"su_daemon"
,
"shell_exec"
,
"file"
,
"execute"
);
allow
(
"su_daemon"
,
"shell_exec"
,
"file"
,
"read"
);
allow
(
"su_daemon"
,
"shell_exec"
,
"file"
,
"open"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"capability"
,
"chown"
);
allow
(
"su_daemon"
,
"su"
,
"process"
,
"transition"
);
allow
(
"su_daemon"
,
"su"
,
"process"
,
"siginh"
);
allow
(
"su_daemon"
,
"su"
,
"process"
,
"rlimitinh"
);
allow
(
"su_daemon"
,
"su"
,
"process"
,
"noatsecure"
);
// suL9
allow
(
"su_daemon"
,
"su_daemon"
,
"dir"
,
ALL
);
allow
(
"su_daemon"
,
"su_daemon"
,
"file"
,
ALL
);
allow
(
"su_daemon"
,
"su_daemon"
,
"lnk_file"
,
ALL
);
allow
(
"su_daemon"
,
"system_data_file"
,
"dir"
,
ALL
);
allow
(
"su_daemon"
,
"system_data_file"
,
"file"
,
ALL
);
allow
(
"su_daemon"
,
"system_data_file"
,
"lnk_file"
,
ALL
);
allow
(
"su_daemon"
,
"labeledfs"
,
"filesystem"
,
"associate"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"process"
,
"setfscreate"
);
allow
(
"su_daemon"
,
"tmpfs"
,
"filesystem"
,
"associate"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"file"
,
"relabelfrom"
);
allow
(
"su_daemon"
,
"system_file"
,
"file"
,
"mounton"
);
// Allow to start daemon by script in su domain
allow
(
"su_daemon"
,
"su"
,
"file"
,
"write"
);
allow
(
"su_daemon"
,
"proc"
,
"file"
,
"read"
);
allow
(
"su_daemon"
,
"proc"
,
"file"
,
"open"
);
allow
(
"su_daemon"
,
"su_daemon"
,
"process"
,
"setcurrent"
);
allow
(
"su_daemon"
,
"system_file"
,
"file"
,
"execute_no_trans"
);
// Allow to adb shell su
allow
(
"su_daemon"
,
"adbd"
,
"fd"
,
"use"
);
allow
(
"su_daemon"
,
"adbd"
,
"unix_stream_socket"
,
"read"
);
allow
(
"su_daemon"
,
"adbd"
,
"unix_stream_socket"
,
"write"
);
allow
(
"su_daemon"
,
"adbd"
,
"unix_stream_socket"
,
"ioctl"
);
}
void
suBind
()
{
allow
(
"su_daemon"
,
"su_exec"
,
"file"
,
"mounton"
);
allow
(
"su_daemon"
,
"su_exec"
,
"file"
,
"read"
);
allow
(
"su_daemon"
,
"su_device"
,
"dir"
,
ALL
);
allow
(
"su_daemon"
,
"su_device"
,
"file"
,
ALL
);
allow
(
"su_daemon"
,
"su_device"
,
"lnk_file"
,
ALL
);
allow
(
"su_daemon"
,
"system_file"
,
"file"
,
"relabelto"
);
}
}
void
suRights
()
{
void
suRights
()
{
allow
(
"su_daemon"
,
"su_daemon"
,
"capability"
,
"sys_admin"
);
allow
(
"servicemanager"
,
"su"
,
"dir"
,
"search"
);
allow
(
"servicemanager"
,
"su"
,
"dir"
,
"search"
);
allow
(
"servicemanager"
,
"su"
,
"dir"
,
"read"
);
allow
(
"servicemanager"
,
"su"
,
"dir"
,
"read"
);
allow
(
"servicemanager"
,
"su"
,
"file"
,
"open"
);
allow
(
"servicemanager"
,
"su"
,
"file"
,
"open"
);
...
@@ -263,14 +138,13 @@ void su_rules() {
...
@@ -263,14 +138,13 @@ void su_rules() {
// Create domains if they don't exist
// Create domains if they don't exist
permissive
(
"su"
);
permissive
(
"su"
);
enforce
(
"su_device"
);
enforce
(
"su_device"
);
enforce
(
"su_daemon"
);
// Patch su to everything
// Patch su to everything
allow
(
"su"
,
ALL
,
ALL
,
ALL
);
allow
(
"su"
,
ALL
,
ALL
,
ALL
);
// Autotransition su's socket to su_device
// Autotransition su's socket to su_device
add_transition
(
"su
_daemon
"
,
"device"
,
"su_device"
,
"file"
);
add_transition
(
"su"
,
"device"
,
"su_device"
,
"file"
);
add_transition
(
"su
_daemon
"
,
"device"
,
"su_device"
,
"dir"
);
add_transition
(
"su"
,
"device"
,
"su_device"
,
"dir"
);
allow
(
"su_device"
,
"tmpfs"
,
"filesystem"
,
"associate"
);
allow
(
"su_device"
,
"tmpfs"
,
"filesystem"
,
"associate"
);
// Transition from untrusted_app to su_client
// Transition from untrusted_app to su_client
...
@@ -278,26 +152,21 @@ void su_rules() {
...
@@ -278,26 +152,21 @@ void su_rules() {
allowSuClient
(
"untrusted_app"
);
allowSuClient
(
"untrusted_app"
);
allowSuClient
(
"system_app"
);
allowSuClient
(
"system_app"
);
allowSuClient
(
"platform_app"
);
allowSuClient
(
"platform_app"
);
allowSuClient
(
"su"
);
if
(
exists
(
"priv_app"
))
if
(
exists
(
"priv_app"
))
allowSuClient
(
"priv_app"
);
allowSuClient
(
"priv_app"
);
if
(
exists
(
"ssd_tool"
))
if
(
exists
(
"ssd_tool"
))
allowSuClient
(
"ssd_tool"
);
allowSuClient
(
"ssd_tool"
);
// Allow init to execute su daemon/transition
// Allow init to execute su daemon/transition
allow
(
"init"
,
"su_daemon"
,
"process"
,
"transition"
);
allow
(
"init"
,
"su"
,
"process"
,
"transition"
);
allow
(
"init"
,
"su_daemon"
,
"process"
,
"rlimitinh"
);
allow
(
"init"
,
"su"
,
"process"
,
"rlimitinh"
);
allow
(
"init"
,
"su_daemon"
,
"process"
,
"siginh"
);
allow
(
"init"
,
"su"
,
"process"
,
"siginh"
);
allow
(
"init"
,
"su_daemon"
,
"process"
,
"noatsecure"
);
allow
(
"init"
,
"su"
,
"process"
,
"noatsecure"
);
suDaemonRights
();
suBind
();
suRights
();
suRights
();
otherToSU
();
otherToSU
();
// Need to set su_device/su as trusted to be accessible from other categories
// Need to set su_device/su as trusted to be accessible from other categories
attradd
(
"su_device"
,
"mlstrustedobject"
);
attradd
(
"su_device"
,
"mlstrustedobject"
);
attradd
(
"su_daemon"
,
"mlstrustedsubject"
);
attradd
(
"su"
,
"mlstrustedsubject"
);
attradd
(
"su"
,
"mlstrustedsubject"
);
// Allow chcon to anything
// Allow chcon to anything
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment