Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
M
Magisk
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
Magisk
Commits
f392ade7
Commit
f392ade7
authored
May 23, 2020
by
topjohnwu
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Rewrite sepolicy.c in C++
parent
0236ab88
Expand all
Hide whitespace changes
Inline
Side-by-side
Showing
10 changed files
with
714 additions
and
138 deletions
+714
-138
Android.mk
native/jni/Android.mk
+3
-5
magiskpolicy.hpp
native/jni/include/magiskpolicy.hpp
+2
-3
api.cpp
native/jni/magiskpolicy/api.cpp
+0
-90
magiskpolicy.cpp
native/jni/magiskpolicy/magiskpolicy.cpp
+1
-1
policydb.cpp
native/jni/magiskpolicy/policydb.cpp
+1
-1
rules.cpp
native/jni/magiskpolicy/rules.cpp
+10
-13
sepolicy.cpp
native/jni/magiskpolicy/sepolicy.cpp
+666
-0
sepolicy.h
native/jni/magiskpolicy/sepolicy.h
+0
-24
sepolicy.hpp
native/jni/magiskpolicy/sepolicy.hpp
+30
-0
statement.cpp
native/jni/magiskpolicy/statement.cpp
+1
-1
No files found.
native/jni/Android.mk
View file @
f392ade7
...
...
@@ -63,12 +63,11 @@ LOCAL_SRC_FILES := \
init/getinfo.cpp \
init/twostage.cpp \
core/socket.cpp \
magiskpolicy/
api
.cpp \
magiskpolicy/
sepolicy
.cpp \
magiskpolicy/magiskpolicy.cpp \
magiskpolicy/rules.cpp \
magiskpolicy/policydb.cpp \
magiskpolicy/statement.cpp \
magiskpolicy/sepolicy.c \
magiskboot/pattern.cpp
LOCAL_LDFLAGS := -static
...
...
@@ -108,12 +107,11 @@ LOCAL_C_INCLUDES := jni/include
LOCAL_SRC_FILES := \
core/applet_stub.cpp \
magiskpolicy/
api
.cpp \
magiskpolicy/
sepolicy
.cpp \
magiskpolicy/magiskpolicy.cpp \
magiskpolicy/rules.cpp \
magiskpolicy/policydb.cpp \
magiskpolicy/statement.cpp \
magiskpolicy/sepolicy.c
magiskpolicy/statement.cpp
LOCAL_CFLAGS := -DAPPLET_STUB_MAIN=magiskpolicy_main
LOCAL_LDFLAGS := -static
...
...
native/jni/include/magiskpolicy.hpp
View file @
f392ade7
...
...
@@ -41,7 +41,7 @@ public:
int
dontauditxperm
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
range
);
// Type rules
int
type_transition
(
c_str
s
rc
,
c_str
tgt
,
c_str
cls
,
c_str
def
,
c_str
obj
=
nullptr
);
int
type_transition
(
c_str
s
,
c_str
t
,
c_str
c
,
c_str
d
,
c_str
o
=
nullptr
);
int
type_change
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
def
);
int
type_member
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
def
);
...
...
@@ -50,8 +50,7 @@ public:
// Magisk
void
magisk_rules
();
void
allow_su_client
(
c_str
type
);
pr
ivate
:
pr
otected
:
policydb
*
db
;
};
native/jni/magiskpolicy/api.cpp
deleted
100644 → 0
View file @
0236ab88
#include <magiskpolicy.hpp>
#include "sepolicy.h"
//#define vprint(fmt, ...) printf(fmt, __VA_ARGS__)
#define vprint(...)
int
sepolicy
::
allow
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
vprint
(
"allow %s %s %s %s
\n
"
,
s
,
t
,
c
,
p
);
return
add_rule
(
db
,
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
0
);
}
int
sepolicy
::
deny
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
vprint
(
"deny %s %s %s %s
\n
"
,
s
,
t
,
c
,
p
);
return
add_rule
(
db
,
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
1
);
}
int
sepolicy
::
auditallow
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
vprint
(
"auditallow %s %s %s %s
\n
"
,
s
,
t
,
c
,
p
);
return
add_rule
(
db
,
s
,
t
,
c
,
p
,
AVTAB_AUDITALLOW
,
0
);
}
int
sepolicy
::
dontaudit
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
vprint
(
"dontaudit %s %s %s %s
\n
"
,
s
,
t
,
c
,
p
);
return
add_rule
(
db
,
s
,
t
,
c
,
p
,
AVTAB_AUDITDENY
,
1
);
}
int
sepolicy
::
allowxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
vprint
(
"allowxperm %s %s %s %s
\n
"
,
s
,
t
,
c
,
range
);
return
add_xperm_rule
(
db
,
s
,
t
,
c
,
range
,
AVTAB_XPERMS_ALLOWED
,
0
);
}
int
sepolicy
::
auditallowxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
vprint
(
"auditallowxperm %s %s %s %s
\n
"
,
s
,
t
,
c
,
range
);
return
add_xperm_rule
(
db
,
s
,
t
,
c
,
range
,
AVTAB_XPERMS_AUDITALLOW
,
0
);
}
int
sepolicy
::
dontauditxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
vprint
(
"dontauditxperm %s %s %s %s
\n
"
,
s
,
t
,
c
,
range
);
return
add_xperm_rule
(
db
,
s
,
t
,
c
,
range
,
AVTAB_XPERMS_DONTAUDIT
,
0
);
}
int
sepolicy
::
type_change
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
vprint
(
"type_change %s %s %s %s
\n
"
,
s
,
t
,
c
,
d
);
return
add_type_rule
(
db
,
s
,
t
,
c
,
d
,
AVTAB_CHANGE
);
}
int
sepolicy
::
type_member
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
vprint
(
"type_member %s %s %s %s
\n
"
,
s
,
t
,
c
,
d
);
return
add_type_rule
(
db
,
s
,
t
,
c
,
d
,
AVTAB_MEMBER
);
}
int
sepolicy
::
type_transition
(
const
char
*
src
,
const
char
*
tgt
,
const
char
*
cls
,
const
char
*
def
,
const
char
*
obj
)
{
if
(
obj
)
{
vprint
(
"type_transition %s %s %s %s
\n
"
,
src
,
tgt
,
cls
,
def
);
return
add_type_rule
(
db
,
src
,
tgt
,
cls
,
def
,
AVTAB_TRANSITION
);
}
else
{
vprint
(
"type_transition %s %s %s %s %s
\n
"
,
src
,
tgt
,
cls
,
def
,
obj
);
return
add_filename_trans
(
db
,
src
,
tgt
,
cls
,
def
,
obj
);
}
}
int
sepolicy
::
permissive
(
const
char
*
s
)
{
vprint
(
"permissive %s
\n
"
,
s
);
return
set_domain_state
(
db
,
s
,
1
);
}
int
sepolicy
::
enforce
(
const
char
*
s
)
{
vprint
(
"enforce %s
\n
"
,
s
);
return
set_domain_state
(
db
,
s
,
0
);
}
int
sepolicy
::
create
(
const
char
*
s
)
{
vprint
(
"create %s
\n
"
,
s
);
return
create_domain
(
db
,
s
);
}
int
sepolicy
::
typeattribute
(
const
char
*
type
,
const
char
*
attr
)
{
vprint
(
"typeattribute %s %s
\n
"
,
type
,
attr
);
return
add_typeattribute
(
db
,
type
,
attr
);
}
int
sepolicy
::
genfscon
(
const
char
*
fs_name
,
const
char
*
path
,
const
char
*
ctx
)
{
vprint
(
"genfscon %s %s %s
\n
"
,
fs_name
,
path
,
ctx
);
return
add_genfscon
(
db
,
fs_name
,
path
,
ctx
);
}
int
sepolicy
::
exists
(
const
char
*
source
)
{
return
hashtab_search
(
db
->
p_types
.
table
,
source
)
!=
nullptr
;
}
native/jni/magiskpolicy/magiskpolicy.cpp
View file @
f392ade7
...
...
@@ -6,7 +6,7 @@
#include <flags.h>
#include <magiskpolicy.hpp>
#include "sepolicy.h"
#include "sepolicy.h
pp
"
using
namespace
std
::
literals
;
...
...
native/jni/magiskpolicy/policydb.cpp
View file @
f392ade7
...
...
@@ -10,7 +10,7 @@
#include <stream.hpp>
#include <magiskpolicy.hpp>
#include "sepolicy.h"
#include "sepolicy.h
pp
"
#define SHALEN 64
static
bool
cmp_sha256
(
const
char
*
a
,
const
char
*
b
)
{
...
...
native/jni/magiskpolicy/rules.cpp
View file @
f392ade7
#include <initializer_list>
#include <logging.hpp>
#include <flags.h>
#include <magiskpolicy.hpp>
#include "sepolicy.h"
#include "sepolicy.h
pp
"
void
sepol
icy
::
allow_su_client
(
const
char
*
type
)
{
void
sepol
_impl
::
allow_su_client
(
const
char
*
type
)
{
if
(
!
exists
(
type
))
return
;
allow
(
type
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"connectto"
);
...
...
@@ -78,16 +80,11 @@ void sepolicy::magisk_rules() {
allow
(
SEPOL_PROC_DOMAIN
,
"kernel"
,
"security"
,
"load_policy"
);
// Allow these processes to access MagiskSU
allow_su_client
(
"init"
);
allow_su_client
(
"shell"
);
allow_su_client
(
"system_app"
);
allow_su_client
(
"priv_app"
);
allow_su_client
(
"platform_app"
);
allow_su_client
(
"untrusted_app"
);
allow_su_client
(
"untrusted_app_25"
);
allow_su_client
(
"untrusted_app_27"
);
allow_su_client
(
"untrusted_app_29"
);
allow_su_client
(
"update_engine"
);
std
::
initializer_list
<
const
char
*>
clients
{
"init"
,
"shell"
,
"system_app"
,
"priv_app"
,
"platform_app"
,
"untrusted_app"
,
"untrusted_app_25"
,
"untrusted_app_27"
,
"untrusted_app_29"
,
"update_engine"
};
for
(
auto
type
:
clients
)
impl
->
allow_su_client
(
type
);
// suRights
allow
(
"servicemanager"
,
SEPOL_PROC_DOMAIN
,
"dir"
,
"search"
);
...
...
@@ -199,7 +196,7 @@ void sepolicy::magisk_rules() {
#if 0
// Remove all dontaudit in debug mode
strip_dontaudit(db
);
impl->strip_dontaudit(
);
#endif
log_cb
.
w
=
bak
;
...
...
native/jni/magiskpolicy/sepolicy.c
→
native/jni/magiskpolicy/sepolicy.c
pp
View file @
f392ade7
This diff is collapsed.
Click to expand it.
native/jni/magiskpolicy/sepolicy.h
deleted
100644 → 0
View file @
0236ab88
#pragma once
#include <sepol/policydb/policydb.h>
__BEGIN_DECLS
// Internal C APIs, do not use directly
int
create_domain
(
policydb_t
*
db
,
const
char
*
d
);
int
set_domain_state
(
policydb_t
*
db
,
const
char
*
s
,
int
state
);
int
add_typeattribute
(
policydb_t
*
db
,
const
char
*
type
,
const
char
*
attr
);
int
add_rule
(
policydb_t
*
db
,
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
,
int
effect
,
int
n
);
int
add_xperm_rule
(
policydb_t
*
db
,
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
,
int
effect
,
int
n
);
int
add_type_rule
(
policydb_t
*
db
,
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
int
effect
);
int
add_filename_trans
(
policydb_t
*
db
,
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
);
int
add_genfscon
(
policydb_t
*
db
,
const
char
*
name
,
const
char
*
path
,
const
char
*
context
);
void
strip_dontaudit
(
policydb_t
*
db
);
void
statement_help
();
__END_DECLS
native/jni/magiskpolicy/sepolicy.hpp
0 → 100644
View file @
f392ade7
#pragma once
#include <sepol/policydb/policydb.h>
#include <magiskpolicy.hpp>
// Internal APIs, do not use directly
struct
sepol_impl
:
public
sepolicy
{
int
set_attr
(
const
char
*
attr_name
,
int
type_val
);
void
check_avtab_node
(
avtab_ptr_t
node
);
avtab_ptr_t
get_avtab_node
(
avtab_key_t
*
key
,
avtab_extended_perms_t
*
xperms
);
int
add_avrule
(
avtab_key_t
*
key
,
int
val
,
bool
n
);
int
add_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
,
int
effect
,
bool
n
);
int
add_rule
(
type_datum_t
*
src
,
type_datum_t
*
tgt
,
class_datum_t
*
cls
,
perm_datum_t
*
perm
,
int
effect
,
bool
n
);
int
add_avxrule
(
avtab_key_t
*
key
,
uint16_t
low
,
uint16_t
high
,
bool
n
);
int
add_xperm_rule
(
type_datum_t
*
src
,
type_datum_t
*
tgt
,
class_datum_t
*
cls
,
uint16_t
low
,
uint16_t
high
,
int
effect
,
bool
n
);
int
add_xperm_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
,
int
effect
,
bool
n
);
int
create_domain
(
const
char
*
type_name
);
int
set_domain_state
(
const
char
*
s
,
bool
permissive
);
int
add_filename_trans
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
);
int
add_typeattribute
(
const
char
*
type
,
const
char
*
attr
);
int
add_type_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
int
effect
);
int
add_genfscon
(
const
char
*
fs_name
,
const
char
*
path
,
const
char
*
context
);
void
strip_dontaudit
();
void
allow_su_client
(
const
char
*
type
);
};
#define impl static_cast<sepol_impl *>(this)
void
statement_help
();
native/jni/magiskpolicy/statement.cpp
View file @
f392ade7
...
...
@@ -6,7 +6,7 @@
#include <logging.hpp>
#include <utils.hpp>
#include "sepolicy.h"
#include "sepolicy.h
pp
"
using
namespace
std
;
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment