Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
M
Magisk
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
Magisk
Commits
f392ade7
Commit
f392ade7
authored
May 23, 2020
by
topjohnwu
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Rewrite sepolicy.c in C++
parent
0236ab88
Show whitespace changes
Inline
Side-by-side
Showing
10 changed files
with
714 additions
and
138 deletions
+714
-138
Android.mk
native/jni/Android.mk
+3
-5
magiskpolicy.hpp
native/jni/include/magiskpolicy.hpp
+2
-3
api.cpp
native/jni/magiskpolicy/api.cpp
+0
-90
magiskpolicy.cpp
native/jni/magiskpolicy/magiskpolicy.cpp
+1
-1
policydb.cpp
native/jni/magiskpolicy/policydb.cpp
+1
-1
rules.cpp
native/jni/magiskpolicy/rules.cpp
+10
-13
sepolicy.cpp
native/jni/magiskpolicy/sepolicy.cpp
+666
-0
sepolicy.h
native/jni/magiskpolicy/sepolicy.h
+0
-24
sepolicy.hpp
native/jni/magiskpolicy/sepolicy.hpp
+30
-0
statement.cpp
native/jni/magiskpolicy/statement.cpp
+1
-1
No files found.
native/jni/Android.mk
View file @
f392ade7
...
@@ -63,12 +63,11 @@ LOCAL_SRC_FILES := \
...
@@ -63,12 +63,11 @@ LOCAL_SRC_FILES := \
init/getinfo.cpp \
init/getinfo.cpp \
init/twostage.cpp \
init/twostage.cpp \
core/socket.cpp \
core/socket.cpp \
magiskpolicy/
api
.cpp \
magiskpolicy/
sepolicy
.cpp \
magiskpolicy/magiskpolicy.cpp \
magiskpolicy/magiskpolicy.cpp \
magiskpolicy/rules.cpp \
magiskpolicy/rules.cpp \
magiskpolicy/policydb.cpp \
magiskpolicy/policydb.cpp \
magiskpolicy/statement.cpp \
magiskpolicy/statement.cpp \
magiskpolicy/sepolicy.c \
magiskboot/pattern.cpp
magiskboot/pattern.cpp
LOCAL_LDFLAGS := -static
LOCAL_LDFLAGS := -static
...
@@ -108,12 +107,11 @@ LOCAL_C_INCLUDES := jni/include
...
@@ -108,12 +107,11 @@ LOCAL_C_INCLUDES := jni/include
LOCAL_SRC_FILES := \
LOCAL_SRC_FILES := \
core/applet_stub.cpp \
core/applet_stub.cpp \
magiskpolicy/
api
.cpp \
magiskpolicy/
sepolicy
.cpp \
magiskpolicy/magiskpolicy.cpp \
magiskpolicy/magiskpolicy.cpp \
magiskpolicy/rules.cpp \
magiskpolicy/rules.cpp \
magiskpolicy/policydb.cpp \
magiskpolicy/policydb.cpp \
magiskpolicy/statement.cpp \
magiskpolicy/statement.cpp
magiskpolicy/sepolicy.c
LOCAL_CFLAGS := -DAPPLET_STUB_MAIN=magiskpolicy_main
LOCAL_CFLAGS := -DAPPLET_STUB_MAIN=magiskpolicy_main
LOCAL_LDFLAGS := -static
LOCAL_LDFLAGS := -static
...
...
native/jni/include/magiskpolicy.hpp
View file @
f392ade7
...
@@ -41,7 +41,7 @@ public:
...
@@ -41,7 +41,7 @@ public:
int
dontauditxperm
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
range
);
int
dontauditxperm
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
range
);
// Type rules
// Type rules
int
type_transition
(
c_str
s
rc
,
c_str
tgt
,
c_str
cls
,
c_str
def
,
c_str
obj
=
nullptr
);
int
type_transition
(
c_str
s
,
c_str
t
,
c_str
c
,
c_str
d
,
c_str
o
=
nullptr
);
int
type_change
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
def
);
int
type_change
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
def
);
int
type_member
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
def
);
int
type_member
(
c_str
src
,
c_str
tgt
,
c_str
cls
,
c_str
def
);
...
@@ -50,8 +50,7 @@ public:
...
@@ -50,8 +50,7 @@ public:
// Magisk
// Magisk
void
magisk_rules
();
void
magisk_rules
();
void
allow_su_client
(
c_str
type
);
pr
ivate
:
pr
otected
:
policydb
*
db
;
policydb
*
db
;
};
};
native/jni/magiskpolicy/api.cpp
deleted
100644 → 0
View file @
0236ab88
#include <magiskpolicy.hpp>
#include "sepolicy.h"
//#define vprint(fmt, ...) printf(fmt, __VA_ARGS__)
#define vprint(...)
int
sepolicy
::
allow
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
vprint
(
"allow %s %s %s %s
\n
"
,
s
,
t
,
c
,
p
);
return
add_rule
(
db
,
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
0
);
}
int
sepolicy
::
deny
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
vprint
(
"deny %s %s %s %s
\n
"
,
s
,
t
,
c
,
p
);
return
add_rule
(
db
,
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
1
);
}
int
sepolicy
::
auditallow
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
vprint
(
"auditallow %s %s %s %s
\n
"
,
s
,
t
,
c
,
p
);
return
add_rule
(
db
,
s
,
t
,
c
,
p
,
AVTAB_AUDITALLOW
,
0
);
}
int
sepolicy
::
dontaudit
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
vprint
(
"dontaudit %s %s %s %s
\n
"
,
s
,
t
,
c
,
p
);
return
add_rule
(
db
,
s
,
t
,
c
,
p
,
AVTAB_AUDITDENY
,
1
);
}
int
sepolicy
::
allowxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
vprint
(
"allowxperm %s %s %s %s
\n
"
,
s
,
t
,
c
,
range
);
return
add_xperm_rule
(
db
,
s
,
t
,
c
,
range
,
AVTAB_XPERMS_ALLOWED
,
0
);
}
int
sepolicy
::
auditallowxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
vprint
(
"auditallowxperm %s %s %s %s
\n
"
,
s
,
t
,
c
,
range
);
return
add_xperm_rule
(
db
,
s
,
t
,
c
,
range
,
AVTAB_XPERMS_AUDITALLOW
,
0
);
}
int
sepolicy
::
dontauditxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
vprint
(
"dontauditxperm %s %s %s %s
\n
"
,
s
,
t
,
c
,
range
);
return
add_xperm_rule
(
db
,
s
,
t
,
c
,
range
,
AVTAB_XPERMS_DONTAUDIT
,
0
);
}
int
sepolicy
::
type_change
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
vprint
(
"type_change %s %s %s %s
\n
"
,
s
,
t
,
c
,
d
);
return
add_type_rule
(
db
,
s
,
t
,
c
,
d
,
AVTAB_CHANGE
);
}
int
sepolicy
::
type_member
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
vprint
(
"type_member %s %s %s %s
\n
"
,
s
,
t
,
c
,
d
);
return
add_type_rule
(
db
,
s
,
t
,
c
,
d
,
AVTAB_MEMBER
);
}
int
sepolicy
::
type_transition
(
const
char
*
src
,
const
char
*
tgt
,
const
char
*
cls
,
const
char
*
def
,
const
char
*
obj
)
{
if
(
obj
)
{
vprint
(
"type_transition %s %s %s %s
\n
"
,
src
,
tgt
,
cls
,
def
);
return
add_type_rule
(
db
,
src
,
tgt
,
cls
,
def
,
AVTAB_TRANSITION
);
}
else
{
vprint
(
"type_transition %s %s %s %s %s
\n
"
,
src
,
tgt
,
cls
,
def
,
obj
);
return
add_filename_trans
(
db
,
src
,
tgt
,
cls
,
def
,
obj
);
}
}
int
sepolicy
::
permissive
(
const
char
*
s
)
{
vprint
(
"permissive %s
\n
"
,
s
);
return
set_domain_state
(
db
,
s
,
1
);
}
int
sepolicy
::
enforce
(
const
char
*
s
)
{
vprint
(
"enforce %s
\n
"
,
s
);
return
set_domain_state
(
db
,
s
,
0
);
}
int
sepolicy
::
create
(
const
char
*
s
)
{
vprint
(
"create %s
\n
"
,
s
);
return
create_domain
(
db
,
s
);
}
int
sepolicy
::
typeattribute
(
const
char
*
type
,
const
char
*
attr
)
{
vprint
(
"typeattribute %s %s
\n
"
,
type
,
attr
);
return
add_typeattribute
(
db
,
type
,
attr
);
}
int
sepolicy
::
genfscon
(
const
char
*
fs_name
,
const
char
*
path
,
const
char
*
ctx
)
{
vprint
(
"genfscon %s %s %s
\n
"
,
fs_name
,
path
,
ctx
);
return
add_genfscon
(
db
,
fs_name
,
path
,
ctx
);
}
int
sepolicy
::
exists
(
const
char
*
source
)
{
return
hashtab_search
(
db
->
p_types
.
table
,
source
)
!=
nullptr
;
}
native/jni/magiskpolicy/magiskpolicy.cpp
View file @
f392ade7
...
@@ -6,7 +6,7 @@
...
@@ -6,7 +6,7 @@
#include <flags.h>
#include <flags.h>
#include <magiskpolicy.hpp>
#include <magiskpolicy.hpp>
#include "sepolicy.h"
#include "sepolicy.h
pp
"
using
namespace
std
::
literals
;
using
namespace
std
::
literals
;
...
...
native/jni/magiskpolicy/policydb.cpp
View file @
f392ade7
...
@@ -10,7 +10,7 @@
...
@@ -10,7 +10,7 @@
#include <stream.hpp>
#include <stream.hpp>
#include <magiskpolicy.hpp>
#include <magiskpolicy.hpp>
#include "sepolicy.h"
#include "sepolicy.h
pp
"
#define SHALEN 64
#define SHALEN 64
static
bool
cmp_sha256
(
const
char
*
a
,
const
char
*
b
)
{
static
bool
cmp_sha256
(
const
char
*
a
,
const
char
*
b
)
{
...
...
native/jni/magiskpolicy/rules.cpp
View file @
f392ade7
#include <initializer_list>
#include <logging.hpp>
#include <logging.hpp>
#include <flags.h>
#include <flags.h>
#include <magiskpolicy.hpp>
#include <magiskpolicy.hpp>
#include "sepolicy.h"
#include "sepolicy.h
pp
"
void
sepol
icy
::
allow_su_client
(
const
char
*
type
)
{
void
sepol
_impl
::
allow_su_client
(
const
char
*
type
)
{
if
(
!
exists
(
type
))
if
(
!
exists
(
type
))
return
;
return
;
allow
(
type
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"connectto"
);
allow
(
type
,
SEPOL_PROC_DOMAIN
,
"unix_stream_socket"
,
"connectto"
);
...
@@ -78,16 +80,11 @@ void sepolicy::magisk_rules() {
...
@@ -78,16 +80,11 @@ void sepolicy::magisk_rules() {
allow
(
SEPOL_PROC_DOMAIN
,
"kernel"
,
"security"
,
"load_policy"
);
allow
(
SEPOL_PROC_DOMAIN
,
"kernel"
,
"security"
,
"load_policy"
);
// Allow these processes to access MagiskSU
// Allow these processes to access MagiskSU
allow_su_client
(
"init"
);
std
::
initializer_list
<
const
char
*>
clients
{
allow_su_client
(
"shell"
);
"init"
,
"shell"
,
"system_app"
,
"priv_app"
,
"platform_app"
,
"untrusted_app"
,
allow_su_client
(
"system_app"
);
"untrusted_app_25"
,
"untrusted_app_27"
,
"untrusted_app_29"
,
"update_engine"
};
allow_su_client
(
"priv_app"
);
for
(
auto
type
:
clients
)
allow_su_client
(
"platform_app"
);
impl
->
allow_su_client
(
type
);
allow_su_client
(
"untrusted_app"
);
allow_su_client
(
"untrusted_app_25"
);
allow_su_client
(
"untrusted_app_27"
);
allow_su_client
(
"untrusted_app_29"
);
allow_su_client
(
"update_engine"
);
// suRights
// suRights
allow
(
"servicemanager"
,
SEPOL_PROC_DOMAIN
,
"dir"
,
"search"
);
allow
(
"servicemanager"
,
SEPOL_PROC_DOMAIN
,
"dir"
,
"search"
);
...
@@ -199,7 +196,7 @@ void sepolicy::magisk_rules() {
...
@@ -199,7 +196,7 @@ void sepolicy::magisk_rules() {
#if 0
#if 0
// Remove all dontaudit in debug mode
// Remove all dontaudit in debug mode
strip_dontaudit(db
);
impl->strip_dontaudit(
);
#endif
#endif
log_cb
.
w
=
bak
;
log_cb
.
w
=
bak
;
...
...
native/jni/magiskpolicy/sepolicy.c
→
native/jni/magiskpolicy/sepolicy.c
pp
View file @
f392ade7
#include <stdlib.h>
#include <sepol/policydb/policydb.h>
#include <sepol/policydb/expand.h>
#include <magiskpolicy.hpp>
#include <logging.hpp>
#include <logging.hpp>
#include <utils.hpp>
#include "sepolicy.hpp"
#if 0
// Print out all rules going through public API for debugging
template <typename ...Args>
static void dprint(const char *action, Args ...args) {
std::string s(action);
for (int i = 0; i < sizeof...(args); ++i) s += " %s";
s += "\n";
LOGD(s.data(), (args ? args : "*")...);
}
#else
#define dprint(...)
#endif
template
<
typename
T
>
struct
auto_cast_wrapper
{
auto_cast_wrapper
(
T
*
ptr
)
:
ptr
(
ptr
)
{}
template
<
typename
U
>
operator
U
*
()
const
{
return
static_cast
<
U
*>
(
ptr
);
}
private
:
T
*
ptr
;
};
template
<
typename
T
>
static
auto_cast_wrapper
<
T
>
auto_cast
(
T
*
p
)
{
return
auto_cast_wrapper
<
T
>
(
p
);
}
static
auto
hashtab_find
(
hashtab_t
h
,
const_hashtab_key_t
key
)
{
return
auto_cast
(
hashtab_search
(
h
,
key
));
}
template
<
class
Node
,
class
Func
>
static
void
hash_for_each
(
Node
**
node_ptr
,
int
n_slot
,
const
Func
&
fn
)
{
for
(
int
i
=
0
;
i
<
n_slot
;
++
i
)
{
for
(
Node
*
cur
=
node_ptr
[
i
];
cur
;
cur
=
cur
->
next
)
{
fn
(
cur
);
}
}
}
#include "sepolicy.h"
#define hashtab_for_each(hashtab, fn) \
hash_for_each((hashtab)->htable, (hashtab)->size, fn)
extern
void
*
xmalloc
(
size_t
size
);
#define avtab_for_each(avtab, fn) \
extern
void
*
xcalloc
(
size_t
nmemb
,
size_t
size
);
hash_for_each((avtab)->htable, (avtab)->nslot, fn)
extern
void
*
xrealloc
(
void
*
ptr
,
size_t
size
);
//
Internal libsepo
l APIs
//
libsepol interna
l APIs
extern
int
policydb_index_decls
(
sepol_handle_t
*
handle
,
policydb_t
*
p
);
extern
"C"
int
policydb_index_decls
(
sepol_handle_t
*
handle
,
policydb_t
*
p
);
extern
int
context_from_string
(
extern
"C"
int
context_from_string
(
sepol_handle_t
*
handle
,
sepol_handle_t
*
handle
,
const
policydb_t
*
policydb
,
const
policydb_t
*
policydb
,
context_struct_t
**
cptr
,
context_struct_t
**
cptr
,
const
char
*
con_str
,
size_t
con_str_len
);
const
char
*
con_str
,
size_t
con_str_len
);
extern
"C"
int
type_set_expand
(
type_set_t
*
set
,
ebitmap_t
*
t
,
policydb_t
*
p
,
unsigned
char
alwaysexpand
);
// Generic hash table traversal
int
sepol_impl
::
set_attr
(
const
char
*
attr_name
,
int
type_val
)
{
#define hash_for_each(node_ptr, n_slots, table, block) \
type_datum_t
*
attr
=
hashtab_find
(
db
->
p_types
.
table
,
attr_name
);
for (int __i = 0; __i < (table)->n_slots; ++__i) { \
__typeof__(*(table)->node_ptr) node; \
__typeof__(node) __next; \
for (node = (table)->node_ptr[__i]; node; node = __next) { \
__next = node->next; \
block \
} \
}
// hashtab traversal
#define hashtab_for_each(hashtab, block) \
hash_for_each(htable, size, hashtab, block)
// avtab traversal
#define avtab_for_each(avtab, block) \
hash_for_each(htable, nslot, avtab, block)
static
int
set_attr
(
policydb_t
*
db
,
const
char
*
type
,
int
value
)
{
type_datum_t
*
attr
=
hashtab_search
(
db
->
p_types
.
table
,
type
);
if
(
!
attr
||
attr
->
flavor
!=
TYPE_ATTRIB
)
if
(
!
attr
||
attr
->
flavor
!=
TYPE_ATTRIB
)
return
-
1
;
return
-
1
;
if
(
ebitmap_set_bit
(
&
db
->
type_attr_map
[
value
-
1
],
attr
->
s
.
value
-
1
,
1
))
if
(
ebitmap_set_bit
(
&
db
->
type_attr_map
[
type_val
-
1
],
attr
->
s
.
value
-
1
,
1
))
return
-
1
;
return
-
1
;
if
(
ebitmap_set_bit
(
&
db
->
attr_type_map
[
attr
->
s
.
value
-
1
],
value
-
1
,
1
))
if
(
ebitmap_set_bit
(
&
db
->
attr_type_map
[
attr
->
s
.
value
-
1
],
type_val
-
1
,
1
))
return
-
1
;
return
-
1
;
return
attr
->
s
.
value
;
return
attr
->
s
.
value
;
}
}
static
void
check_avtab_node
(
policydb_t
*
db
,
avtab_ptr_t
node
)
{
void
sepol_impl
::
check_avtab_node
(
avtab_ptr_t
node
)
{
int
redundant
=
0
;
bool
redundant
;
if
(
node
->
key
.
specified
==
AVTAB_AUDITDENY
)
if
(
node
->
key
.
specified
==
AVTAB_AUDITDENY
)
redundant
=
node
->
datum
.
data
==
~
0U
;
redundant
=
node
->
datum
.
data
==
~
0U
;
else
if
(
node
->
key
.
specified
&
AVTAB_XPERMS
)
else
if
(
node
->
key
.
specified
&
AVTAB_XPERMS
)
redundant
=
node
->
datum
.
xperms
==
NULL
;
redundant
=
node
->
datum
.
xperms
==
nullptr
;
else
else
redundant
=
node
->
datum
.
data
==
0U
;
redundant
=
node
->
datum
.
data
==
0U
;
if
(
redundant
)
if
(
redundant
)
avtab_remove_node
(
&
db
->
te_avtab
,
node
);
avtab_remove_node
(
&
db
->
te_avtab
,
node
);
}
}
static
avtab_ptr_t
get_avtab_node
(
policydb_t
*
db
,
avtab_key_t
*
key
,
avtab_extended_perms_t
*
xperms
)
{
avtab_ptr_t
sepol_impl
::
get_avtab_node
(
avtab_key_t
*
key
,
avtab_extended_perms_t
*
xperms
)
{
avtab_ptr_t
node
;
avtab_ptr_t
node
;
avtab_datum_t
avdatum
;
int
match
=
0
;
/* AVTAB_XPERMS entries are not necessarily unique */
/* AVTAB_XPERMS entries are not necessarily unique */
if
(
key
->
specified
&
AVTAB_XPERMS
)
{
if
(
key
->
specified
&
AVTAB_XPERMS
)
{
bool
match
=
false
;
node
=
avtab_search_node
(
&
db
->
te_avtab
,
key
);
node
=
avtab_search_node
(
&
db
->
te_avtab
,
key
);
while
(
node
)
{
while
(
node
)
{
if
((
node
->
datum
.
xperms
->
specified
==
xperms
->
specified
)
&&
if
((
node
->
datum
.
xperms
->
specified
==
xperms
->
specified
)
&&
(
node
->
datum
.
xperms
->
driver
==
xperms
->
driver
))
{
(
node
->
datum
.
xperms
->
driver
==
xperms
->
driver
))
{
match
=
1
;
match
=
true
;
break
;
break
;
}
}
node
=
avtab_search_node_next
(
node
,
key
->
specified
);
node
=
avtab_search_node_next
(
node
,
key
->
specified
);
}
}
if
(
!
match
)
if
(
!
match
)
node
=
NULL
;
node
=
nullptr
;
}
else
{
}
else
{
node
=
avtab_search_node
(
&
db
->
te_avtab
,
key
);
node
=
avtab_search_node
(
&
db
->
te_avtab
,
key
);
}
}
if
(
!
node
)
{
if
(
!
node
)
{
memset
(
&
avdatum
,
0
,
sizeof
avdatum
)
;
avtab_datum_t
avdatum
{}
;
/*
/*
* AUDITDENY, aka DONTAUDIT, are &= assigned, versus |= for
* AUDITDENY, aka DONTAUDIT, are &= assigned, versus |= for
* others. Initialize the data accordingly.
* others. Initialize the data accordingly.
...
@@ -97,10 +125,10 @@ static avtab_ptr_t get_avtab_node(policydb_t *db, avtab_key_t *key, avtab_extend
...
@@ -97,10 +125,10 @@ static avtab_ptr_t get_avtab_node(policydb_t *db, avtab_key_t *key, avtab_extend
return
node
;
return
node
;
}
}
static
int
add_avrule
(
policydb_t
*
db
,
avtab_key_t
*
key
,
int
val
,
int
not
)
{
int
sepol_impl
::
add_avrule
(
avtab_key_t
*
key
,
int
val
,
bool
n
)
{
avtab_ptr_t
node
=
get_avtab_node
(
NULL
,
key
,
NULL
);
avtab_ptr_t
node
=
get_avtab_node
(
key
,
nullptr
);
if
(
n
ot
)
{
if
(
n
)
{
if
(
val
<
0
)
if
(
val
<
0
)
node
->
datum
.
data
=
0U
;
node
->
datum
.
data
=
0U
;
else
else
...
@@ -112,44 +140,91 @@ static int add_avrule(policydb_t *db, avtab_key_t *key, int val, int not) {
...
@@ -112,44 +140,91 @@ static int add_avrule(policydb_t *db, avtab_key_t *key, int val, int not) {
node
->
datum
.
data
|=
1U
<<
(
val
-
1
);
node
->
datum
.
data
|=
1U
<<
(
val
-
1
);
}
}
check_avtab_node
(
db
,
node
);
check_avtab_node
(
node
);
return
0
;
return
0
;
}
}
static
int
add_rule_auto
(
policydb_t
*
db
,
type_datum_t
*
src
,
type_datum_t
*
tgt
,
class_datum_t
*
cls
,
int
sepol_impl
::
add_rule
(
type_datum_t
*
src
,
type_datum_t
*
tgt
,
class_datum_t
*
cls
,
perm_datum_t
*
perm
,
int
effect
,
bool
n
)
{
perm_datum_t
*
perm
,
int
effect
,
int
not
)
{
avtab_key_t
key
;
int
ret
=
0
;
int
ret
=
0
;
if
(
src
==
NULL
)
{
if
(
src
==
nullptr
)
{
hashtab_for_each
(
db
->
p_types
.
table
,
{
hashtab_for_each
(
db
->
p_types
.
table
,
[
&
](
hashtab_ptr_t
node
)
{
src
=
node
->
datum
;
src
=
auto_cast
(
node
->
datum
)
;
ret
|=
add_rule
_auto
(
db
,
src
,
tgt
,
cls
,
perm
,
effect
,
not
);
ret
|=
add_rule
(
src
,
tgt
,
cls
,
perm
,
effect
,
n
);
})
})
;
}
else
if
(
tgt
==
NULL
)
{
}
else
if
(
tgt
==
nullptr
)
{
hashtab_for_each
(
db
->
p_types
.
table
,
{
hashtab_for_each
(
db
->
p_types
.
table
,
[
&
](
hashtab_ptr_t
node
)
{
tgt
=
node
->
datum
;
tgt
=
auto_cast
(
node
->
datum
)
;
ret
|=
add_rule
_auto
(
db
,
src
,
tgt
,
cls
,
perm
,
effect
,
not
);
ret
|=
add_rule
(
src
,
tgt
,
cls
,
perm
,
effect
,
n
);
})
})
;
}
else
if
(
cls
==
NULL
)
{
}
else
if
(
cls
==
nullptr
)
{
hashtab_for_each
(
db
->
p_classes
.
table
,
{
hashtab_for_each
(
db
->
p_classes
.
table
,
[
&
](
hashtab_ptr_t
node
)
{
cls
=
node
->
datum
;
cls
=
auto_cast
(
node
->
datum
)
;
ret
|=
add_rule
_auto
(
db
,
src
,
tgt
,
cls
,
perm
,
effect
,
not
);
ret
|=
add_rule
(
src
,
tgt
,
cls
,
perm
,
effect
,
n
);
})
})
;
}
else
{
}
else
{
avtab_key_t
key
;
key
.
source_type
=
src
->
s
.
value
;
key
.
source_type
=
src
->
s
.
value
;
key
.
target_type
=
tgt
->
s
.
value
;
key
.
target_type
=
tgt
->
s
.
value
;
key
.
target_class
=
cls
->
s
.
value
;
key
.
target_class
=
cls
->
s
.
value
;
key
.
specified
=
effect
;
key
.
specified
=
effect
;
return
add_avrule
(
db
,
&
key
,
perm
?
perm
->
s
.
value
:
-
1
,
not
);
return
add_avrule
(
&
key
,
perm
?
perm
->
s
.
value
:
-
1
,
n
);
}
}
return
ret
;
return
ret
;
}
}
int
sepol_impl
::
add_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
,
int
effect
,
bool
n
)
{
type_datum_t
*
src
=
nullptr
,
*
tgt
=
nullptr
;
class_datum_t
*
cls
=
nullptr
;
perm_datum_t
*
perm
=
nullptr
;
if
(
s
)
{
src
=
hashtab_find
(
db
->
p_types
.
table
,
s
);
if
(
src
==
nullptr
)
{
LOGW
(
"source type %s does not exist
\n
"
,
s
);
return
1
;
}
}
if
(
t
)
{
tgt
=
hashtab_find
(
db
->
p_types
.
table
,
t
);
if
(
tgt
==
nullptr
)
{
LOGW
(
"target type %s does not exist
\n
"
,
t
);
return
1
;
}
}
if
(
c
)
{
cls
=
hashtab_find
(
db
->
p_classes
.
table
,
c
);
if
(
cls
==
nullptr
)
{
LOGW
(
"class %s does not exist
\n
"
,
c
);
return
1
;
}
}
if
(
p
)
{
if
(
c
==
nullptr
)
{
LOGW
(
"No class is specified, cannot add perm [%s]
\n
"
,
p
);
return
1
;
}
perm
=
hashtab_find
(
cls
->
permissions
.
table
,
p
);
if
(
perm
==
nullptr
&&
cls
->
comdatum
!=
nullptr
)
{
perm
=
hashtab_find
(
cls
->
comdatum
->
permissions
.
table
,
p
);
}
if
(
perm
==
nullptr
)
{
LOGW
(
"perm %s does not exist in class %s
\n
"
,
p
,
c
);
return
1
;
}
}
return
add_rule
(
src
,
tgt
,
cls
,
perm
,
effect
,
n
);
}
#define ioctl_driver(x) (x>>8 & 0xFF)
#define ioctl_driver(x) (x>>8 & 0xFF)
#define ioctl_func(x) (x & 0xFF)
#define ioctl_func(x) (x & 0xFF)
static
int
add_avxrule
(
policydb_t
*
db
,
avtab_key_t
*
key
,
uint16_t
low
,
uint16_t
high
,
int
not
)
{
int
sepol_impl
::
add_avxrule
(
avtab_key_t
*
key
,
uint16_t
low
,
uint16_t
high
,
bool
n
)
{
avtab_datum_t
*
datum
;
avtab_datum_t
*
datum
;
avtab_extended_perms_t
xperms
;
avtab_extended_perms_t
xperms
;
...
@@ -164,96 +239,140 @@ static int add_avxrule(policydb_t *db, avtab_key_t *key, uint16_t low, uint16_t
...
@@ -164,96 +239,140 @@ static int add_avxrule(policydb_t *db, avtab_key_t *key, uint16_t low, uint16_t
if
(
xperms
.
specified
==
AVTAB_XPERMS_IOCTLDRIVER
)
{
if
(
xperms
.
specified
==
AVTAB_XPERMS_IOCTLDRIVER
)
{
for
(
int
i
=
ioctl_driver
(
low
);
i
<=
ioctl_driver
(
high
);
++
i
)
{
for
(
int
i
=
ioctl_driver
(
low
);
i
<=
ioctl_driver
(
high
);
++
i
)
{
if
(
n
ot
)
if
(
n
)
xperm_clear
(
i
,
xperms
.
perms
);
xperm_clear
(
i
,
xperms
.
perms
);
else
else
xperm_set
(
i
,
xperms
.
perms
);
xperm_set
(
i
,
xperms
.
perms
);
}
}
}
else
{
}
else
{
for
(
int
i
=
ioctl_func
(
low
);
i
<=
ioctl_func
(
high
);
++
i
)
{
for
(
int
i
=
ioctl_func
(
low
);
i
<=
ioctl_func
(
high
);
++
i
)
{
if
(
n
ot
)
if
(
n
)
xperm_clear
(
i
,
xperms
.
perms
);
xperm_clear
(
i
,
xperms
.
perms
);
else
else
xperm_set
(
i
,
xperms
.
perms
);
xperm_set
(
i
,
xperms
.
perms
);
}
}
}
}
datum
=
&
get_avtab_node
(
db
,
key
,
&
xperms
)
->
datum
;
datum
=
&
get_avtab_node
(
key
,
&
xperms
)
->
datum
;
if
(
datum
->
xperms
==
NULL
)
if
(
datum
->
xperms
==
nullptr
)
datum
->
xperms
=
xmalloc
(
sizeof
(
xperms
));
datum
->
xperms
=
auto_cast
(
xmalloc
(
sizeof
(
xperms
)
));
memcpy
(
datum
->
xperms
,
&
xperms
,
sizeof
(
xperms
));
memcpy
(
datum
->
xperms
,
&
xperms
,
sizeof
(
xperms
));
return
0
;
return
0
;
}
}
static
int
add_xperm_rule_auto
(
policydb_t
*
db
,
type_datum_t
*
src
,
type_datum_t
*
tgt
,
int
sepol_impl
::
add_xperm_rule
(
type_datum_t
*
src
,
type_datum_t
*
tgt
,
class_datum_t
*
cls
,
uint16_t
low
,
uint16_t
high
,
int
effect
,
int
not
)
{
class_datum_t
*
cls
,
uint16_t
low
,
uint16_t
high
,
int
effect
,
bool
n
)
{
avtab_key_t
key
;
int
ret
=
0
;
int
ret
=
0
;
if
(
src
==
nullptr
)
{
if
(
src
==
NULL
)
{
hashtab_for_each
(
db
->
p_types
.
table
,
[
&
](
hashtab_ptr_t
node
)
{
hashtab_for_each
(
db
->
p_types
.
table
,
{
src
=
auto_cast
(
node
->
datum
);
src
=
node
->
datum
;
ret
|=
add_xperm_rule
(
src
,
tgt
,
cls
,
low
,
high
,
effect
,
n
);
ret
|=
add_xperm_rule_auto
(
db
,
src
,
tgt
,
cls
,
low
,
high
,
effect
,
not
);
});
})
}
else
if
(
tgt
==
nullptr
)
{
}
else
if
(
tgt
==
NULL
)
{
hashtab_for_each
(
db
->
p_types
.
table
,
[
&
](
hashtab_ptr_t
node
)
{
hashtab_for_each
(
db
->
p_types
.
table
,
{
tgt
=
auto_cast
(
node
->
datum
);
tgt
=
node
->
datum
;
ret
|=
add_xperm_rule
(
src
,
tgt
,
cls
,
low
,
high
,
effect
,
n
);
ret
|=
add_xperm_rule_auto
(
db
,
src
,
tgt
,
cls
,
low
,
high
,
effect
,
not
);
});
})
}
else
if
(
cls
==
nullptr
)
{
}
else
if
(
cls
==
NULL
)
{
hashtab_for_each
(
db
->
p_classes
.
table
,
[
&
](
hashtab_ptr_t
node
)
{
hashtab_for_each
(
db
->
p_classes
.
table
,
{
tgt
=
auto_cast
(
node
->
datum
);
cls
=
node
->
datum
;
ret
|=
add_xperm_rule
(
src
,
tgt
,
cls
,
low
,
high
,
effect
,
n
);
ret
|=
add_xperm_rule_auto
(
db
,
src
,
tgt
,
cls
,
low
,
high
,
effect
,
not
);
});
})
}
else
{
}
else
{
avtab_key_t
key
;
key
.
source_type
=
src
->
s
.
value
;
key
.
source_type
=
src
->
s
.
value
;
key
.
target_type
=
tgt
->
s
.
value
;
key
.
target_type
=
tgt
->
s
.
value
;
key
.
target_class
=
cls
->
s
.
value
;
key
.
target_class
=
cls
->
s
.
value
;
key
.
specified
=
effect
;
key
.
specified
=
effect
;
return
add_avxrule
(
db
,
&
key
,
low
,
high
,
not
);
return
add_avxrule
(
&
key
,
low
,
high
,
n
);
}
}
return
ret
;
return
ret
;
}
}
int
create_domain
(
policydb_t
*
db
,
const
char
*
d
)
{
int
sepol_impl
::
add_xperm_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
,
int
effect
,
bool
n
)
{
symtab_datum_t
*
src
=
hashtab_search
(
db
->
p_types
.
table
,
d
);
type_datum_t
*
src
=
nullptr
,
*
tgt
=
nullptr
;
class_datum_t
*
cls
=
nullptr
;
if
(
s
)
{
src
=
hashtab_find
(
db
->
p_types
.
table
,
s
);
if
(
src
==
nullptr
)
{
LOGW
(
"source type %s does not exist
\n
"
,
s
);
return
1
;
}
}
if
(
t
)
{
tgt
=
hashtab_find
(
db
->
p_types
.
table
,
t
);
if
(
tgt
==
nullptr
)
{
LOGW
(
"target type %s does not exist
\n
"
,
t
);
return
1
;
}
}
if
(
c
)
{
cls
=
hashtab_find
(
db
->
p_classes
.
table
,
c
);
if
(
cls
==
nullptr
)
{
LOGW
(
"class %s does not exist
\n
"
,
c
);
return
1
;
}
}
uint16_t
low
,
high
;
if
(
range
)
{
if
(
strchr
(
range
,
'-'
)){
sscanf
(
range
,
"%hx-%hx"
,
&
low
,
&
high
);
}
else
{
sscanf
(
range
,
"%hx"
,
&
low
);
high
=
low
;
}
}
else
{
low
=
0
;
high
=
0xFFFF
;
}
return
add_xperm_rule
(
src
,
tgt
,
cls
,
low
,
high
,
effect
,
n
);
}
int
sepol_impl
::
create_domain
(
const
char
*
type_name
)
{
symtab_datum_t
*
src
=
hashtab_find
(
db
->
p_types
.
table
,
type_name
);
if
(
src
)
{
if
(
src
)
{
LOGW
(
"
Domain %s already exists
\n
"
,
d
);
LOGW
(
"
Type %s already exists
\n
"
,
type_name
);
return
0
;
return
0
;
}
}
type_datum_t
*
type
datum
=
xmalloc
(
sizeof
(
type_datum_t
));
type_datum_t
*
type
=
auto_cast
(
xmalloc
(
sizeof
(
type_datum_t
)
));
type_datum_init
(
type
datum
);
type_datum_init
(
type
);
type
datum
->
primary
=
1
;
type
->
primary
=
1
;
type
datum
->
flavor
=
TYPE_TYPE
;
type
->
flavor
=
TYPE_TYPE
;
uint32_t
value
=
0
;
uint32_t
value
=
0
;
symtab_insert
(
db
,
SYM_TYPES
,
strdup
(
d
),
typedatum
,
SCOPE_DECL
,
1
,
&
value
);
symtab_insert
(
db
,
SYM_TYPES
,
strdup
(
type_name
),
type
,
SCOPE_DECL
,
1
,
&
value
);
type
datum
->
s
.
value
=
value
;
type
->
s
.
value
=
value
;
if
(
ebitmap_set_bit
(
&
db
->
global
->
branch_list
->
declared
.
scope
[
SYM_TYPES
],
value
-
1
,
1
))
{
if
(
ebitmap_set_bit
(
&
db
->
global
->
branch_list
->
declared
.
scope
[
SYM_TYPES
],
value
-
1
,
1
))
{
return
1
;
return
1
;
}
}
db
->
type_attr_map
=
xrealloc
(
db
->
type_attr_map
,
sizeof
(
ebitmap_t
)
*
db
->
p_types
.
nprim
);
db
->
type_attr_map
=
auto_cast
(
xrealloc
(
db
->
type_attr_map
,
sizeof
(
ebitmap_t
)
*
db
->
p_types
.
nprim
)
);
db
->
attr_type_map
=
xrealloc
(
db
->
attr_type_map
,
sizeof
(
ebitmap_t
)
*
db
->
p_types
.
nprim
);
db
->
attr_type_map
=
auto_cast
(
xrealloc
(
db
->
attr_type_map
,
sizeof
(
ebitmap_t
)
*
db
->
p_types
.
nprim
)
);
ebitmap_init
(
&
db
->
type_attr_map
[
value
-
1
]);
ebitmap_init
(
&
db
->
type_attr_map
[
value
-
1
]);
ebitmap_init
(
&
db
->
attr_type_map
[
value
-
1
]);
ebitmap_init
(
&
db
->
attr_type_map
[
value
-
1
]);
ebitmap_set_bit
(
&
db
->
type_attr_map
[
value
-
1
],
value
-
1
,
1
);
ebitmap_set_bit
(
&
db
->
type_attr_map
[
value
-
1
],
value
-
1
,
1
);
src
=
hashtab_
search
(
db
->
p_types
.
table
,
d
);
src
=
hashtab_
find
(
db
->
p_types
.
table
,
type_name
);
if
(
!
src
)
if
(
!
src
)
return
1
;
return
1
;
if
(
policydb_index_decls
(
NULL
,
db
))
if
(
policydb_index_decls
(
nullptr
,
db
))
return
1
;
return
1
;
if
(
policydb_index_classes
(
db
))
if
(
policydb_index_classes
(
db
))
return
1
;
return
1
;
if
(
policydb_index_others
(
NULL
,
db
,
0
))
if
(
policydb_index_others
(
nullptr
,
db
,
0
))
return
1
;
return
1
;
// Add the domain to all roles
// Add the domain to all roles
...
@@ -264,56 +383,53 @@ int create_domain(policydb_t *db, const char *d) {
...
@@ -264,56 +383,53 @@ int create_domain(policydb_t *db, const char *d) {
type_set_expand
(
&
db
->
role_val_to_struct
[
i
]
->
types
,
&
db
->
role_val_to_struct
[
i
]
->
cache
,
db
,
0
);
type_set_expand
(
&
db
->
role_val_to_struct
[
i
]
->
types
,
&
db
->
role_val_to_struct
[
i
]
->
cache
,
db
,
0
);
}
}
return
set_attr
(
db
,
"domain"
,
value
);
return
set_attr
(
"domain"
,
value
);
}
}
int
se
t_domain_state
(
policydb_t
*
db
,
const
char
*
s
,
int
stat
e
)
{
int
se
pol_impl
::
set_domain_state
(
const
char
*
s
,
bool
permissiv
e
)
{
type_datum_t
*
type
;
type_datum_t
*
type
;
if
(
s
==
NULL
)
{
if
(
s
==
nullptr
)
{
hashtab_for_each
(
db
->
p_types
.
table
,
{
hashtab_for_each
(
db
->
p_types
.
table
,
[
&
](
hashtab_ptr_t
node
)
{
type
=
node
->
datum
;
type
=
auto_cast
(
node
->
datum
)
;
if
(
ebitmap_set_bit
(
&
db
->
permissive_map
,
type
->
s
.
value
,
state
))
{
if
(
ebitmap_set_bit
(
&
db
->
permissive_map
,
type
->
s
.
value
,
permissive
))
LOGW
(
"Could not set bit in permissive map
\n
"
);
LOGW
(
"Could not set bit in permissive map
\n
"
);
return
1
;
});
}
})
}
else
{
}
else
{
type
=
hashtab_
search
(
db
->
p_types
.
table
,
s
);
type
=
hashtab_
find
(
db
->
p_types
.
table
,
s
);
if
(
type
==
NULL
)
{
if
(
type
==
nullptr
)
{
LOGW
(
"type %s does not exist
\n
"
,
s
);
LOGW
(
"type %s does not exist
\n
"
,
s
);
return
1
;
return
1
;
}
}
if
(
ebitmap_set_bit
(
&
db
->
permissive_map
,
type
->
s
.
value
,
stat
e
))
{
if
(
ebitmap_set_bit
(
&
db
->
permissive_map
,
type
->
s
.
value
,
permissiv
e
))
{
LOGW
(
"Could not set bit in permissive map
\n
"
);
LOGW
(
"Could not set bit in permissive map
\n
"
);
return
1
;
return
1
;
}
}
}
}
return
0
;
return
0
;
}
}
int
add_filename_trans
(
policydb_t
*
db
,
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
int
sepol_impl
::
add_filename_trans
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
)
{
const
char
*
o
)
{
type_datum_t
*
src
,
*
tgt
,
*
def
;
type_datum_t
*
src
,
*
tgt
,
*
def
;
class_datum_t
*
cls
;
class_datum_t
*
cls
;
filename_trans_datum_t
*
trans
;
src
=
hashtab_
search
(
db
->
p_types
.
table
,
s
);
src
=
hashtab_
find
(
db
->
p_types
.
table
,
s
);
if
(
src
==
NULL
)
{
if
(
src
==
nullptr
)
{
LOGW
(
"source type %s does not exist
\n
"
,
s
);
LOGW
(
"source type %s does not exist
\n
"
,
s
);
return
1
;
return
1
;
}
}
tgt
=
hashtab_
search
(
db
->
p_types
.
table
,
t
);
tgt
=
hashtab_
find
(
db
->
p_types
.
table
,
t
);
if
(
tgt
==
NULL
)
{
if
(
tgt
==
nullptr
)
{
LOGW
(
"target type %s does not exist
\n
"
,
t
);
LOGW
(
"target type %s does not exist
\n
"
,
t
);
return
1
;
return
1
;
}
}
cls
=
hashtab_
search
(
db
->
p_classes
.
table
,
c
);
cls
=
hashtab_
find
(
db
->
p_classes
.
table
,
c
);
if
(
cls
==
NULL
)
{
if
(
cls
==
nullptr
)
{
LOGW
(
"class %s does not exist
\n
"
,
c
);
LOGW
(
"class %s does not exist
\n
"
,
c
);
return
1
;
return
1
;
}
}
def
=
hashtab_
search
(
db
->
p_types
.
table
,
d
);
def
=
hashtab_
find
(
db
->
p_types
.
table
,
d
);
if
(
def
==
NULL
)
{
if
(
def
==
nullptr
)
{
LOGW
(
"default type %s does not exist
\n
"
,
d
);
LOGW
(
"default type %s does not exist
\n
"
,
d
);
return
1
;
return
1
;
}
}
...
@@ -324,161 +440,64 @@ int add_filename_trans(policydb_t *db, const char *s, const char *t, const char
...
@@ -324,161 +440,64 @@ int add_filename_trans(policydb_t *db, const char *s, const char *t, const char
trans_key
.
tclass
=
cls
->
s
.
value
;
trans_key
.
tclass
=
cls
->
s
.
value
;
trans_key
.
name
=
(
char
*
)
o
;
trans_key
.
name
=
(
char
*
)
o
;
filename_trans_datum_t
*
trans_datum
;
trans
=
hashtab_find
(
db
->
filename_trans
,
(
hashtab_key_t
)
&
trans_key
);
trans_datum
=
hashtab_search
(
db
->
filename_trans
,
(
hashtab_key_t
)
&
trans_key
);
if
(
trans
_datum
==
NULL
)
{
if
(
trans
==
nullptr
)
{
trans
_datum
=
xcalloc
(
sizeof
(
*
trans_datum
),
1
);
trans
=
auto_cast
(
xcalloc
(
sizeof
(
*
trans
),
1
)
);
hashtab_insert
(
db
->
filename_trans
,
(
hashtab_key_t
)
&
trans_key
,
trans
_datum
);
hashtab_insert
(
db
->
filename_trans
,
(
hashtab_key_t
)
&
trans_key
,
trans
);
}
}
// Overwrite existing
// Overwrite existing
trans
_datum
->
otype
=
def
->
s
.
value
;
trans
->
otype
=
def
->
s
.
value
;
return
0
;
return
0
;
}
}
int
add_typeattribute
(
policydb_t
*
db
,
const
char
*
type
,
const
char
*
attr
)
{
int
sepol_impl
::
add_typeattribute
(
const
char
*
type
,
const
char
*
attr
)
{
type_datum_t
*
domain
=
hashtab_
search
(
db
->
p_types
.
table
,
type
);
type_datum_t
*
domain
=
hashtab_
find
(
db
->
p_types
.
table
,
type
);
if
(
domain
==
NULL
)
{
if
(
domain
==
nullptr
)
{
LOGW
(
"type %s does not exist
\n
"
,
type
);
LOGW
(
"type %s does not exist
\n
"
,
type
);
return
1
;
return
1
;
}
}
int
attr_
id
=
set_attr
(
db
,
attr
,
domain
->
s
.
value
);
int
attr_
val
=
set_attr
(
attr
,
domain
->
s
.
value
);
if
(
attr_
id
<
0
)
if
(
attr_
val
<
0
)
return
1
;
return
1
;
hashtab_for_each
(
db
->
p_classes
.
table
,
{
hashtab_for_each
(
db
->
p_classes
.
table
,
[
&
](
hashtab_ptr_t
node
)
{
class_datum_t
*
cls
=
node
->
datum
;
auto
cls
=
static_cast
<
class_datum_t
*>
(
node
->
datum
)
;
for
(
constraint_node_t
*
n
=
cls
->
constraints
;
n
;
n
=
n
->
next
)
{
for
(
constraint_node_t
*
n
=
cls
->
constraints
;
n
;
n
=
n
->
next
)
{
for
(
constraint_expr_t
*
e
=
n
->
expr
;
e
;
e
=
e
->
next
)
{
for
(
constraint_expr_t
*
e
=
n
->
expr
;
e
;
e
=
e
->
next
)
{
if
(
e
->
expr_type
==
CEXPR_NAMES
&&
if
(
e
->
expr_type
==
CEXPR_NAMES
&&
ebitmap_get_bit
(
&
e
->
type_names
->
types
,
attr_
id
-
1
))
{
ebitmap_get_bit
(
&
e
->
type_names
->
types
,
attr_
val
-
1
))
{
ebitmap_set_bit
(
&
e
->
names
,
domain
->
s
.
value
-
1
,
1
);
ebitmap_set_bit
(
&
e
->
names
,
domain
->
s
.
value
-
1
,
1
);
}
}
}
}
}
}
})
});
return
0
;
return
0
;
}
}
int
add_rule
(
policydb_t
*
db
,
int
sepol_impl
::
add_type_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
int
effect
)
{
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
,
int
effect
,
int
n
)
{
type_datum_t
*
src
=
NULL
,
*
tgt
=
NULL
;
class_datum_t
*
cls
=
NULL
;
perm_datum_t
*
perm
=
NULL
;
if
(
s
)
{
src
=
hashtab_search
(
db
->
p_types
.
table
,
s
);
if
(
src
==
NULL
)
{
LOGW
(
"source type %s does not exist
\n
"
,
s
);
return
1
;
}
}
if
(
t
)
{
tgt
=
hashtab_search
(
db
->
p_types
.
table
,
t
);
if
(
tgt
==
NULL
)
{
LOGW
(
"target type %s does not exist
\n
"
,
t
);
return
1
;
}
}
if
(
c
)
{
cls
=
hashtab_search
(
db
->
p_classes
.
table
,
c
);
if
(
cls
==
NULL
)
{
LOGW
(
"class %s does not exist
\n
"
,
c
);
return
1
;
}
}
if
(
p
)
{
if
(
c
==
NULL
)
{
LOGW
(
"No class is specified, cannot add perm [%s]
\n
"
,
p
);
return
1
;
}
perm
=
hashtab_search
(
cls
->
permissions
.
table
,
p
);
if
(
perm
==
NULL
&&
cls
->
comdatum
!=
NULL
)
{
perm
=
hashtab_search
(
cls
->
comdatum
->
permissions
.
table
,
p
);
}
if
(
perm
==
NULL
)
{
LOGW
(
"perm %s does not exist in class %s
\n
"
,
p
,
c
);
return
1
;
}
}
return
add_rule_auto
(
db
,
src
,
tgt
,
cls
,
perm
,
effect
,
n
);
}
int
add_xperm_rule
(
policydb_t
*
db
,
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
,
int
effect
,
int
n
)
{
type_datum_t
*
src
=
NULL
,
*
tgt
=
NULL
;
class_datum_t
*
cls
=
NULL
;
if
(
s
)
{
src
=
hashtab_search
(
db
->
p_types
.
table
,
s
);
if
(
src
==
NULL
)
{
LOGW
(
"source type %s does not exist
\n
"
,
s
);
return
1
;
}
}
if
(
t
)
{
tgt
=
hashtab_search
(
db
->
p_types
.
table
,
t
);
if
(
tgt
==
NULL
)
{
LOGW
(
"target type %s does not exist
\n
"
,
t
);
return
1
;
}
}
if
(
c
)
{
cls
=
hashtab_search
(
db
->
p_classes
.
table
,
c
);
if
(
cls
==
NULL
)
{
LOGW
(
"class %s does not exist
\n
"
,
c
);
return
1
;
}
}
uint16_t
low
,
high
;
if
(
range
)
{
if
(
strchr
(
range
,
'-'
)){
sscanf
(
range
,
"%hx-%hx"
,
&
low
,
&
high
);
}
else
{
sscanf
(
range
,
"%hx"
,
&
low
);
high
=
low
;
}
}
else
{
low
=
0
;
high
=
0xFFFF
;
}
return
add_xperm_rule_auto
(
db
,
src
,
tgt
,
cls
,
low
,
high
,
effect
,
n
);
}
int
add_type_rule
(
policydb_t
*
db
,
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
int
effect
)
{
type_datum_t
*
src
,
*
tgt
,
*
def
;
type_datum_t
*
src
,
*
tgt
,
*
def
;
class_datum_t
*
cls
;
class_datum_t
*
cls
;
src
=
hashtab_
search
(
db
->
p_types
.
table
,
s
);
src
=
hashtab_
find
(
db
->
p_types
.
table
,
s
);
if
(
src
==
NULL
)
{
if
(
src
==
nullptr
)
{
LOGW
(
"source type %s does not exist
\n
"
,
s
);
LOGW
(
"source type %s does not exist
\n
"
,
s
);
return
1
;
return
1
;
}
}
tgt
=
hashtab_
search
(
db
->
p_types
.
table
,
t
);
tgt
=
hashtab_
find
(
db
->
p_types
.
table
,
t
);
if
(
tgt
==
NULL
)
{
if
(
tgt
==
nullptr
)
{
LOGW
(
"target type %s does not exist
\n
"
,
t
);
LOGW
(
"target type %s does not exist
\n
"
,
t
);
return
1
;
return
1
;
}
}
cls
=
hashtab_
search
(
db
->
p_classes
.
table
,
c
);
cls
=
hashtab_
find
(
db
->
p_classes
.
table
,
c
);
if
(
cls
==
NULL
)
{
if
(
cls
==
nullptr
)
{
LOGW
(
"class %s does not exist
\n
"
,
c
);
LOGW
(
"class %s does not exist
\n
"
,
c
);
return
1
;
return
1
;
}
}
def
=
hashtab_
search
(
db
->
p_types
.
table
,
d
);
def
=
hashtab_
find
(
db
->
p_types
.
table
,
d
);
if
(
def
==
NULL
)
{
if
(
def
==
nullptr
)
{
LOGW
(
"default type %s does not exist
\n
"
,
d
);
LOGW
(
"default type %s does not exist
\n
"
,
d
);
return
1
;
return
1
;
}
}
...
@@ -489,39 +508,39 @@ int add_type_rule(policydb_t *db,
...
@@ -489,39 +508,39 @@ int add_type_rule(policydb_t *db,
key
.
target_class
=
cls
->
s
.
value
;
key
.
target_class
=
cls
->
s
.
value
;
key
.
specified
=
effect
;
key
.
specified
=
effect
;
avtab_ptr_t
node
=
get_avtab_node
(
db
,
&
key
,
NULL
);
avtab_ptr_t
node
=
get_avtab_node
(
&
key
,
nullptr
);
node
->
datum
.
data
=
def
->
s
.
value
;
node
->
datum
.
data
=
def
->
s
.
value
;
return
0
;
return
0
;
}
}
int
add_genfscon
(
policydb_t
*
db
,
const
char
*
name
,
const
char
*
path
,
const
char
*
context
)
{
int
sepol_impl
::
add_genfscon
(
const
char
*
fs_
name
,
const
char
*
path
,
const
char
*
context
)
{
// First try to create context
// First try to create context
context_struct_t
*
ctx
;
context_struct_t
*
ctx
;
if
(
context_from_string
(
NULL
,
db
,
&
ctx
,
context
,
strlen
(
context
)))
{
if
(
context_from_string
(
nullptr
,
db
,
&
ctx
,
context
,
strlen
(
context
)))
{
LOGW
(
"Failed to create context from string [%s]
\n
"
,
context
);
LOGW
(
"Failed to create context from string [%s]
\n
"
,
context
);
return
1
;
return
1
;
}
}
// Allocate genfs context
// Allocate genfs context
ocontext_t
*
newc
=
xcalloc
(
sizeof
(
*
newc
),
1
);
ocontext_t
*
newc
=
auto_cast
(
xcalloc
(
sizeof
(
*
newc
),
1
)
);
newc
->
u
.
name
=
strdup
(
path
);
newc
->
u
.
name
=
strdup
(
path
);
memcpy
(
&
newc
->
context
[
0
],
ctx
,
sizeof
(
*
ctx
));
memcpy
(
&
newc
->
context
[
0
],
ctx
,
sizeof
(
*
ctx
));
free
(
ctx
);
free
(
ctx
);
// Find or allocate genfs
// Find or allocate genfs
genfs_t
*
last_gen
=
NULL
;
genfs_t
*
last_gen
=
nullptr
;
genfs_t
*
newfs
=
NULL
;
genfs_t
*
newfs
=
nullptr
;
for
(
genfs_t
*
node
=
db
->
genfs
;
node
;
node
=
node
->
next
)
{
for
(
genfs_t
*
node
=
db
->
genfs
;
node
;
node
=
node
->
next
)
{
if
(
strcmp
(
node
->
fstype
,
name
)
==
0
)
{
if
(
strcmp
(
node
->
fstype
,
fs_
name
)
==
0
)
{
newfs
=
node
;
newfs
=
node
;
break
;
break
;
}
}
last_gen
=
node
;
last_gen
=
node
;
}
}
if
(
newfs
==
NULL
)
{
if
(
newfs
==
nullptr
)
{
newfs
=
xcalloc
(
sizeof
(
*
newfs
),
1
);
newfs
=
auto_cast
(
xcalloc
(
sizeof
(
*
newfs
),
1
)
);
newfs
->
fstype
=
strdup
(
name
);
newfs
->
fstype
=
strdup
(
fs_
name
);
// Insert
// Insert
if
(
last_gen
)
if
(
last_gen
)
last_gen
->
next
=
newfs
;
last_gen
->
next
=
newfs
;
...
@@ -530,14 +549,14 @@ int add_genfscon(policydb_t *db, const char *name, const char *path, const char
...
@@ -530,14 +549,14 @@ int add_genfscon(policydb_t *db, const char *name, const char *path, const char
}
}
// Insert or replace genfs context
// Insert or replace genfs context
ocontext_t
*
last_ctx
=
NULL
;
ocontext_t
*
last_ctx
=
nullptr
;
for
(
ocontext_t
*
node
=
newfs
->
head
;
node
;
node
=
node
->
next
)
{
for
(
ocontext_t
*
node
=
newfs
->
head
;
node
;
node
=
node
->
next
)
{
if
(
strcmp
(
node
->
u
.
name
,
path
)
==
0
)
{
if
(
strcmp
(
node
->
u
.
name
,
path
)
==
0
)
{
// Unlink
// Unlink
if
(
last_ctx
)
if
(
last_ctx
)
last_ctx
->
next
=
node
->
next
;
last_ctx
->
next
=
node
->
next
;
else
else
newfs
->
head
=
NULL
;
newfs
->
head
=
nullptr
;
// Destroy old node
// Destroy old node
free
(
node
->
u
.
name
);
free
(
node
->
u
.
name
);
context_destroy
(
&
node
->
context
[
0
]);
context_destroy
(
&
node
->
context
[
0
]);
...
@@ -555,9 +574,93 @@ int add_genfscon(policydb_t *db, const char *name, const char *path, const char
...
@@ -555,9 +574,93 @@ int add_genfscon(policydb_t *db, const char *name, const char *path, const char
return
0
;
return
0
;
}
}
void
s
trip_dontaudit
(
policydb_t
*
db
)
{
void
s
epol_impl
::
strip_dontaudit
(
)
{
avtab_for_each
(
&
db
->
te_avtab
,
{
avtab_for_each
(
&
db
->
te_avtab
,
[
=
](
avtab_ptr_t
node
)
{
if
(
node
->
key
.
specified
==
AVTAB_AUDITDENY
||
node
->
key
.
specified
==
AVTAB_XPERMS_DONTAUDIT
)
if
(
node
->
key
.
specified
==
AVTAB_AUDITDENY
||
node
->
key
.
specified
==
AVTAB_XPERMS_DONTAUDIT
)
avtab_remove_node
(
&
db
->
te_avtab
,
node
);
avtab_remove_node
(
&
db
->
te_avtab
,
node
);
})
});
}
int
sepolicy
::
allow
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
p
);
return
impl
->
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
false
);
}
int
sepolicy
::
deny
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
p
);
return
impl
->
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_ALLOWED
,
true
);
}
int
sepolicy
::
auditallow
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
p
);
return
impl
->
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITALLOW
,
false
);
}
int
sepolicy
::
dontaudit
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
p
);
return
impl
->
add_rule
(
s
,
t
,
c
,
p
,
AVTAB_AUDITDENY
,
true
);
}
int
sepolicy
::
allowxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
"ioctl"
,
range
);
return
impl
->
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_ALLOWED
,
false
);
}
int
sepolicy
::
auditallowxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
"ioctl"
,
range
);
return
impl
->
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_AUDITALLOW
,
false
);
}
int
sepolicy
::
dontauditxperm
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
"ioctl"
,
range
);
return
impl
->
add_xperm_rule
(
s
,
t
,
c
,
range
,
AVTAB_XPERMS_DONTAUDIT
,
false
);
}
int
sepolicy
::
type_change
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
d
);
return
impl
->
add_type_rule
(
s
,
t
,
c
,
d
,
AVTAB_CHANGE
);
}
int
sepolicy
::
type_member
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
d
);
return
impl
->
add_type_rule
(
s
,
t
,
c
,
d
,
AVTAB_MEMBER
);
}
int
sepolicy
::
type_transition
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
)
{
if
(
o
)
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
d
);
return
impl
->
add_type_rule
(
s
,
t
,
c
,
d
,
AVTAB_TRANSITION
);
}
else
{
dprint
(
__FUNCTION__
,
s
,
t
,
c
,
d
,
o
);
return
impl
->
add_filename_trans
(
s
,
t
,
c
,
d
,
o
);
}
}
int
sepolicy
::
permissive
(
const
char
*
s
)
{
dprint
(
__FUNCTION__
,
s
);
return
impl
->
set_domain_state
(
s
,
true
);
}
int
sepolicy
::
enforce
(
const
char
*
s
)
{
dprint
(
__FUNCTION__
,
s
);
return
impl
->
set_domain_state
(
s
,
false
);
}
int
sepolicy
::
create
(
const
char
*
s
)
{
dprint
(
__FUNCTION__
,
s
);
return
impl
->
create_domain
(
s
);
}
int
sepolicy
::
typeattribute
(
const
char
*
type
,
const
char
*
attr
)
{
dprint
(
__FUNCTION__
,
type
,
attr
);
return
impl
->
add_typeattribute
(
type
,
attr
);
}
int
sepolicy
::
genfscon
(
const
char
*
fs_name
,
const
char
*
path
,
const
char
*
ctx
)
{
dprint
(
__FUNCTION__
,
fs_name
,
path
,
ctx
);
return
impl
->
add_genfscon
(
fs_name
,
path
,
ctx
);
}
int
sepolicy
::
exists
(
const
char
*
source
)
{
return
hashtab_search
(
db
->
p_types
.
table
,
source
)
!=
nullptr
;
}
}
native/jni/magiskpolicy/sepolicy.h
deleted
100644 → 0
View file @
0236ab88
#pragma once
#include <sepol/policydb/policydb.h>
__BEGIN_DECLS
// Internal C APIs, do not use directly
int
create_domain
(
policydb_t
*
db
,
const
char
*
d
);
int
set_domain_state
(
policydb_t
*
db
,
const
char
*
s
,
int
state
);
int
add_typeattribute
(
policydb_t
*
db
,
const
char
*
type
,
const
char
*
attr
);
int
add_rule
(
policydb_t
*
db
,
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
,
int
effect
,
int
n
);
int
add_xperm_rule
(
policydb_t
*
db
,
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
,
int
effect
,
int
n
);
int
add_type_rule
(
policydb_t
*
db
,
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
int
effect
);
int
add_filename_trans
(
policydb_t
*
db
,
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
);
int
add_genfscon
(
policydb_t
*
db
,
const
char
*
name
,
const
char
*
path
,
const
char
*
context
);
void
strip_dontaudit
(
policydb_t
*
db
);
void
statement_help
();
__END_DECLS
native/jni/magiskpolicy/sepolicy.hpp
0 → 100644
View file @
f392ade7
#pragma once
#include <sepol/policydb/policydb.h>
#include <magiskpolicy.hpp>
// Internal APIs, do not use directly
struct
sepol_impl
:
public
sepolicy
{
int
set_attr
(
const
char
*
attr_name
,
int
type_val
);
void
check_avtab_node
(
avtab_ptr_t
node
);
avtab_ptr_t
get_avtab_node
(
avtab_key_t
*
key
,
avtab_extended_perms_t
*
xperms
);
int
add_avrule
(
avtab_key_t
*
key
,
int
val
,
bool
n
);
int
add_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
p
,
int
effect
,
bool
n
);
int
add_rule
(
type_datum_t
*
src
,
type_datum_t
*
tgt
,
class_datum_t
*
cls
,
perm_datum_t
*
perm
,
int
effect
,
bool
n
);
int
add_avxrule
(
avtab_key_t
*
key
,
uint16_t
low
,
uint16_t
high
,
bool
n
);
int
add_xperm_rule
(
type_datum_t
*
src
,
type_datum_t
*
tgt
,
class_datum_t
*
cls
,
uint16_t
low
,
uint16_t
high
,
int
effect
,
bool
n
);
int
add_xperm_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
range
,
int
effect
,
bool
n
);
int
create_domain
(
const
char
*
type_name
);
int
set_domain_state
(
const
char
*
s
,
bool
permissive
);
int
add_filename_trans
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
const
char
*
o
);
int
add_typeattribute
(
const
char
*
type
,
const
char
*
attr
);
int
add_type_rule
(
const
char
*
s
,
const
char
*
t
,
const
char
*
c
,
const
char
*
d
,
int
effect
);
int
add_genfscon
(
const
char
*
fs_name
,
const
char
*
path
,
const
char
*
context
);
void
strip_dontaudit
();
void
allow_su_client
(
const
char
*
type
);
};
#define impl static_cast<sepol_impl *>(this)
void
statement_help
();
native/jni/magiskpolicy/statement.cpp
View file @
f392ade7
...
@@ -6,7 +6,7 @@
...
@@ -6,7 +6,7 @@
#include <logging.hpp>
#include <logging.hpp>
#include <utils.hpp>
#include <utils.hpp>
#include "sepolicy.h"
#include "sepolicy.h
pp
"
using
namespace
std
;
using
namespace
std
;
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment