Commit f392ade7 authored by topjohnwu's avatar topjohnwu

Rewrite sepolicy.c in C++

parent 0236ab88
......@@ -63,12 +63,11 @@ LOCAL_SRC_FILES := \
init/getinfo.cpp \
init/twostage.cpp \
core/socket.cpp \
magiskpolicy/api.cpp \
magiskpolicy/sepolicy.cpp \
magiskpolicy/magiskpolicy.cpp \
magiskpolicy/rules.cpp \
magiskpolicy/policydb.cpp \
magiskpolicy/statement.cpp \
magiskpolicy/sepolicy.c \
magiskboot/pattern.cpp
LOCAL_LDFLAGS := -static
......@@ -108,12 +107,11 @@ LOCAL_C_INCLUDES := jni/include
LOCAL_SRC_FILES := \
core/applet_stub.cpp \
magiskpolicy/api.cpp \
magiskpolicy/sepolicy.cpp \
magiskpolicy/magiskpolicy.cpp \
magiskpolicy/rules.cpp \
magiskpolicy/policydb.cpp \
magiskpolicy/statement.cpp \
magiskpolicy/sepolicy.c
magiskpolicy/statement.cpp
LOCAL_CFLAGS := -DAPPLET_STUB_MAIN=magiskpolicy_main
LOCAL_LDFLAGS := -static
......
......@@ -41,7 +41,7 @@ public:
int dontauditxperm(c_str src, c_str tgt, c_str cls, c_str range);
// Type rules
int type_transition(c_str src, c_str tgt, c_str cls, c_str def, c_str obj = nullptr);
int type_transition(c_str s, c_str t, c_str c, c_str d, c_str o = nullptr);
int type_change(c_str src, c_str tgt, c_str cls, c_str def);
int type_member(c_str src, c_str tgt, c_str cls, c_str def);
......@@ -50,8 +50,7 @@ public:
// Magisk
void magisk_rules();
void allow_su_client(c_str type);
private:
protected:
policydb *db;
};
#include <magiskpolicy.hpp>
#include "sepolicy.h"
//#define vprint(fmt, ...) printf(fmt, __VA_ARGS__)
#define vprint(...)
int sepolicy::allow(const char *s, const char *t, const char *c, const char *p) {
vprint("allow %s %s %s %s\n", s, t, c, p);
return add_rule(db, s, t, c, p, AVTAB_ALLOWED, 0);
}
int sepolicy::deny(const char *s, const char *t, const char *c, const char *p) {
vprint("deny %s %s %s %s\n", s, t, c, p);
return add_rule(db, s, t, c, p, AVTAB_ALLOWED, 1);
}
int sepolicy::auditallow(const char *s, const char *t, const char *c, const char *p) {
vprint("auditallow %s %s %s %s\n", s, t, c, p);
return add_rule(db, s, t, c, p, AVTAB_AUDITALLOW, 0);
}
int sepolicy::dontaudit(const char *s, const char *t, const char *c, const char *p) {
vprint("dontaudit %s %s %s %s\n", s, t, c, p);
return add_rule(db, s, t, c, p, AVTAB_AUDITDENY, 1);
}
int sepolicy::allowxperm(const char *s, const char *t, const char *c, const char *range) {
vprint("allowxperm %s %s %s %s\n", s, t, c, range);
return add_xperm_rule(db, s, t, c, range, AVTAB_XPERMS_ALLOWED, 0);
}
int sepolicy::auditallowxperm(const char *s, const char *t, const char *c, const char *range) {
vprint("auditallowxperm %s %s %s %s\n", s, t, c, range);
return add_xperm_rule(db, s, t, c, range, AVTAB_XPERMS_AUDITALLOW, 0);
}
int sepolicy::dontauditxperm(const char *s, const char *t, const char *c, const char *range) {
vprint("dontauditxperm %s %s %s %s\n", s, t, c, range);
return add_xperm_rule(db, s, t, c, range, AVTAB_XPERMS_DONTAUDIT, 0);
}
int sepolicy::type_change(const char *s, const char *t, const char *c, const char *d) {
vprint("type_change %s %s %s %s\n", s, t, c, d);
return add_type_rule(db, s, t, c, d, AVTAB_CHANGE);
}
int sepolicy::type_member(const char *s, const char *t, const char *c, const char *d) {
vprint("type_member %s %s %s %s\n", s, t, c, d);
return add_type_rule(db, s, t, c, d, AVTAB_MEMBER);
}
int sepolicy::type_transition(const char *src, const char *tgt, const char *cls, const char *def, const char *obj) {
if (obj) {
vprint("type_transition %s %s %s %s\n", src, tgt, cls, def);
return add_type_rule(db, src, tgt, cls, def, AVTAB_TRANSITION);
} else {
vprint("type_transition %s %s %s %s %s\n", src, tgt, cls, def, obj);
return add_filename_trans(db, src, tgt, cls, def, obj);
}
}
int sepolicy::permissive(const char *s) {
vprint("permissive %s\n", s);
return set_domain_state(db, s, 1);
}
int sepolicy::enforce(const char *s) {
vprint("enforce %s\n", s);
return set_domain_state(db, s, 0);
}
int sepolicy::create(const char *s) {
vprint("create %s\n", s);
return create_domain(db, s);
}
int sepolicy::typeattribute(const char *type, const char *attr) {
vprint("typeattribute %s %s\n", type, attr);
return add_typeattribute(db, type, attr);
}
int sepolicy::genfscon(const char *fs_name, const char *path, const char *ctx) {
vprint("genfscon %s %s %s\n", fs_name, path, ctx);
return add_genfscon(db, fs_name, path, ctx);
}
int sepolicy::exists(const char *source) {
return hashtab_search(db->p_types.table, source) != nullptr;
}
......@@ -6,7 +6,7 @@
#include <flags.h>
#include <magiskpolicy.hpp>
#include "sepolicy.h"
#include "sepolicy.hpp"
using namespace std::literals;
......
......@@ -10,7 +10,7 @@
#include <stream.hpp>
#include <magiskpolicy.hpp>
#include "sepolicy.h"
#include "sepolicy.hpp"
#define SHALEN 64
static bool cmp_sha256(const char *a, const char *b) {
......
#include <initializer_list>
#include <logging.hpp>
#include <flags.h>
#include <magiskpolicy.hpp>
#include "sepolicy.h"
#include "sepolicy.hpp"
void sepolicy::allow_su_client(const char *type) {
void sepol_impl::allow_su_client(const char *type) {
if (!exists(type))
return;
allow(type, SEPOL_PROC_DOMAIN, "unix_stream_socket", "connectto");
......@@ -78,16 +80,11 @@ void sepolicy::magisk_rules() {
allow(SEPOL_PROC_DOMAIN, "kernel", "security", "load_policy");
// Allow these processes to access MagiskSU
allow_su_client("init");
allow_su_client("shell");
allow_su_client("system_app");
allow_su_client("priv_app");
allow_su_client("platform_app");
allow_su_client("untrusted_app");
allow_su_client("untrusted_app_25");
allow_su_client("untrusted_app_27");
allow_su_client("untrusted_app_29");
allow_su_client("update_engine");
std::initializer_list<const char *> clients {
"init", "shell", "system_app", "priv_app", "platform_app", "untrusted_app",
"untrusted_app_25", "untrusted_app_27", "untrusted_app_29", "update_engine" };
for (auto type : clients)
impl->allow_su_client(type);
// suRights
allow("servicemanager", SEPOL_PROC_DOMAIN, "dir", "search");
......@@ -199,7 +196,7 @@ void sepolicy::magisk_rules() {
#if 0
// Remove all dontaudit in debug mode
strip_dontaudit(db);
impl->strip_dontaudit();
#endif
log_cb.w = bak;
......
#pragma once
#include <sepol/policydb/policydb.h>
__BEGIN_DECLS
// Internal C APIs, do not use directly
int create_domain(policydb_t *db, const char *d);
int set_domain_state(policydb_t *db, const char *s, int state);
int add_typeattribute(policydb_t *db, const char *type, const char *attr);
int add_rule(policydb_t *db, const char *s, const char *t, const char *c, const char *p, int effect,
int n);
int add_xperm_rule(policydb_t *db, const char *s, const char *t, const char *c, const char *range,
int effect, int n);
int add_type_rule(policydb_t *db, const char *s, const char *t, const char *c, const char *d,
int effect);
int add_filename_trans(policydb_t *db, const char *s, const char *t, const char *c, const char *d,
const char *o);
int add_genfscon(policydb_t *db, const char *name, const char *path, const char *context);
void strip_dontaudit(policydb_t *db);
void statement_help();
__END_DECLS
#pragma once
#include <sepol/policydb/policydb.h>
#include <magiskpolicy.hpp>
// Internal APIs, do not use directly
struct sepol_impl : public sepolicy {
int set_attr(const char *attr_name, int type_val);
void check_avtab_node(avtab_ptr_t node);
avtab_ptr_t get_avtab_node(avtab_key_t *key, avtab_extended_perms_t *xperms);
int add_avrule(avtab_key_t *key, int val, bool n);
int add_rule(const char *s, const char *t, const char *c, const char *p, int effect, bool n);
int add_rule(type_datum_t *src, type_datum_t *tgt, class_datum_t *cls, perm_datum_t *perm, int effect, bool n);
int add_avxrule(avtab_key_t *key, uint16_t low, uint16_t high, bool n);
int add_xperm_rule(type_datum_t *src, type_datum_t *tgt,
class_datum_t *cls, uint16_t low, uint16_t high, int effect, bool n);
int add_xperm_rule(const char *s, const char *t, const char *c, const char *range, int effect, bool n);
int create_domain(const char *type_name);
int set_domain_state(const char *s, bool permissive);
int add_filename_trans(const char *s, const char *t, const char *c, const char *d, const char *o);
int add_typeattribute(const char *type, const char *attr);
int add_type_rule(const char *s, const char *t, const char *c, const char *d, int effect);
int add_genfscon(const char *fs_name, const char *path, const char *context);
void strip_dontaudit();
void allow_su_client(const char *type);
};
#define impl static_cast<sepol_impl *>(this)
void statement_help();
......@@ -6,7 +6,7 @@
#include <logging.hpp>
#include <utils.hpp>
#include "sepolicy.h"
#include "sepolicy.hpp"
using namespace std;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment