Commit f392ade7 authored by topjohnwu's avatar topjohnwu

Rewrite sepolicy.c in C++

parent 0236ab88
...@@ -63,12 +63,11 @@ LOCAL_SRC_FILES := \ ...@@ -63,12 +63,11 @@ LOCAL_SRC_FILES := \
init/getinfo.cpp \ init/getinfo.cpp \
init/twostage.cpp \ init/twostage.cpp \
core/socket.cpp \ core/socket.cpp \
magiskpolicy/api.cpp \ magiskpolicy/sepolicy.cpp \
magiskpolicy/magiskpolicy.cpp \ magiskpolicy/magiskpolicy.cpp \
magiskpolicy/rules.cpp \ magiskpolicy/rules.cpp \
magiskpolicy/policydb.cpp \ magiskpolicy/policydb.cpp \
magiskpolicy/statement.cpp \ magiskpolicy/statement.cpp \
magiskpolicy/sepolicy.c \
magiskboot/pattern.cpp magiskboot/pattern.cpp
LOCAL_LDFLAGS := -static LOCAL_LDFLAGS := -static
...@@ -108,12 +107,11 @@ LOCAL_C_INCLUDES := jni/include ...@@ -108,12 +107,11 @@ LOCAL_C_INCLUDES := jni/include
LOCAL_SRC_FILES := \ LOCAL_SRC_FILES := \
core/applet_stub.cpp \ core/applet_stub.cpp \
magiskpolicy/api.cpp \ magiskpolicy/sepolicy.cpp \
magiskpolicy/magiskpolicy.cpp \ magiskpolicy/magiskpolicy.cpp \
magiskpolicy/rules.cpp \ magiskpolicy/rules.cpp \
magiskpolicy/policydb.cpp \ magiskpolicy/policydb.cpp \
magiskpolicy/statement.cpp \ magiskpolicy/statement.cpp
magiskpolicy/sepolicy.c
LOCAL_CFLAGS := -DAPPLET_STUB_MAIN=magiskpolicy_main LOCAL_CFLAGS := -DAPPLET_STUB_MAIN=magiskpolicy_main
LOCAL_LDFLAGS := -static LOCAL_LDFLAGS := -static
......
...@@ -41,7 +41,7 @@ public: ...@@ -41,7 +41,7 @@ public:
int dontauditxperm(c_str src, c_str tgt, c_str cls, c_str range); int dontauditxperm(c_str src, c_str tgt, c_str cls, c_str range);
// Type rules // Type rules
int type_transition(c_str src, c_str tgt, c_str cls, c_str def, c_str obj = nullptr); int type_transition(c_str s, c_str t, c_str c, c_str d, c_str o = nullptr);
int type_change(c_str src, c_str tgt, c_str cls, c_str def); int type_change(c_str src, c_str tgt, c_str cls, c_str def);
int type_member(c_str src, c_str tgt, c_str cls, c_str def); int type_member(c_str src, c_str tgt, c_str cls, c_str def);
...@@ -50,8 +50,7 @@ public: ...@@ -50,8 +50,7 @@ public:
// Magisk // Magisk
void magisk_rules(); void magisk_rules();
void allow_su_client(c_str type);
private: protected:
policydb *db; policydb *db;
}; };
#include <magiskpolicy.hpp>
#include "sepolicy.h"
//#define vprint(fmt, ...) printf(fmt, __VA_ARGS__)
#define vprint(...)
int sepolicy::allow(const char *s, const char *t, const char *c, const char *p) {
vprint("allow %s %s %s %s\n", s, t, c, p);
return add_rule(db, s, t, c, p, AVTAB_ALLOWED, 0);
}
int sepolicy::deny(const char *s, const char *t, const char *c, const char *p) {
vprint("deny %s %s %s %s\n", s, t, c, p);
return add_rule(db, s, t, c, p, AVTAB_ALLOWED, 1);
}
int sepolicy::auditallow(const char *s, const char *t, const char *c, const char *p) {
vprint("auditallow %s %s %s %s\n", s, t, c, p);
return add_rule(db, s, t, c, p, AVTAB_AUDITALLOW, 0);
}
int sepolicy::dontaudit(const char *s, const char *t, const char *c, const char *p) {
vprint("dontaudit %s %s %s %s\n", s, t, c, p);
return add_rule(db, s, t, c, p, AVTAB_AUDITDENY, 1);
}
int sepolicy::allowxperm(const char *s, const char *t, const char *c, const char *range) {
vprint("allowxperm %s %s %s %s\n", s, t, c, range);
return add_xperm_rule(db, s, t, c, range, AVTAB_XPERMS_ALLOWED, 0);
}
int sepolicy::auditallowxperm(const char *s, const char *t, const char *c, const char *range) {
vprint("auditallowxperm %s %s %s %s\n", s, t, c, range);
return add_xperm_rule(db, s, t, c, range, AVTAB_XPERMS_AUDITALLOW, 0);
}
int sepolicy::dontauditxperm(const char *s, const char *t, const char *c, const char *range) {
vprint("dontauditxperm %s %s %s %s\n", s, t, c, range);
return add_xperm_rule(db, s, t, c, range, AVTAB_XPERMS_DONTAUDIT, 0);
}
int sepolicy::type_change(const char *s, const char *t, const char *c, const char *d) {
vprint("type_change %s %s %s %s\n", s, t, c, d);
return add_type_rule(db, s, t, c, d, AVTAB_CHANGE);
}
int sepolicy::type_member(const char *s, const char *t, const char *c, const char *d) {
vprint("type_member %s %s %s %s\n", s, t, c, d);
return add_type_rule(db, s, t, c, d, AVTAB_MEMBER);
}
int sepolicy::type_transition(const char *src, const char *tgt, const char *cls, const char *def, const char *obj) {
if (obj) {
vprint("type_transition %s %s %s %s\n", src, tgt, cls, def);
return add_type_rule(db, src, tgt, cls, def, AVTAB_TRANSITION);
} else {
vprint("type_transition %s %s %s %s %s\n", src, tgt, cls, def, obj);
return add_filename_trans(db, src, tgt, cls, def, obj);
}
}
int sepolicy::permissive(const char *s) {
vprint("permissive %s\n", s);
return set_domain_state(db, s, 1);
}
int sepolicy::enforce(const char *s) {
vprint("enforce %s\n", s);
return set_domain_state(db, s, 0);
}
int sepolicy::create(const char *s) {
vprint("create %s\n", s);
return create_domain(db, s);
}
int sepolicy::typeattribute(const char *type, const char *attr) {
vprint("typeattribute %s %s\n", type, attr);
return add_typeattribute(db, type, attr);
}
int sepolicy::genfscon(const char *fs_name, const char *path, const char *ctx) {
vprint("genfscon %s %s %s\n", fs_name, path, ctx);
return add_genfscon(db, fs_name, path, ctx);
}
int sepolicy::exists(const char *source) {
return hashtab_search(db->p_types.table, source) != nullptr;
}
...@@ -6,7 +6,7 @@ ...@@ -6,7 +6,7 @@
#include <flags.h> #include <flags.h>
#include <magiskpolicy.hpp> #include <magiskpolicy.hpp>
#include "sepolicy.h" #include "sepolicy.hpp"
using namespace std::literals; using namespace std::literals;
......
...@@ -10,7 +10,7 @@ ...@@ -10,7 +10,7 @@
#include <stream.hpp> #include <stream.hpp>
#include <magiskpolicy.hpp> #include <magiskpolicy.hpp>
#include "sepolicy.h" #include "sepolicy.hpp"
#define SHALEN 64 #define SHALEN 64
static bool cmp_sha256(const char *a, const char *b) { static bool cmp_sha256(const char *a, const char *b) {
......
#include <initializer_list>
#include <logging.hpp> #include <logging.hpp>
#include <flags.h> #include <flags.h>
#include <magiskpolicy.hpp> #include <magiskpolicy.hpp>
#include "sepolicy.h" #include "sepolicy.hpp"
void sepolicy::allow_su_client(const char *type) { void sepol_impl::allow_su_client(const char *type) {
if (!exists(type)) if (!exists(type))
return; return;
allow(type, SEPOL_PROC_DOMAIN, "unix_stream_socket", "connectto"); allow(type, SEPOL_PROC_DOMAIN, "unix_stream_socket", "connectto");
...@@ -78,16 +80,11 @@ void sepolicy::magisk_rules() { ...@@ -78,16 +80,11 @@ void sepolicy::magisk_rules() {
allow(SEPOL_PROC_DOMAIN, "kernel", "security", "load_policy"); allow(SEPOL_PROC_DOMAIN, "kernel", "security", "load_policy");
// Allow these processes to access MagiskSU // Allow these processes to access MagiskSU
allow_su_client("init"); std::initializer_list<const char *> clients {
allow_su_client("shell"); "init", "shell", "system_app", "priv_app", "platform_app", "untrusted_app",
allow_su_client("system_app"); "untrusted_app_25", "untrusted_app_27", "untrusted_app_29", "update_engine" };
allow_su_client("priv_app"); for (auto type : clients)
allow_su_client("platform_app"); impl->allow_su_client(type);
allow_su_client("untrusted_app");
allow_su_client("untrusted_app_25");
allow_su_client("untrusted_app_27");
allow_su_client("untrusted_app_29");
allow_su_client("update_engine");
// suRights // suRights
allow("servicemanager", SEPOL_PROC_DOMAIN, "dir", "search"); allow("servicemanager", SEPOL_PROC_DOMAIN, "dir", "search");
...@@ -199,7 +196,7 @@ void sepolicy::magisk_rules() { ...@@ -199,7 +196,7 @@ void sepolicy::magisk_rules() {
#if 0 #if 0
// Remove all dontaudit in debug mode // Remove all dontaudit in debug mode
strip_dontaudit(db); impl->strip_dontaudit();
#endif #endif
log_cb.w = bak; log_cb.w = bak;
......
#pragma once
#include <sepol/policydb/policydb.h>
__BEGIN_DECLS
// Internal C APIs, do not use directly
int create_domain(policydb_t *db, const char *d);
int set_domain_state(policydb_t *db, const char *s, int state);
int add_typeattribute(policydb_t *db, const char *type, const char *attr);
int add_rule(policydb_t *db, const char *s, const char *t, const char *c, const char *p, int effect,
int n);
int add_xperm_rule(policydb_t *db, const char *s, const char *t, const char *c, const char *range,
int effect, int n);
int add_type_rule(policydb_t *db, const char *s, const char *t, const char *c, const char *d,
int effect);
int add_filename_trans(policydb_t *db, const char *s, const char *t, const char *c, const char *d,
const char *o);
int add_genfscon(policydb_t *db, const char *name, const char *path, const char *context);
void strip_dontaudit(policydb_t *db);
void statement_help();
__END_DECLS
#pragma once
#include <sepol/policydb/policydb.h>
#include <magiskpolicy.hpp>
// Internal APIs, do not use directly
struct sepol_impl : public sepolicy {
int set_attr(const char *attr_name, int type_val);
void check_avtab_node(avtab_ptr_t node);
avtab_ptr_t get_avtab_node(avtab_key_t *key, avtab_extended_perms_t *xperms);
int add_avrule(avtab_key_t *key, int val, bool n);
int add_rule(const char *s, const char *t, const char *c, const char *p, int effect, bool n);
int add_rule(type_datum_t *src, type_datum_t *tgt, class_datum_t *cls, perm_datum_t *perm, int effect, bool n);
int add_avxrule(avtab_key_t *key, uint16_t low, uint16_t high, bool n);
int add_xperm_rule(type_datum_t *src, type_datum_t *tgt,
class_datum_t *cls, uint16_t low, uint16_t high, int effect, bool n);
int add_xperm_rule(const char *s, const char *t, const char *c, const char *range, int effect, bool n);
int create_domain(const char *type_name);
int set_domain_state(const char *s, bool permissive);
int add_filename_trans(const char *s, const char *t, const char *c, const char *d, const char *o);
int add_typeattribute(const char *type, const char *attr);
int add_type_rule(const char *s, const char *t, const char *c, const char *d, int effect);
int add_genfscon(const char *fs_name, const char *path, const char *context);
void strip_dontaudit();
void allow_su_client(const char *type);
};
#define impl static_cast<sepol_impl *>(this)
void statement_help();
...@@ -6,7 +6,7 @@ ...@@ -6,7 +6,7 @@
#include <logging.hpp> #include <logging.hpp>
#include <utils.hpp> #include <utils.hpp>
#include "sepolicy.h" #include "sepolicy.hpp"
using namespace std; using namespace std;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment