1. 20 Jun, 2020 8 commits
  2. 19 Jun, 2020 3 commits
  3. 17 Jun, 2020 4 commits
  4. 04 Jun, 2020 1 commit
    • topjohnwu's avatar
      Redesign of MagiskSU's sepolicy model · ec3705f2
      topjohnwu authored
      Introduce new domain `magisk_client` and new file type `magisk_exec`.
      
      Connection to magiskd's always-on socket is restricted to magisk_client
      only. Whitelisted process domains can transit to magisk_client through
      executing files labelled magisk_exec. The main magisk binary shall be
      the only file labelled as magisk_exec throughout the whole system.
      All processes thus are no longer allowed to connect to magiskd directly
      without going through the proper magisk binary.
      
      Connection failures are silenced from audit logs with dontaudit rules,
      so crazy processes which traverse through all unix domain sockets to try
      connection can no longer check logcat to know the actual reason behind
      EACCES, leaking the denied process policy (which is u:r:magisk:s0).
      
      This also allows us to remove many rules that open up holes in
      untrusted_app domains that were used to make remote shell work properly.
      Since all processes establishing the remote shell are now restricted to
      the magisk_client domain, all these rules are moved to magisk_client.
      This makes Magisk require fewer compromises in Android's security model.
      
      Note: as of this commit, requesting new root access via Magisk Manager
      will stop working as Magisk Manager can no longer communicate with
      magiskd directly. This will be addressed in a future commit that
      involves changes in both native and application side.
      ec3705f2
  5. 03 Jun, 2020 3 commits
  6. 01 Jun, 2020 3 commits
  7. 31 May, 2020 2 commits
  8. 30 May, 2020 7 commits
  9. 29 May, 2020 1 commit
  10. 25 May, 2020 2 commits
  11. 24 May, 2020 2 commits
    • topjohnwu's avatar
      Optimize match-all-type rules · cd6eca1d
      topjohnwu authored
      For match-all-type rules (e.g. "allow magisk * * *" used in Magisk),
      we used to iterate and apply rules on all existing types. However, this
      is actually unnecessary as all selinux types should have at least 1
      attributes assigned to it (process types "domain", file context types
      "file_type" etc.). This means in order to create rules that applies to
      all types, we actually only need to create rules for all attributes.
      
      This optimization SIGNIFICANTLY reduces the patched sepolicy that is
      loaded into the kernel when running Magisk. For example on Pixel 4 XL
      running Android R DP4, the sepolicy sizes are
      patched (before) : 3455948
      patched (after)  : 843176
      stock            : 630229
      
      The active sepolicy size actually impacts the performance of every single
      operation in the operating system, because the larger the policies gets,
      the longer it takes for the kernel to lookup and match rules.
      cd6eca1d
    • topjohnwu's avatar
      Cleanup some implementations · 951273f8
      topjohnwu authored
      951273f8
  12. 23 May, 2020 4 commits