Significantly broaden sepolicy.rule compatibility

Previously, Magisk uses persist or cache for storing modules' custom
sepolicy rules. In this commit, we significantly broaden its
compatibility and also prevent mounting errors.

The persist partition is non-standard and also critical for Snapdragon
devices, so we prefer not to use it by default.

We will go through the following logic to find the best suitable
non-volatile, writable location to store and load sepolicy.rule files:

Unencrypted data -> FBE data unencrypted dir -> cache -> metadata -> persist

This should cover almost all possible cases: very old devices have
cache partitions; newer devices will use FBE; latest devices will use
metadata FBE (which guarantees a metadata parition); and finally,
all Snapdragon devices have the persist partition (as a last resort).

Fix #3179
This commit is contained in:
topjohnwu 2020-11-02 23:20:38 -08:00
parent cf47214ee4
commit 16e4c67992
9 changed files with 237 additions and 105 deletions

View File

@ -26,11 +26,17 @@ class LocalModule(path: String) : Module() {
set(enable) {
val dir = "$PERSIST/$id"
if (enable) {
Shell.su("mkdir -p $dir", "cp -af $ruleFile $dir").submit()
disableFile.delete()
if (Const.Version.isCanary())
Shell.su("copy_sepolicy_rules").submit()
else
Shell.su("mkdir -p $dir", "cp -af $ruleFile $dir").submit()
} else {
Shell.su("rm -rf $dir").submit()
!disableFile.createNewFile()
if (Const.Version.isCanary())
Shell.su("copy_sepolicy_rules").submit()
else
Shell.su("rm -rf $dir").submit()
}
}
@ -38,11 +44,17 @@ class LocalModule(path: String) : Module() {
get() = removeFile.exists()
set(remove) {
if (remove) {
Shell.su("rm -rf $PERSIST/$id").submit()
removeFile.createNewFile()
if (Const.Version.isCanary())
Shell.su("copy_sepolicy_rules").submit()
else
Shell.su("rm -rf $PERSIST/$id").submit()
} else {
Shell.su("cp -af $ruleFile $PERSIST/$id").submit()
!removeFile.delete()
if (Const.Version.isCanary())
Shell.su("copy_sepolicy_rules").submit()
else
Shell.su("cp -af $ruleFile $PERSIST/$id").submit()
}
}

View File

@ -22,14 +22,15 @@ static bool safe_mode = false;
* Setup *
*********/
#define DIR_IS(part) (me->mnt_dir == "/" #part ""sv)
#define MNT_DIR_IS(dir) (me->mnt_dir == string_view(dir))
#define SETMIR(b, part) sprintf(b, "%s/" MIRRDIR "/" #part, MAGISKTMP.data())
#define SETBLK(b, part) sprintf(b, "%s/" BLOCKDIR "/" #part, MAGISKTMP.data())
#define mount_mirror(part, flag) \
else if (DIR_IS(part) && me->mnt_type != "tmpfs"sv && lstat(me->mnt_dir, &st) == 0) { \
else if (MNT_DIR_IS("/" #part) && me->mnt_type != "tmpfs"sv && lstat(me->mnt_dir, &st) == 0) { \
SETMIR(buf1, part); \
SETBLK(buf2, part); \
unlink(buf2); \
mknod(buf2, S_IFBLK | 0600, st.st_dev); \
xmkdir(buf1, 0755); \
xmount(buf2, buf1, me->mnt_type, flag, nullptr); \
@ -43,6 +44,16 @@ if (access("/system/" #part, F_OK) == 0 && access(buf1, F_OK) != 0) { \
LOGI("link: %s\n", buf1); \
}
#define link_orig_dir(dir, part) \
else if (MNT_DIR_IS(dir) && me->mnt_type != "tmpfs"sv) { \
SETMIR(buf1, part); \
rmdir(buf1); \
xsymlink(dir, buf1); \
LOGI("link: %s\n", buf1); \
}
#define link_orig(part) link_orig_dir("/" #part, part)
static bool magisk_env() {
LOGI("* Initializing Magisk environment\n");
@ -98,7 +109,11 @@ static bool magisk_env() {
mount_mirror(product, MS_RDONLY)
mount_mirror(system_ext, MS_RDONLY)
mount_mirror(data, 0)
else if (SDK_INT >= 24 && DIR_IS(proc) && !strstr(me->mnt_opts, "hidepid=2")) {
link_orig(cache)
link_orig(metadata)
link_orig(persist)
link_orig_dir("/mnt/vendor/persist", persist)
else if (SDK_INT >= 24 && MNT_DIR_IS("/proc") && !strstr(me->mnt_opts, "hidepid=2")) {
xmount(nullptr, "/proc", nullptr, MS_REMOUNT, "hidepid=2,gid=3009");
}
return true;
@ -109,9 +124,9 @@ static bool magisk_env() {
xsymlink("./system_root/system", buf1);
LOGI("link: %s\n", buf1);
}
link_mirror(vendor);
link_mirror(product);
link_mirror(system_ext);
link_mirror(vendor)
link_mirror(product)
link_mirror(system_ext)
// Disable/remove magiskhide, resetprop
if (SDK_INT < 19) {

View File

@ -17,6 +17,7 @@
extern std::string MAGISKTMP;
#define INTLROOT ".magisk"
#define MIRRDIR INTLROOT "/mirror"
#define RULESDIR MIRRDIR "/sepolicy.rules"
#define BLOCKDIR INTLROOT "/block"
#define MODULEMNT INTLROOT "/modules"
#define BBPATH INTLROOT "/busybox"

View File

@ -68,11 +68,12 @@ class MagiskInit : public BaseInit {
protected:
auto_data<HEAP> self;
auto_data<HEAP> config;
std::string persist_dir;
std::string custom_rules_dir;
void mount_with_dt();
bool patch_sepolicy(const char *file);
void setup_tmp(const char *path);
void mount_rules_dir(const char *dev_base, const char *mnt_base);
public:
MagiskInit(char *argv[], cmdline *cmd) : BaseInit(argv, cmd) {}
};
@ -114,10 +115,11 @@ public:
class SecondStageInit : public SARBase {
protected:
void early_mount() override;
void cleanup() override { /* Do not do any cleanup */ }
public:
SecondStageInit(char *argv[]) : SARBase(argv, nullptr) {
LOGD("%s\n", __FUNCTION__);
// Do not unmount /sys and /proc
mount_list.clear();
};
};

View File

@ -205,27 +205,89 @@ static void switch_root(const string &path) {
frm_rf(root);
}
static void mount_persist(const char *dev_base, const char *mnt_base) {
string mnt_point = mnt_base + "/persist"s;
strcpy(blk_info.partname, "persist");
void MagiskInit::mount_rules_dir(const char *dev_base, const char *mnt_base) {
char path[128];
xrealpath(dev_base, blk_info.block_dev);
char *s = blk_info.block_dev + strlen(blk_info.block_dev);
strcpy(s, "/persist");
xrealpath(mnt_base, path);
char *b = blk_info.block_dev + strlen(blk_info.block_dev);
char *p = path + strlen(path);
auto do_mount = [&](const char *type) -> bool {
xmkdir(path, 0755);
bool success = xmount(blk_info.block_dev, path, type, 0, nullptr) == 0;
if (success)
mount_list.emplace_back(path);
return success;
};
// First try userdata
strcpy(blk_info.partname, "userdata");
strcpy(b, "/data");
strcpy(p, "/data");
if (setup_block(false) < 0) {
// Try NVIDIA naming scheme
strcpy(blk_info.partname, "UDA");
if (setup_block(false) < 0)
goto cache;
}
// Try to mount with either ext4 or f2fs
// Failure means either FDE or metadata encryption
if (!do_mount("ext4") && !do_mount("f2fs"))
goto cache;
strcpy(p, "/data/unencrypted");
if (access(path, F_OK) == 0) {
// FBE, need to use an unencrypted path
custom_rules_dir = path + "/magisk"s;
} else {
// Skip if /data/adb does not exist
strcpy(p, "/data/adb");
if (access(path, F_OK) != 0)
return;
// Unencrypted, directly use module paths
custom_rules_dir = string(mnt_base) + MODULEROOT;
}
goto success;
cache:
// Fallback to cache
strcpy(blk_info.partname, "cache");
strcpy(s, "/cache");
strcpy(b, "/cache");
strcpy(p, "/cache");
if (setup_block(false) < 0) {
// Try NVIDIA's BS
// Try NVIDIA naming scheme
strcpy(blk_info.partname, "CAC");
if (setup_block(false) < 0)
goto metadata;
}
if (!do_mount("ext4"))
goto metadata;
custom_rules_dir = path + "/magisk"s;
goto success;
metadata:
// Fallback to metadata
strcpy(blk_info.partname, "metadata");
strcpy(b, "/metadata");
strcpy(p, "/metadata");
if (setup_block(false) < 0 || !do_mount("ext4"))
goto persist;
custom_rules_dir = path + "/magisk"s;
goto success;
persist:
// Fallback to persist
strcpy(blk_info.partname, "persist");
strcpy(b, "/persist");
strcpy(p, "/persist");
if (setup_block(false) < 0 || !do_mount("ext4"))
return;
}
xsymlink("./cache", mnt_point.data());
mnt_point = mnt_base + "/cache"s;
}
xmkdir(mnt_point.data(), 0755);
xmount(blk_info.block_dev, mnt_point.data(), "ext4", 0, nullptr);
custom_rules_dir = path + "/magisk"s;
success:
// Create symlinks so we don't need to go through this logic again
strcpy(p, "/sepolicy.rules");
xsymlink(custom_rules_dir.data(), path);
}
void RootFSInit::early_mount() {
@ -235,11 +297,6 @@ void RootFSInit::early_mount() {
rename("/.backup/init", "/init");
mount_with_dt();
xmkdir("/dev/mnt", 0755);
mount_persist("/dev/block", "/dev/mnt");
mount_list.emplace_back("/dev/mnt/persist");
persist_dir = "/dev/mnt/persist/magisk";
}
void SARBase::backup_files() {
@ -337,8 +394,6 @@ void MagiskInit::setup_tmp(const char *path) {
xmkdir(MIRRDIR, 0);
xmkdir(BLOCKDIR, 0);
mount_persist(BLOCKDIR, MIRRDIR);
int fd = xopen(INTLROOT "/config", O_WRONLY | O_CREAT, 0);
xwrite(fd, config.buf, config.sz);
close(fd);

View File

@ -81,33 +81,6 @@ static void load_overlay_rc(const char *overlay) {
}
}
void RootFSInit::setup_rootfs() {
if (patch_sepolicy("/sepolicy")) {
auto init = raw_data::mmap_rw("/init");
init.patch({ make_pair(SPLIT_PLAT_CIL, "xxx") });
}
// Handle overlays
if (access("/overlay.d", F_OK) == 0) {
LOGD("Merge overlay.d\n");
load_overlay_rc("/overlay.d");
mv_path("/overlay.d", "/");
}
patch_init_rc("/init.rc", "/init.p.rc", "/sbin");
rename("/init.p.rc", "/init.rc");
// Create hardlink mirror of /sbin to /root
mkdir("/root", 0750);
clone_attr("/sbin", "/root");
link_path("/sbin", "/root");
// Dump magiskinit as magisk
int fd = xopen("/sbin/magisk", O_WRONLY | O_CREAT, 0755);
write(fd, self.buf, self.sz);
close(fd);
}
bool MagiskInit::patch_sepolicy(const char *file) {
bool patch_init = false;
sepolicy *sepol = nullptr;
@ -135,15 +108,17 @@ bool MagiskInit::patch_sepolicy(const char *file) {
sepol->magisk_rules();
// Custom rules
if (auto dir = open_dir(persist_dir.data()); dir) {
if (!custom_rules_dir.empty()) {
if (auto dir = open_dir(custom_rules_dir.data())) {
for (dirent *entry; (entry = xreaddir(dir.get()));) {
auto rule = persist_dir + "/" + entry->d_name + "/sepolicy.rule";
auto rule = custom_rules_dir + "/" + entry->d_name + "/sepolicy.rule";
if (access(rule.data(), R_OK) == 0) {
LOGD("Loading custom sepolicy patch: %s\n", rule.data());
sepol->load_rule_file(rule.data());
}
}
}
}
sepol->to_file(file);
delete sepol;
@ -229,9 +204,8 @@ void SARBase::patch_rootdir() {
}
setup_tmp(tmp_dir);
persist_dir = MIRRDIR "/persist/magisk";
chdir(tmp_dir);
mount_rules_dir(BLOCKDIR, MIRRDIR);
// Mount system_root mirror
struct stat st;
@ -317,11 +291,55 @@ void SARBase::patch_rootdir() {
chdir("/");
}
#define TMP_MNTDIR "/dev/mnt"
#define TMP_RULESDIR "/.backup/.sepolicy.rules"
void RootFSInit::setup_rootfs() {
// Handle custom sepolicy rules
xmkdir(TMP_MNTDIR, 0755);
mount_rules_dir("/dev/block", TMP_MNTDIR);
// Preserve custom rule path
if (!custom_rules_dir.empty()) {
string rules_dir = "./" + custom_rules_dir.substr(sizeof(TMP_MNTDIR));
xsymlink(rules_dir.data(), TMP_RULESDIR);
}
if (patch_sepolicy("/sepolicy")) {
auto init = raw_data::mmap_rw("/init");
init.patch({ make_pair(SPLIT_PLAT_CIL, "xxx") });
}
// Handle overlays
if (access("/overlay.d", F_OK) == 0) {
LOGD("Merge overlay.d\n");
load_overlay_rc("/overlay.d");
mv_path("/overlay.d", "/");
}
patch_init_rc("/init.rc", "/init.p.rc", "/sbin");
rename("/init.p.rc", "/init.rc");
// Create hardlink mirror of /sbin to /root
mkdir("/root", 0750);
clone_attr("/sbin", "/root");
link_path("/sbin", "/root");
// Dump magiskinit as magisk
int fd = xopen("/sbin/magisk", O_WRONLY | O_CREAT, 0755);
write(fd, self.buf, self.sz);
close(fd);
}
void MagiskProxy::start() {
// Mount rootfs as rw to do post-init rootfs patches
xmount(nullptr, "/", nullptr, MS_REMOUNT, nullptr);
// Backup stuffs before removing them
self = raw_data::read("/sbin/magisk");
config = raw_data::read("/.backup/.magisk");
xmount(nullptr, "/", nullptr, MS_REMOUNT, nullptr);
char custom_rules_dir[64];
custom_rules_dir[0] = '\0';
xreadlink(TMP_RULESDIR, custom_rules_dir, sizeof(custom_rules_dir));
unlink("/sbin/magisk");
rm_rf("/.backup");
@ -331,6 +349,10 @@ void MagiskProxy::start() {
// Create symlinks pointing back to /root
recreate_sbin("/root", false);
if (custom_rules_dir[0])
xsymlink(custom_rules_dir, "/sbin/" RULESDIR);
// Tell magiskd to remount rootfs
setenv("REMOUNT_ROOT", "1", 1);
execv("/sbin/magisk", argv);
}

View File

@ -178,5 +178,8 @@ ui_print "- Repacking boot image"
# Sign chromeos boot
$CHROMEOS && sign_chromeos
# Copy existing rules for migration
$BOOTMODE && copy_sepolicy_rules
# Reset any error code
true

View File

@ -15,7 +15,6 @@ TMPDIR=/dev/tmp
INSTALLER=$TMPDIR/install
CHROMEDIR=$INSTALLER/chromeos
PERSISTDIR=/sbin/.magisk/mirror/persist
# Default permissions
umask 022
@ -36,7 +35,12 @@ setup_flashable
print_title "Magisk Uninstaller"
is_mounted /data || mount /data || abort "! Unable to mount /data, please uninstall with Magisk Manager"
is_mounted /cache || mount /cache 2>/dev/null
if ! $BOOTMODE; then
# Mounting stuffs in recovery (best effort)
mount_name metadata /metadata
mount_name "cache cac" /cache
mount_name persist /persist
fi
mount_partitions
api_level_arch_detect
@ -141,7 +145,8 @@ ui_print "- Removing Magisk files"
rm -rf \
/cache/*magisk* /cache/unblock /data/*magisk* /data/cache/*magisk* /data/property/*magisk* \
/data/Magisk.apk /data/busybox /data/custom_ramdisk_patch.sh /data/adb/*magisk* \
/data/adb/post-fs-data.d /data/adb/service.d /data/adb/modules* $PERSISTDIR/magisk 2>/dev/null
/data/adb/post-fs-data.d /data/adb/service.d /data/adb/modules* \
/data/unencrypted/magisk /metadata/magisk /persist/magisk /mnt/vendor/persist/magisk
if [ -f /system/addon.d/99-magisk.sh ]; then
blockdev --setrw /dev/block/mapper/system$SLOT 2>/dev/null
@ -158,7 +163,7 @@ if $BOOTMODE; then
ui_print "********************************************"
(sleep 8; /system/bin/reboot)&
else
rm -rf /data/user*/*/*magisk* /data/app/*magisk*
rm -rf /data/data/*magisk* /data/user*/*/*magisk* /data/app/*magisk* /data/app/*/*magisk*
recovery_cleanup
ui_print "- Done"
fi

View File

@ -152,6 +152,7 @@ recovery_cleanup() {
fi
umount -l /vendor
umount -l /persist
umount -l /metadata
for DIR in /apex /system /system_root; do
if [ -L "${DIR}_link" ]; then
rmdir $DIR
@ -217,13 +218,13 @@ mount_name() {
local FLAG=$3
setup_mntpoint $POINT
is_mounted $POINT && return
ui_print "- Mounting $POINT"
# First try mounting with fstab
mount $FLAG $POINT 2>/dev/null
if ! is_mounted $POINT; then
local BLOCK=`find_block $PART`
mount $FLAG $BLOCK $POINT
local BLOCK=$(find_block $PART)
mount $FLAG $BLOCK $POINT || return
fi
ui_print "- Mounting $POINT"
}
# mount_ro_ensure <partname(s)> <mountpoint>
@ -266,18 +267,6 @@ mount_partitions() {
# Allow /system/bin commands (dalvikvm) on Android 10+ in recovery
$BOOTMODE || mount_apex
# Mount persist partition in recovery
if ! $BOOTMODE && [ ! -z $PERSISTDIR ]; then
# Try to mount persist
PERSISTDIR=/persist
mount_name persist /persist
if ! is_mounted /persist; then
# Fallback to cache
mount_name "cache cac" /cache
is_mounted /cache && PERSISTDIR=/cache || PERSISTDIR=
fi
fi
}
# loop_setup <ext4_img>, sets LOOPDEV
@ -575,6 +564,41 @@ run_migrations() {
done
}
copy_sepolicy_rules() {
# Remove all existing rule folders
rm -rf /data/unencrypted/magisk /metadata/magisk /persist/magisk /mnt/vendor/persist/magisk
# Find current active RULESDIR
local RULESDIR
local active_dir=$(magisk --path)/.magisk/mirror/sepolicy.rules
if [ -e $active_dir ]; then
RULESDIR=$(readlink -f $active_dir)
elif [ -d /data/unencrypted ] && ! grep ' /data ' /proc/mounts | grep -q 'dm-'; then
RULESDIR=/data/unencrypted/magisk
elif grep -q ' /cache ' /proc/mounts; then
RULESDIR=/cache/magisk
elif grep -q ' /metadata ' /proc/mounts; then
RULESDIR=/metadata/magisk
elif grep -q ' /persist ' /proc/mounts; then
RULESDIR=/persist/magisk
elif grep -q ' /mnt/vendor/persist ' /proc/mounts; then
RULESDIR=/mnt/vendor/persist/magisk
else
return
fi
# Copy all enabled sepolicy.rule
for r in /data/adb/modules*/*/sepolicy.rule; do
[ -f "$r" ] || continue
local MODDIR=${r%/*}
[ -f $MODDIR/disable ] && continue
[ -f $MODDIR/remove ] && continue
local MODNAME=${MODDIR##*/}
mkdir -p $RULESDIR/$MODNAME
cp -f $r $RULESDIR/$MODNAME/sepolicy.rule
done
}
#################
# Module Related
#################
@ -620,9 +644,6 @@ is_legacy_script() {
# Require OUTFD, ZIPFILE to be set
install_module() {
local PERSISTDIR
command -v magisk >/dev/null && PERSISTDIR=$(magisk --path)/mirror/persist
rm -rf $TMPDIR
mkdir -p $TMPDIR
@ -646,7 +667,7 @@ install_module() {
MODPATH=$MODULEROOT/$MODID
# Create mod paths
rm -rf $MODPATH 2>/dev/null
rm -rf $MODPATH
mkdir -p $MODPATH
if is_legacy_script; then
@ -699,19 +720,15 @@ install_module() {
fi
# Copy over custom sepolicy rules
if [ -f $MODPATH/sepolicy.rule -a -e "$PERSISTDIR" ]; then
ui_print "- Installing custom sepolicy patch"
# Remove old recovery logs (which may be filling partition) to make room
rm -f $PERSISTDIR/cache/recovery/*
PERSISTMOD=$PERSISTDIR/magisk/$MODID
mkdir -p $PERSISTMOD
cp -af $MODPATH/sepolicy.rule $PERSISTMOD/sepolicy.rule || abort "! Insufficient partition size"
if [ -f $MODPATH/sepolicy.rule ]; then
ui_print "- Installing custom sepolicy rules"
copy_sepolicy_rules
fi
# Remove stuffs that don't belong to modules
rm -rf \
$MODPATH/system/placeholder $MODPATH/customize.sh \
$MODPATH/README.md $MODPATH/.git* 2>/dev/null
$MODPATH/README.md $MODPATH/.git*
cd /
$BOOTMODE || recovery_cleanup