MarcoBuster/Magisk
1
1
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Major refactor on sepolicy

Browse Source
This commit is contained in:
topjohnwu 2018-04-15 03:13:01 +08:00
parent 21a557a184
commit 31110b1927
2 changed files with 92 additions and 97 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
magiskpolicy.h
View File

@ -7,6 +7,8 @@
#include <stdlib.h> #include <stdlib.h>
#define ALL NULL #define ALL NULL
#define SEPOL_PROC_DOMAIN "magisk"
#define SEPOL_FILE_DOMAIN "magisk_file"
// policydb functions // policydb functions
int load_policydb(const char *filename); int load_policydb(const char *filename);

187
rules.c
View File

@ -4,72 +4,72 @@
void allowSuClient(char *target) { void allowSuClient(char *target) {
if (!sepol_exists(target)) if (!sepol_exists(target))
return; return;
sepol_allow(target, "rootfs", "file", ALL); sepol_allow(target, SEPOL_PROC_DOMAIN, "unix_stream_socket", "connectto");
sepol_allow(target, "rootfs", "lnk_file", ALL); sepol_allow(target, SEPOL_PROC_DOMAIN, "unix_stream_socket", "getopt");
sepol_allow(target, "su", "unix_stream_socket", "connectto");
sepol_allow(target, "su", "unix_stream_socket", "getopt");
sepol_allow(target, "su_file", "sock_file", "read");
sepol_allow(target, "su_file", "sock_file", "write");
sepol_allow(target, "su_file", "file", ALL);
sepol_allow(target, "su_file", "dir", ALL);
sepol_allow(target, "devpts", "chr_file", "ioctl"); sepol_allow(target, "devpts", "chr_file", "ioctl");
sepol_allow("su", target, "fd", "use"); sepol_allow(SEPOL_PROC_DOMAIN, target, "fd", "use");
sepol_allow("su", target, "fifo_file", ALL); sepol_allow(SEPOL_PROC_DOMAIN, target, "fifo_file", ALL);
// Allow access to magisk files
sepol_allow(target, SEPOL_FILE_DOMAIN, "sock_file", "read");
sepol_allow(target, SEPOL_FILE_DOMAIN, "sock_file", "write");
sepol_allow(target, SEPOL_FILE_DOMAIN, "file", ALL);
sepol_allow(target, SEPOL_FILE_DOMAIN, "dir", ALL);
} }
void suRights() { void suRights() {
sepol_allow("servicemanager", "su", "dir", "search"); sepol_allow("servicemanager", SEPOL_PROC_DOMAIN, "dir", "search");
sepol_allow("servicemanager", "su", "dir", "read"); sepol_allow("servicemanager", SEPOL_PROC_DOMAIN, "dir", "read");
sepol_allow("servicemanager", "su", "file", "open"); sepol_allow("servicemanager", SEPOL_PROC_DOMAIN, "file", "open");
sepol_allow("servicemanager", "su", "file", "read"); sepol_allow("servicemanager", SEPOL_PROC_DOMAIN, "file", "read");
sepol_allow("servicemanager", "su", "process", "getattr"); sepol_allow("servicemanager", SEPOL_PROC_DOMAIN, "process", "getattr");
sepol_allow("servicemanager", "su", "binder", "transfer"); sepol_allow("servicemanager", SEPOL_PROC_DOMAIN, "binder", "transfer");
sepol_allow("system_server", "su", "binder", "call"); sepol_allow("system_server", SEPOL_PROC_DOMAIN, "binder", "call");
sepol_allow("system_server", "su", "fd", "use"); sepol_allow("system_server", SEPOL_PROC_DOMAIN, "fd", "use");
sepol_allow("su", "servicemanager", "dir", "search"); sepol_allow(SEPOL_PROC_DOMAIN, "servicemanager", "dir", "search");
sepol_allow("su", "servicemanager", "dir", "read"); sepol_allow(SEPOL_PROC_DOMAIN, "servicemanager", "dir", "read");
sepol_allow("su", "servicemanager", "file", "open"); sepol_allow(SEPOL_PROC_DOMAIN, "servicemanager", "file", "open");
sepol_allow("su", "servicemanager", "file", "read"); sepol_allow(SEPOL_PROC_DOMAIN, "servicemanager", "file", "read");
sepol_allow("su", "servicemanager", "process", "getattr"); sepol_allow(SEPOL_PROC_DOMAIN, "servicemanager", "process", "getattr");
sepol_allow("su", "servicemanager", "binder", "transfer"); sepol_allow(SEPOL_PROC_DOMAIN, "servicemanager", "binder", "transfer");
sepol_allow("su", "servicemanager", "binder", "call"); sepol_allow(SEPOL_PROC_DOMAIN, "servicemanager", "binder", "call");
sepol_allow("su", "system_server", "binder", "transfer"); sepol_allow(SEPOL_PROC_DOMAIN, "system_server", "binder", "transfer");
sepol_allow("su", "system_server", "binder", "call"); sepol_allow(SEPOL_PROC_DOMAIN, "system_server", "binder", "call");
} }
void otherToSU() { void otherToSU() {
// allowLog // allowLog
sepol_allow("logd", "su", "dir", "search"); sepol_allow("logd", SEPOL_PROC_DOMAIN, "dir", "search");
sepol_allow("logd", "su", "file", "read"); sepol_allow("logd", SEPOL_PROC_DOMAIN, "file", "read");
sepol_allow("logd", "su", "file", "open"); sepol_allow("logd", SEPOL_PROC_DOMAIN, "file", "open");
sepol_allow("logd", "su", "file", "getattr"); sepol_allow("logd", SEPOL_PROC_DOMAIN, "file", "getattr");
// suBackL0 // suBackL0
sepol_allow("system_server", "su", "binder", "call"); sepol_allow("system_server", SEPOL_PROC_DOMAIN, "binder", "call");
sepol_allow("system_server", "su", "binder", "transfer"); sepol_allow("system_server", SEPOL_PROC_DOMAIN, "binder", "transfer");
// ES Explorer opens a sokcet // ES Explorer opens a sokcet
sepol_allow("untrusted_app", "su", "unix_stream_socket", "ioctl"); sepol_allow("untrusted_app", SEPOL_PROC_DOMAIN, "unix_stream_socket", "ioctl");
sepol_allow("untrusted_app", "su", "unix_stream_socket", "read"); sepol_allow("untrusted_app", SEPOL_PROC_DOMAIN, "unix_stream_socket", "read");
sepol_allow("untrusted_app", "su", "unix_stream_socket", "getattr"); sepol_allow("untrusted_app", SEPOL_PROC_DOMAIN, "unix_stream_socket", "getattr");
sepol_allow("untrusted_app", "su", "unix_stream_socket", "write"); sepol_allow("untrusted_app", SEPOL_PROC_DOMAIN, "unix_stream_socket", "write");
sepol_allow("untrusted_app", "su", "unix_stream_socket", "setattr"); sepol_allow("untrusted_app", SEPOL_PROC_DOMAIN, "unix_stream_socket", "setattr");
sepol_allow("untrusted_app", "su", "unix_stream_socket", "lock"); sepol_allow("untrusted_app", SEPOL_PROC_DOMAIN, "unix_stream_socket", "lock");
sepol_allow("untrusted_app", "su", "unix_stream_socket", "append"); sepol_allow("untrusted_app", SEPOL_PROC_DOMAIN, "unix_stream_socket", "append");
sepol_allow("untrusted_app", "su", "unix_stream_socket", "bind"); sepol_allow("untrusted_app", SEPOL_PROC_DOMAIN, "unix_stream_socket", "bind");
sepol_allow("untrusted_app", "su", "unix_stream_socket", "connect"); sepol_allow("untrusted_app", SEPOL_PROC_DOMAIN, "unix_stream_socket", "connect");
sepol_allow("untrusted_app", "su", "unix_stream_socket", "getopt"); sepol_allow("untrusted_app", SEPOL_PROC_DOMAIN, "unix_stream_socket", "getopt");
sepol_allow("untrusted_app", "su", "unix_stream_socket", "setopt"); sepol_allow("untrusted_app", SEPOL_PROC_DOMAIN, "unix_stream_socket", "setopt");
sepol_allow("untrusted_app", "su", "unix_stream_socket", "shutdown"); sepol_allow("untrusted_app", SEPOL_PROC_DOMAIN, "unix_stream_socket", "shutdown");
sepol_allow("untrusted_app", "su", "unix_stream_socket", "connectto"); sepol_allow("untrusted_app", SEPOL_PROC_DOMAIN, "unix_stream_socket", "connectto");
// Any domain is allowed to send su "sigchld" // Any domain is allowed to send su "sigchld"
sepol_allow(ALL, "su", "process", "sigchld"); sepol_allow(ALL, SEPOL_PROC_DOMAIN, "process", "sigchld");
// uNetworkL0 // uNetworkL0
sepol_attradd("su", "netdomain"); sepol_attradd(SEPOL_PROC_DOMAIN, "netdomain");
sepol_attradd("su", "bluetoothdomain"); sepol_attradd(SEPOL_PROC_DOMAIN, "bluetoothdomain");
// suBackL6 // suBackL6
sepol_allow("surfaceflinger", "app_data_file", "dir", ALL); sepol_allow("surfaceflinger", "app_data_file", "dir", ALL);
@ -82,43 +82,36 @@ void otherToSU() {
sepol_allow("audioserver", "audioserver", "process", "execmem"); sepol_allow("audioserver", "audioserver", "process", "execmem");
// Liveboot // Liveboot
sepol_allow("surfaceflinger", "su", "process", "ptrace"); sepol_allow("surfaceflinger", SEPOL_PROC_DOMAIN, "process", "ptrace");
sepol_allow("surfaceflinger", "su", "binder", "transfer"); sepol_allow("surfaceflinger", SEPOL_PROC_DOMAIN, "binder", "transfer");
sepol_allow("surfaceflinger", "su", "binder", "call"); sepol_allow("surfaceflinger", SEPOL_PROC_DOMAIN, "binder", "call");
sepol_allow("surfaceflinger", "su", "fd", "use"); sepol_allow("surfaceflinger", SEPOL_PROC_DOMAIN, "fd", "use");
sepol_allow("debuggerd", "su", "process", "ptrace"); sepol_allow("debuggerd", SEPOL_PROC_DOMAIN, "process", "ptrace");
// dumpsys // dumpsys
sepol_allow(ALL, "su", "fd", "use"); sepol_allow(ALL, SEPOL_PROC_DOMAIN, "fd", "use");
sepol_allow(ALL, "su", "fifo_file", "write"); sepol_allow(ALL, SEPOL_PROC_DOMAIN, "fifo_file", "write");
sepol_allow(ALL, "su", "fifo_file", "read"); sepol_allow(ALL, SEPOL_PROC_DOMAIN, "fifo_file", "read");
sepol_allow(ALL, "su", "fifo_file", "open"); sepol_allow(ALL, SEPOL_PROC_DOMAIN, "fifo_file", "open");
sepol_allow(ALL, "su", "fifo_file", "getattr"); sepol_allow(ALL, SEPOL_PROC_DOMAIN, "fifo_file", "getattr");
} }
void sepol_magisk_rules() { void sepol_magisk_rules() {
// First prevent anything to change sepolicy except ourselves // First prevent anything to change sepolicy except ourselves
sepol_deny(ALL, "kernel", "security", "load_policy"); sepol_deny(ALL, "kernel", "security", "load_policy");
if (!sepol_exists("su")) if (!sepol_exists(SEPOL_PROC_DOMAIN))
sepol_create("su"); sepol_create(SEPOL_PROC_DOMAIN);
if (!sepol_exists("su_file")) if (!sepol_exists(SEPOL_FILE_DOMAIN))
sepol_create("su_file"); sepol_create(SEPOL_FILE_DOMAIN);
sepol_permissive("su"); sepol_permissive(SEPOL_PROC_DOMAIN);
sepol_attradd("su", "mlstrustedsubject"); sepol_attradd(SEPOL_PROC_DOMAIN, "mlstrustedsubject");
sepol_attradd("su_file", "mlstrustedobject"); sepol_attradd(SEPOL_FILE_DOMAIN, "mlstrustedobject");
// Allow magiskinit daemon to run and run in su context
sepol_allow("kernel", "device", "dir", ALL);
sepol_allow("kernel", "device", "file", ALL);
sepol_allow("kernel", "su", "unix_stream_socket", "connectto");
sepol_allow("kernel", "kernel", "process", "setcurrent");
sepol_allow("kernel", "su", "process", "dyntransition");
// Let init run stuffs // Let init run stuffs
sepol_allow("kernel", "su", "fd", "use"); sepol_allow("kernel", SEPOL_PROC_DOMAIN, "fd", "use");
sepol_allow("init", "su", "process", ALL); sepol_allow("init", SEPOL_PROC_DOMAIN, "process", ALL);
sepol_allow("init", "system_file", "dir", ALL); sepol_allow("init", "system_file", "dir", ALL);
sepol_allow("init", "system_file", "lnk_file", ALL); sepol_allow("init", "system_file", "lnk_file", ALL);
sepol_allow("init", "system_file", "file", ALL); sepol_allow("init", "system_file", "file", ALL);
@ -126,18 +119,19 @@ void sepol_magisk_rules() {
// Shell, properties, logs // Shell, properties, logs
if (sepol_exists("default_prop")) if (sepol_exists("default_prop"))
sepol_allow("su", "default_prop", "property_service", "set"); sepol_allow(SEPOL_PROC_DOMAIN, "default_prop", "property_service", "set");
sepol_allow("su", "init", "unix_stream_socket", "connectto"); sepol_allow(SEPOL_PROC_DOMAIN, "init", "unix_stream_socket", "connectto");
sepol_allow("su", "rootfs", "filesystem", "remount"); sepol_allow(SEPOL_PROC_DOMAIN, "rootfs", "filesystem", "remount");
if (sepol_exists("logd")) if (sepol_exists("logd"))
sepol_allow("su", "logd", "unix_stream_socket", "connectto"); sepol_allow(SEPOL_PROC_DOMAIN, "logd", "unix_stream_socket", "connectto");
sepol_allow("su", "su", ALL, ALL); sepol_allow(SEPOL_PROC_DOMAIN, SEPOL_PROC_DOMAIN, ALL, ALL);
// For sepolicy live patching // For sepolicy live patching
sepol_allow("su", "kernel", "security", "read_policy"); sepol_allow(SEPOL_PROC_DOMAIN, "kernel", "security", "read_policy");
sepol_allow("su", "kernel", "security", "load_policy"); sepol_allow(SEPOL_PROC_DOMAIN, "kernel", "security", "load_policy");
// Allow these client to access su // Allow these client to access su
allowSuClient("init");
allowSuClient("shell"); allowSuClient("shell");
allowSuClient("untrusted_app"); allowSuClient("untrusted_app");
allowSuClient("system_app"); allowSuClient("system_app");
@ -151,26 +145,26 @@ void sepol_magisk_rules() {
otherToSU(); otherToSU();
// For mounting loop devices, mirrors, tmpfs // For mounting loop devices, mirrors, tmpfs
sepol_allow("su", "kernel", "process", "setsched"); sepol_allow(SEPOL_PROC_DOMAIN, "kernel", "process", "setsched");
sepol_allow("su", "labeledfs", "filesystem", "mount"); sepol_allow(SEPOL_PROC_DOMAIN, "labeledfs", "filesystem", "mount");
sepol_allow("su", "labeledfs", "filesystem", "unmount"); sepol_allow(SEPOL_PROC_DOMAIN, "labeledfs", "filesystem", "unmount");
sepol_allow("su", "tmpfs", "filesystem", "mount"); sepol_allow(SEPOL_PROC_DOMAIN, "tmpfs", "filesystem", "mount");
sepol_allow("su", "tmpfs", "filesystem", "unmount"); sepol_allow(SEPOL_PROC_DOMAIN, "tmpfs", "filesystem", "unmount");
sepol_allow("kernel", ALL, "file", "read"); sepol_allow("kernel", ALL, "file", "read");
// Allow su to do anything to any files/dir/links // Allow su to do anything to any files/dir/links
sepol_allow("su", ALL, "file", ALL); sepol_allow(SEPOL_PROC_DOMAIN, ALL, "file", ALL);
sepol_allow("su", ALL, "dir", ALL); sepol_allow(SEPOL_PROC_DOMAIN, ALL, "dir", ALL);
sepol_allow("su", ALL, "lnk_file", ALL); sepol_allow(SEPOL_PROC_DOMAIN, ALL, "lnk_file", ALL);
sepol_allow("su", ALL, "blk_file", ALL); sepol_allow(SEPOL_PROC_DOMAIN, ALL, "blk_file", ALL);
sepol_allow("su", ALL, "sock_file", ALL); sepol_allow(SEPOL_PROC_DOMAIN, ALL, "sock_file", ALL);
sepol_allow("su", ALL, "chr_file", ALL); sepol_allow(SEPOL_PROC_DOMAIN, ALL, "chr_file", ALL);
sepol_allow("su", ALL, "fifo_file", ALL); sepol_allow(SEPOL_PROC_DOMAIN, ALL, "fifo_file", ALL);
// For changing attributes // For changing attributes
sepol_allow("rootfs", "tmpfs", "filesystem", "associate"); sepol_allow("rootfs", "tmpfs", "filesystem", "associate");
sepol_allow("su_file", "labeledfs", "filesystem", "associate"); sepol_allow(SEPOL_FILE_DOMAIN, "labeledfs", "filesystem", "associate");
sepol_allow("su_file", "tmpfs", "filesystem", "associate"); sepol_allow(SEPOL_FILE_DOMAIN, "tmpfs", "filesystem", "associate");
// Xposed // Xposed
sepol_allow("untrusted_app", "untrusted_app", "capability", "setgid"); sepol_allow("untrusted_app", "untrusted_app", "capability", "setgid");
@ -185,4 +179,3 @@ void sepol_magisk_rules() {
sepol_allowxperm("domain", "untrusted_app_devpts", "chr_file", "0x5400-0x54FF"); sepol_allowxperm("domain", "untrusted_app_devpts", "chr_file", "0x5400-0x54FF");
} }
} }