MarcoBuster/Magisk
1
1
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Small sepolicy refactor and fixes

Browse Source
This commit is contained in:
topjohnwu 2019-11-19 05:20:18 -05:00
parent 9aff1a57d3
commit d6fb9868bf
6 changed files with 149 additions and 170 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
native/jni/magiskpolicy/api.cpp
View File

@ -1,81 +1,84 @@
#include "magiskpolicy.h" #include "magiskpolicy.h"
#include "sepolicy.h" #include "sepolicy.h"
//#define vprint(fmt, ...) printf(fmt, __VA_ARGS__)
#define vprint(...)
int sepol_allow(const char *s, const char *t, const char *c, const char *p) { int sepol_allow(const char *s, const char *t, const char *c, const char *p) {
// printf("allow %s %s %s %s\n", s, t, c, p); vprint("allow %s %s %s %s\n", s, t, c, p);
return add_rule(s, t, c, p, AVTAB_ALLOWED, 0); return add_rule(s, t, c, p, AVTAB_ALLOWED, 0);
} }
int sepol_deny(const char *s, const char *t, const char *c, const char *p) { int sepol_deny(const char *s, const char *t, const char *c, const char *p) {
// printf("deny %s %s %s %s\n", s, t, c, p); vprint("deny %s %s %s %s\n", s, t, c, p);
return add_rule(s, t, c, p, AVTAB_ALLOWED, 1); return add_rule(s, t, c, p, AVTAB_ALLOWED, 1);
} }
int sepol_auditallow(const char *s, const char *t, const char *c, const char *p) { int sepol_auditallow(const char *s, const char *t, const char *c, const char *p) {
// printf("auditallow %s %s %s %s\n", s, t, c, p); vprint("auditallow %s %s %s %s\n", s, t, c, p);
return add_rule(s, t, c, p, AVTAB_AUDITALLOW, 0); return add_rule(s, t, c, p, AVTAB_AUDITALLOW, 0);
} }
int sepol_dontaudit(const char *s, const char *t, const char *c, const char *p) { int sepol_dontaudit(const char *s, const char *t, const char *c, const char *p) {
// printf("dontaudit %s %s %s %s\n", s, t, c, p); vprint("dontaudit %s %s %s %s\n", s, t, c, p);
return add_rule(s, t, c, p, AVTAB_AUDITDENY, 0); return add_rule(s, t, c, p, AVTAB_AUDITDENY, 1);
} }
int sepol_allowxperm(const char *s, const char *t, const char *c, const char *range) { int sepol_allowxperm(const char *s, const char *t, const char *c, const char *range) {
// printf("allowxperm %s %s %s %s\n", s, t, c, range); vprint("allowxperm %s %s %s %s\n", s, t, c, range);
return add_xperm_rule(s, t, c, range, AVTAB_XPERMS_ALLOWED, 0); return add_xperm_rule(s, t, c, range, AVTAB_XPERMS_ALLOWED, 0);
} }
int sepol_auditallowxperm(const char *s, const char *t, const char *c, const char *range) { int sepol_auditallowxperm(const char *s, const char *t, const char *c, const char *range) {
// printf("auditallowxperm %s %s %s %s\n", s, t, c, range); vprint("auditallowxperm %s %s %s %s\n", s, t, c, range);
return add_xperm_rule(s, t, c, range, AVTAB_XPERMS_AUDITALLOW, 0); return add_xperm_rule(s, t, c, range, AVTAB_XPERMS_AUDITALLOW, 0);
} }
int sepol_dontauditxperm(const char *s, const char *t, const char *c, const char *range) { int sepol_dontauditxperm(const char *s, const char *t, const char *c, const char *range) {
// printf("dontauditxperm %s %s %s %s\n", s, t, c, range); vprint("dontauditxperm %s %s %s %s\n", s, t, c, range);
return add_xperm_rule(s, t, c, range, AVTAB_XPERMS_DONTAUDIT, 0); return add_xperm_rule(s, t, c, range, AVTAB_XPERMS_DONTAUDIT, 0);
} }
int sepol_typetrans(const char *s, const char *t, const char *c, const char *d) { int sepol_typetrans(const char *s, const char *t, const char *c, const char *d) {
// printf("type_transition %s %s %s %s\n", s, t, c, d); vprint("type_transition %s %s %s %s\n", s, t, c, d);
return add_type_rule(s, t, c, d, AVTAB_TRANSITION); return add_type_rule(s, t, c, d, AVTAB_TRANSITION);
} }
int sepol_typechange(const char *s, const char *t, const char *c, const char *d) { int sepol_typechange(const char *s, const char *t, const char *c, const char *d) {
// printf("type_change %s %s %s %s\n", s, t, c, d); vprint("type_change %s %s %s %s\n", s, t, c, d);
return add_type_rule(s, t, c, d, AVTAB_CHANGE); return add_type_rule(s, t, c, d, AVTAB_CHANGE);
} }
int sepol_typemember(const char *s, const char *t, const char *c, const char *d) { int sepol_typemember(const char *s, const char *t, const char *c, const char *d) {
// printf("type_member %s %s %s %s\n", s, t, c, d); vprint("type_member %s %s %s %s\n", s, t, c, d);
return add_type_rule(s, t, c, d, AVTAB_MEMBER); return add_type_rule(s, t, c, d, AVTAB_MEMBER);
} }
int sepol_nametrans(const char *s, const char *t, const char *c, const char *d, const char *o) { int sepol_nametrans(const char *s, const char *t, const char *c, const char *d, const char *o) {
// printf("name_trans %s %s %s %s %s\n", s, t, c, d, o); vprint("name_trans %s %s %s %s %s\n", s, t, c, d, o);
return add_filename_trans(s, t, c, d, o); return add_filename_trans(s, t, c, d, o);
} }
int sepol_permissive(const char *s) { int sepol_permissive(const char *s) {
// printf("permissive %s\n", s); vprint("permissive %s\n", s);
return set_domain_state(s, 1); return set_domain_state(s, 1);
} }
int sepol_enforce(const char *s) { int sepol_enforce(const char *s) {
// printf("enforce %s\n", s); vprint("enforce %s\n", s);
return set_domain_state(s, 0); return set_domain_state(s, 0);
} }
int sepol_create(const char *s) { int sepol_create(const char *s) {
// printf("create %s\n", s); vprint("create %s\n", s);
return create_domain(s); return create_domain(s);
} }
int sepol_attradd(const char *s, const char *a) { int sepol_attradd(const char *s, const char *a) {
// printf("attradd %s %s\n", s, a); vprint("attradd %s %s\n", s, a);
return add_typeattribute(s, a); return add_typeattribute(s, a);
} }
int sepol_exists(const char *source) { int sepol_exists(const char *source) {
return hashtab_search(policydb->p_types.table, source) != nullptr; return hashtab_search(magisk_policydb->p_types.table, source) != nullptr;
} }

2
native/jni/magiskpolicy/magiskpolicy.cpp
View File

@ -487,7 +487,7 @@ int magiskpolicy_main(int argc, char *argv[]) {
} }
// Use current policy if nothing is loaded // Use current policy if nothing is loaded
if (policydb == nullptr && load_policydb(SELINUX_POLICY)) { if (magisk_policydb == nullptr && load_policydb(SELINUX_POLICY)) {
fprintf(stderr, "Cannot load policy from " SELINUX_POLICY "\n"); fprintf(stderr, "Cannot load policy from " SELINUX_POLICY "\n");
return 1; return 1;
} }

22
native/jni/magiskpolicy/policydb.cpp
View File

@ -11,10 +11,8 @@
#include "magiskpolicy.h" #include "magiskpolicy.h"
#include "sepolicy.h" #include "sepolicy.h"
policydb_t *policydb = nullptr;
int load_policydb(const char *file) { int load_policydb(const char *file) {
if (policydb) if (magisk_policydb)
destroy_policydb(); destroy_policydb();
struct policy_file pf; struct policy_file pf;
@ -22,8 +20,8 @@ int load_policydb(const char *file) {
pf.fp = xfopen(file, "re"); pf.fp = xfopen(file, "re");
pf.type = PF_USE_STDIO; pf.type = PF_USE_STDIO;
policydb = new policydb_t(); magisk_policydb = static_cast<policydb_t *>(xmalloc(sizeof(policydb_t)));
if (policydb_init(policydb) || policydb_read(policydb, &pf, 0)) if (policydb_init(magisk_policydb) || policydb_read(magisk_policydb, &pf, 0))
return 1; return 1;
fclose(pf.fp); fclose(pf.fp);
@ -169,7 +167,7 @@ int compile_split_cil() {
return 1; return 1;
cil_db_destroy(&db); cil_db_destroy(&db);
policydb = &pdb->p; magisk_policydb = &pdb->p;
return 0; return 0;
} }
@ -177,7 +175,7 @@ int dump_policydb(const char *file) {
int fd, ret; int fd, ret;
void *data = nullptr; void *data = nullptr;
size_t len; size_t len;
policydb_to_image(nullptr, policydb, &data, &len); policydb_to_image(nullptr, magisk_policydb, &data, &len);
if (data == nullptr) { if (data == nullptr) {
LOGE("Fail to dump policy image!\n"); LOGE("Fail to dump policy image!\n");
return 1; return 1;
@ -194,9 +192,9 @@ int dump_policydb(const char *file) {
} }
void destroy_policydb() { void destroy_policydb() {
if (policydb) { if (magisk_policydb) {
policydb_destroy(policydb); policydb_destroy(magisk_policydb);
delete policydb; free(magisk_policydb);
policydb = nullptr; magisk_policydb = nullptr;
} }
} }

10
native/jni/magiskpolicy/rules.cpp
View File

@ -21,7 +21,7 @@ static void allowSuClient(const char *target) {
sepol_allow(target, "untrusted_app_devpts", "chr_file", "ioctl"); sepol_allow(target, "untrusted_app_devpts", "chr_file", "ioctl");
sepol_allow(target, "untrusted_app_25_devpts", "chr_file", "ioctl"); sepol_allow(target, "untrusted_app_25_devpts", "chr_file", "ioctl");
sepol_allow(target, "untrusted_app_all_devpts", "chr_file", "ioctl"); sepol_allow(target, "untrusted_app_all_devpts", "chr_file", "ioctl");
if (policydb->policyvers >= POLICYDB_VERSION_XPERMS_IOCTL) { if (magisk_policydb->policyvers >= POLICYDB_VERSION_XPERMS_IOCTL) {
sepol_allowxperm(target, "devpts", "chr_file", "0x5400-0x54FF"); sepol_allowxperm(target, "devpts", "chr_file", "0x5400-0x54FF");
sepol_allowxperm(target, "untrusted_app_devpts", "chr_file", "0x5400-0x54FF"); sepol_allowxperm(target, "untrusted_app_devpts", "chr_file", "0x5400-0x54FF");
sepol_allowxperm(target, "untrusted_app_25_devpts", "chr_file", "0x5400-0x54FF"); sepol_allowxperm(target, "untrusted_app_25_devpts", "chr_file", "0x5400-0x54FF");
@ -166,7 +166,7 @@ void sepol_magisk_rules() {
sepol_allow(SEPOL_PROC_DOMAIN, ALL, "fifo_file", ALL); sepol_allow(SEPOL_PROC_DOMAIN, ALL, "fifo_file", ALL);
// Allow us to do any ioctl on all block devices // Allow us to do any ioctl on all block devices
if (policydb->policyvers >= POLICYDB_VERSION_XPERMS_IOCTL) if (magisk_policydb->policyvers >= POLICYDB_VERSION_XPERMS_IOCTL)
sepol_allowxperm(SEPOL_PROC_DOMAIN, ALL, "blk_file", "0x0000-0xFFFF"); sepol_allowxperm(SEPOL_PROC_DOMAIN, ALL, "blk_file", "0x0000-0xFFFF");
// Allow all binder transactions // Allow all binder transactions
@ -198,11 +198,7 @@ void sepol_magisk_rules() {
#ifdef MAGISK_DEBUG #ifdef MAGISK_DEBUG
// Remove all dontaudit in debug mode // Remove all dontaudit in debug mode
avtab_ptr_t av; strip_dontaudit();
avtab_for_each(&policydb->te_avtab, av, {
if (av->key.specified == AVTAB_AUDITDENY || av->key.specified == AVTAB_XPERMS_DONTAUDIT)
avtab_remove_node(&policydb->te_avtab, av);
})
#endif #endif
log_cb.w = bak; log_cb.w = bak;

225
native/jni/magiskpolicy/sepolicy.c
View File

@ -5,47 +5,44 @@
#include "sepolicy.h" #include "sepolicy.h"
policydb_t *magisk_policydb = NULL;
#define mpdb magisk_policydb
extern void *xmalloc(size_t size); extern void *xmalloc(size_t size);
extern void *xcalloc(size_t nmemb, size_t size); extern void *xcalloc(size_t nmemb, size_t size);
extern void *xrealloc(void *ptr, size_t size); extern void *xrealloc(void *ptr, size_t size);
extern int policydb_index_decls(sepol_handle_t * handle, policydb_t * p); extern int policydb_index_decls(sepol_handle_t * handle, policydb_t * p);
static int get_attr(const char *type, int value) { // Generic hash table traversal
type_datum_t *attr = hashtab_search(policydb->p_types.table, type); #define hash_for_each(node_ptr, n_slots, table, block) \
if (!attr) for (int __i = 0; __i < (table)->n_slots; ++__i) { \
return 1; __typeof__(*(table)->node_ptr) node; \
__typeof__(node) __next; \
for (node = (table)->node_ptr[__i]; node; node = __next) { \
__next = node->next; \
block \
} \
} \
if (attr->flavor != TYPE_ATTRIB) // hashtab traversal
return 1; #define hashtab_for_each(hashtab, block) \
hash_for_each(htable, size, hashtab, block)
return ebitmap_get_bit(&policydb->attr_type_map[attr->s.value - 1], value - 1) != 0; // avtab traversal
} #define avtab_for_each(avtab, block) \
hash_for_each(htable, nslot, avtab, block)
static int get_attr_id(const char *type) {
type_datum_t *attr = hashtab_search(policydb->p_types.table, type);
if (!attr)
return 1;
if (attr->flavor != TYPE_ATTRIB)
return 1;
return attr->s.value;
}
static int set_attr(const char *type, int value) { static int set_attr(const char *type, int value) {
type_datum_t *attr = hashtab_search(policydb->p_types.table, type); type_datum_t *attr = hashtab_search(mpdb->p_types.table, type);
if (!attr) if (!attr || attr->flavor != TYPE_ATTRIB)
return 1; return -1;
if (attr->flavor != TYPE_ATTRIB) if (ebitmap_set_bit(&mpdb->type_attr_map[value - 1], attr->s.value - 1, 1))
return 1; return -1;
if (ebitmap_set_bit(&mpdb->attr_type_map[attr->s.value - 1], value - 1, 1))
return -1;
if(ebitmap_set_bit(&policydb->type_attr_map[value - 1], attr->s.value - 1, 1)) return attr->s.value;
return 1;
if(ebitmap_set_bit(&policydb->attr_type_map[attr->s.value - 1], value - 1, 1))
return 1;
return 0;
} }
static void check_avtab_node(avtab_ptr_t node) { static void check_avtab_node(avtab_ptr_t node) {
@ -57,7 +54,7 @@ static void check_avtab_node(avtab_ptr_t node) {
else else
redundant = node->datum.data == 0U; redundant = node->datum.data == 0U;
if (redundant) if (redundant)
avtab_remove_node(&policydb->te_avtab, node); avtab_remove_node(&mpdb->te_avtab, node);
} }
static avtab_ptr_t get_avtab_node(avtab_key_t *key, avtab_extended_perms_t *xperms) { static avtab_ptr_t get_avtab_node(avtab_key_t *key, avtab_extended_perms_t *xperms) {
@ -67,7 +64,7 @@ static avtab_ptr_t get_avtab_node(avtab_key_t *key, avtab_extended_perms_t *xper
/* AVTAB_XPERMS entries are not necessarily unique */ /* AVTAB_XPERMS entries are not necessarily unique */
if (key->specified & AVTAB_XPERMS) { if (key->specified & AVTAB_XPERMS) {
node = avtab_search_node(&policydb->te_avtab, key); node = avtab_search_node(&mpdb->te_avtab, key);
while (node) { while (node) {
if ((node->datum.xperms->specified == xperms->specified) && if ((node->datum.xperms->specified == xperms->specified) &&
(node->datum.xperms->driver == xperms->driver)) { (node->datum.xperms->driver == xperms->driver)) {
@ -79,7 +76,7 @@ static avtab_ptr_t get_avtab_node(avtab_key_t *key, avtab_extended_perms_t *xper
if (!match) if (!match)
node = NULL; node = NULL;
} else { } else {
node = avtab_search_node(&policydb->te_avtab, key); node = avtab_search_node(&mpdb->te_avtab, key);
} }
if (!node) { if (!node) {
@ -90,26 +87,27 @@ static avtab_ptr_t get_avtab_node(avtab_key_t *key, avtab_extended_perms_t *xper
*/ */
avdatum.data = key->specified == AVTAB_AUDITDENY ? ~0U : 0U; avdatum.data = key->specified == AVTAB_AUDITDENY ? ~0U : 0U;
/* this is used to get the node - insertion is actually unique */ /* this is used to get the node - insertion is actually unique */
node = avtab_insert_nonunique(&policydb->te_avtab, key, &avdatum); node = avtab_insert_nonunique(&mpdb->te_avtab, key, &avdatum);
} }
return node; return node;
} }
static int add_avrule(avtab_key_t *key, int p, int not) { static int add_avrule(avtab_key_t *key, int val, int not) {
avtab_ptr_t node = get_avtab_node(key, NULL); avtab_ptr_t node = get_avtab_node(key, NULL);
// Support DONTAUDIT (AUDITDENY is inverted)
if (AVTAB_AUDITDENY == node->key.specified == !not) { if (not) {
if (p < 0) if (val < 0)
node->datum.data = 0U; node->datum.data = 0U;
else else
node->datum.data &= ~(1U << (p - 1)); node->datum.data &= ~(1U << (val - 1));
} else { } else {
if (p < 0) if (val < 0)
node->datum.data = ~0U; node->datum.data = ~0U;
else else
node->datum.data |= 1U << (p - 1); node->datum.data |= 1U << (val - 1);
} }
check_avtab_node(node); check_avtab_node(node);
return 0; return 0;
} }
@ -117,22 +115,21 @@ static int add_avrule(avtab_key_t *key, int p, int not) {
static int add_rule_auto(type_datum_t *src, type_datum_t *tgt, class_datum_t *cls, static int add_rule_auto(type_datum_t *src, type_datum_t *tgt, class_datum_t *cls,
perm_datum_t *perm, int effect, int not) { perm_datum_t *perm, int effect, int not) {
avtab_key_t key; avtab_key_t key;
hashtab_ptr_t cur;
int ret = 0; int ret = 0;
if (src == NULL) { if (src == NULL) {
hashtab_for_each(policydb->p_types.table, cur, { hashtab_for_each(mpdb->p_types.table, {
src = cur->datum; src = node->datum;
ret |= add_rule_auto(src, tgt, cls, perm, effect, not); ret |= add_rule_auto(src, tgt, cls, perm, effect, not);
}) })
} else if (tgt == NULL) { } else if (tgt == NULL) {
hashtab_for_each(policydb->p_types.table, cur, { hashtab_for_each(mpdb->p_types.table, {
tgt = cur->datum; tgt = node->datum;
ret |= add_rule_auto(src, tgt, cls, perm, effect, not); ret |= add_rule_auto(src, tgt, cls, perm, effect, not);
}) })
} else if (cls == NULL) { } else if (cls == NULL) {
hashtab_for_each(policydb->p_classes.table, cur, { hashtab_for_each(mpdb->p_classes.table, {
cls = cur->datum; cls = node->datum;
ret |= add_rule_auto(src, tgt, cls, perm, effect, not); ret |= add_rule_auto(src, tgt, cls, perm, effect, not);
}) })
} else { } else {
@ -189,22 +186,21 @@ static int add_avxrule(avtab_key_t *key, uint16_t low, uint16_t high, int not) {
static int add_xperm_rule_auto(type_datum_t *src, type_datum_t *tgt, class_datum_t *cls, static int add_xperm_rule_auto(type_datum_t *src, type_datum_t *tgt, class_datum_t *cls,
uint16_t low, uint16_t high, int effect, int not) { uint16_t low, uint16_t high, int effect, int not) {
avtab_key_t key; avtab_key_t key;
hashtab_ptr_t cur;
int ret = 0; int ret = 0;
if (src == NULL) { if (src == NULL) {
hashtab_for_each(policydb->p_types.table, cur, { hashtab_for_each(mpdb->p_types.table, {
src = cur->datum; src = node->datum;
ret |= add_xperm_rule_auto(src, tgt, cls, low, high, effect, not); ret |= add_xperm_rule_auto(src, tgt, cls, low, high, effect, not);
}) })
} else if (tgt == NULL) { } else if (tgt == NULL) {
hashtab_for_each(policydb->p_types.table, cur, { hashtab_for_each(mpdb->p_types.table, {
tgt = cur->datum; tgt = node->datum;
ret |= add_xperm_rule_auto(src, tgt, cls, low, high, effect, not); ret |= add_xperm_rule_auto(src, tgt, cls, low, high, effect, not);
}) })
} else if (cls == NULL) { } else if (cls == NULL) {
hashtab_for_each(policydb->p_classes.table, cur, { hashtab_for_each(mpdb->p_classes.table, {
cls = cur->datum; cls = node->datum;
ret |= add_xperm_rule_auto(src, tgt, cls, low, high, effect, not); ret |= add_xperm_rule_auto(src, tgt, cls, low, high, effect, not);
}) })
} else { } else {
@ -218,50 +214,50 @@ static int add_xperm_rule_auto(type_datum_t *src, type_datum_t *tgt, class_datum
} }
int create_domain(const char *d) { int create_domain(const char *d) {
symtab_datum_t *src = hashtab_search(policydb->p_types.table, d); symtab_datum_t *src = hashtab_search(mpdb->p_types.table, d);
if(src) { if (src) {
LOGW("Domain %s already exists\n", d); LOGW("Domain %s already exists\n", d);
return 0; return 0;
} }
type_datum_t *typedatum = (type_datum_t *) xmalloc(sizeof(type_datum_t)); type_datum_t *typedatum = xmalloc(sizeof(type_datum_t));
type_datum_init(typedatum); type_datum_init(typedatum);
typedatum->primary = 1; typedatum->primary = 1;
typedatum->flavor = TYPE_TYPE; typedatum->flavor = TYPE_TYPE;
uint32_t value = 0; uint32_t value = 0;
symtab_insert(policydb, SYM_TYPES, strdup(d), typedatum, SCOPE_DECL, 1, &value); symtab_insert(mpdb, SYM_TYPES, strdup(d), typedatum, SCOPE_DECL, 1, &value);
typedatum->s.value = value; typedatum->s.value = value;
if (ebitmap_set_bit(&policydb->global->branch_list->declared.scope[SYM_TYPES], value - 1, 1)) { if (ebitmap_set_bit(&mpdb->global->branch_list->declared.scope[SYM_TYPES], value - 1, 1)) {
return 1; return 1;
} }
policydb->type_attr_map = xrealloc(policydb->type_attr_map, sizeof(ebitmap_t) * policydb->p_types.nprim); mpdb->type_attr_map = xrealloc(mpdb->type_attr_map, sizeof(ebitmap_t) * mpdb->p_types.nprim);
policydb->attr_type_map = xrealloc(policydb->attr_type_map, sizeof(ebitmap_t) * policydb->p_types.nprim); mpdb->attr_type_map = xrealloc(mpdb->attr_type_map, sizeof(ebitmap_t) * mpdb->p_types.nprim);
ebitmap_init(&policydb->type_attr_map[value-1]); ebitmap_init(&mpdb->type_attr_map[value-1]);
ebitmap_init(&policydb->attr_type_map[value-1]); ebitmap_init(&mpdb->attr_type_map[value-1]);
ebitmap_set_bit(&policydb->type_attr_map[value-1], value-1, 1); ebitmap_set_bit(&mpdb->type_attr_map[value-1], value-1, 1);
src = hashtab_search(policydb->p_types.table, d); src = hashtab_search(mpdb->p_types.table, d);
if(!src) if(!src)
return 1; return 1;
if(policydb_index_decls(NULL, policydb)) if(policydb_index_decls(NULL, mpdb))
return 1; return 1;
if(policydb_index_classes(policydb)) if(policydb_index_classes(mpdb))
return 1; return 1;
if(policydb_index_others(NULL, policydb, 0)) if(policydb_index_others(NULL, mpdb, 0))
return 1; return 1;
//Add the domain to all roles //Add the domain to all roles
for(unsigned i=0; i<policydb->p_roles.nprim; ++i) { for(unsigned i = 0; i < mpdb->p_roles.nprim; ++i) {
//Not sure all those three calls are needed //Not sure all those three calls are needed
ebitmap_set_bit(&policydb->role_val_to_struct[i]->types.negset, value-1, 0); ebitmap_set_bit(&mpdb->role_val_to_struct[i]->types.negset, value - 1, 0);
ebitmap_set_bit(&policydb->role_val_to_struct[i]->types.types, value-1, 1); ebitmap_set_bit(&mpdb->role_val_to_struct[i]->types.types, value - 1, 1);
type_set_expand(&policydb->role_val_to_struct[i]->types, &policydb->role_val_to_struct[i]->cache, policydb, 0); type_set_expand(&mpdb->role_val_to_struct[i]->types, &mpdb->role_val_to_struct[i]->cache, mpdb, 0);
} }
return set_attr("domain", value); return set_attr("domain", value);
@ -269,22 +265,21 @@ int create_domain(const char *d) {
int set_domain_state(const char *s, int state) { int set_domain_state(const char *s, int state) {
type_datum_t *type; type_datum_t *type;
hashtab_ptr_t cur;
if (s == NULL) { if (s == NULL) {
hashtab_for_each(policydb->p_types.table, cur, { hashtab_for_each(mpdb->p_types.table, {
type = cur->datum; type = node->datum;
if (ebitmap_set_bit(&policydb->permissive_map, type->s.value, state)) { if (ebitmap_set_bit(&mpdb->permissive_map, type->s.value, state)) {
LOGW("Could not set bit in permissive map\n"); LOGW("Could not set bit in permissive map\n");
return 1; return 1;
} }
}) })
} else { } else {
type = hashtab_search(policydb->p_types.table, s); type = hashtab_search(mpdb->p_types.table, s);
if (type == NULL) { if (type == NULL) {
LOGW("type %s does not exist\n", s); LOGW("type %s does not exist\n", s);
return 1; return 1;
} }
if (ebitmap_set_bit(&policydb->permissive_map, type->s.value, state)) { if (ebitmap_set_bit(&mpdb->permissive_map, type->s.value, state)) {
LOGW("Could not set bit in permissive map\n"); LOGW("Could not set bit in permissive map\n");
return 1; return 1;
} }
@ -297,22 +292,22 @@ int add_filename_trans(const char *s, const char *t, const char *c, const char *
type_datum_t *src, *tgt, *def; type_datum_t *src, *tgt, *def;
class_datum_t *cls; class_datum_t *cls;
src = hashtab_search(policydb->p_types.table, s); src = hashtab_search(mpdb->p_types.table, s);
if (src == NULL) { if (src == NULL) {
LOGW("source type %s does not exist\n", s); LOGW("source type %s does not exist\n", s);
return 1; return 1;
} }
tgt = hashtab_search(policydb->p_types.table, t); tgt = hashtab_search(mpdb->p_types.table, t);
if (tgt == NULL) { if (tgt == NULL) {
LOGW("target type %s does not exist\n", t); LOGW("target type %s does not exist\n", t);
return 1; return 1;
} }
cls = hashtab_search(policydb->p_classes.table, c); cls = hashtab_search(mpdb->p_classes.table, c);
if (cls == NULL) { if (cls == NULL) {
LOGW("class %s does not exist\n", c); LOGW("class %s does not exist\n", c);
return 1; return 1;
} }
def = hashtab_search(policydb->p_types.table, d); def = hashtab_search(mpdb->p_types.table, d);
if (def == NULL) { if (def == NULL) {
LOGW("default type %s does not exist\n", d); LOGW("default type %s does not exist\n", d);
return 1; return 1;
@ -325,11 +320,11 @@ int add_filename_trans(const char *s, const char *t, const char *c, const char *
trans_key.name = (char *) o; trans_key.name = (char *) o;
filename_trans_datum_t *trans_datum; filename_trans_datum_t *trans_datum;
trans_datum = hashtab_search(policydb->p_types.table, (hashtab_key_t) &trans_key); trans_datum = hashtab_search(mpdb->filename_trans, (hashtab_key_t) &trans_key);
if (trans_datum == NULL) { if (trans_datum == NULL) {
trans_datum = xcalloc(sizeof(*trans_datum), 1); trans_datum = xcalloc(sizeof(*trans_datum), 1);
hashtab_insert(policydb->filename_trans, (hashtab_key_t) &trans_key, trans_datum); hashtab_insert(mpdb->filename_trans, (hashtab_key_t) &trans_key, trans_datum);
} }
// Overwrite existing // Overwrite existing
@ -337,32 +332,29 @@ int add_filename_trans(const char *s, const char *t, const char *c, const char *
return 0; return 0;
} }
int add_typeattribute(const char *domainS, const char *attr) { int add_typeattribute(const char *type, const char *attr) {
type_datum_t *domain; type_datum_t *domain = hashtab_search(mpdb->p_types.table, type);
domain = hashtab_search(policydb->p_types.table, domainS);
if (domain == NULL) { if (domain == NULL) {
LOGW("source type %s does not exist\n", domainS); LOGW("type %s does not exist\n", type);
return 1; return 1;
} }
set_attr(attr, domain->s.value); int attr_id = set_attr(attr, domain->s.value);
if (attr_id < 0)
return 1;
int typeId = get_attr_id(attr); hashtab_for_each(mpdb->p_classes.table, {
//Now let's update all constraints! class_datum_t *cls = node->datum;
//(kernel doesn't support (yet?) type_names rules) for (constraint_node_t *n = cls->constraints; n ; n = n->next) {
for(int i = 0; i < policydb->p_classes.nprim; ++i) { for (constraint_expr_t *e = n->expr; e; e = e->next) {
class_datum_t *cl = policydb->class_val_to_struct[i]; if (e->expr_type == CEXPR_NAMES &&
for(constraint_node_t *n = cl->constraints; n ; n=n->next) { ebitmap_get_bit(&e->type_names->types, attr_id - 1)) {
for(constraint_expr_t *e = n->expr; e; e = e->next) { ebitmap_set_bit(&e->names, domain->s.value - 1, 1);
if(e->expr_type == CEXPR_NAMES) {
if(ebitmap_get_bit(&e->type_names->types, typeId - 1)) {
ebitmap_set_bit(&e->names, domain->s.value-1, 1);
}
} }
} }
} }
} })
return 0; return 0;
} }
@ -372,7 +364,7 @@ int add_rule(const char *s, const char *t, const char *c, const char *p, int eff
perm_datum_t *perm = NULL; perm_datum_t *perm = NULL;
if (s) { if (s) {
src = hashtab_search(policydb->p_types.table, s); src = hashtab_search(mpdb->p_types.table, s);
if (src == NULL) { if (src == NULL) {
LOGW("source type %s does not exist\n", s); LOGW("source type %s does not exist\n", s);
return 1; return 1;
@ -380,7 +372,7 @@ int add_rule(const char *s, const char *t, const char *c, const char *p, int eff
} }
if (t) { if (t) {
tgt = hashtab_search(policydb->p_types.table, t); tgt = hashtab_search(mpdb->p_types.table, t);
if (tgt == NULL) { if (tgt == NULL) {
LOGW("target type %s does not exist\n", t); LOGW("target type %s does not exist\n", t);
return 1; return 1;
@ -388,7 +380,7 @@ int add_rule(const char *s, const char *t, const char *c, const char *p, int eff
} }
if (c) { if (c) {
cls = hashtab_search(policydb->p_classes.table, c); cls = hashtab_search(mpdb->p_classes.table, c);
if (cls == NULL) { if (cls == NULL) {
LOGW("class %s does not exist\n", c); LOGW("class %s does not exist\n", c);
return 1; return 1;
@ -419,7 +411,7 @@ int add_xperm_rule(const char *s, const char *t, const char *c, const char *rang
class_datum_t *cls = NULL; class_datum_t *cls = NULL;
if (s) { if (s) {
src = hashtab_search(policydb->p_types.table, s); src = hashtab_search(mpdb->p_types.table, s);
if (src == NULL) { if (src == NULL) {
LOGW("source type %s does not exist\n", s); LOGW("source type %s does not exist\n", s);
return 1; return 1;
@ -427,7 +419,7 @@ int add_xperm_rule(const char *s, const char *t, const char *c, const char *rang
} }
if (t) { if (t) {
tgt = hashtab_search(policydb->p_types.table, t); tgt = hashtab_search(mpdb->p_types.table, t);
if (tgt == NULL) { if (tgt == NULL) {
LOGW("target type %s does not exist\n", t); LOGW("target type %s does not exist\n", t);
return 1; return 1;
@ -435,7 +427,7 @@ int add_xperm_rule(const char *s, const char *t, const char *c, const char *rang
} }
if (c) { if (c) {
cls = hashtab_search(policydb->p_classes.table, c); cls = hashtab_search(mpdb->p_classes.table, c);
if (cls == NULL) { if (cls == NULL) {
LOGW("class %s does not exist\n", c); LOGW("class %s does not exist\n", c);
return 1; return 1;
@ -463,22 +455,22 @@ int add_type_rule(const char *s, const char *t, const char *c, const char *d, in
type_datum_t *src, *tgt, *def; type_datum_t *src, *tgt, *def;
class_datum_t *cls; class_datum_t *cls;
src = hashtab_search(policydb->p_types.table, s); src = hashtab_search(mpdb->p_types.table, s);
if (src == NULL) { if (src == NULL) {
LOGW("source type %s does not exist\n", s); LOGW("source type %s does not exist\n", s);
return 1; return 1;
} }
tgt = hashtab_search(policydb->p_types.table, t); tgt = hashtab_search(mpdb->p_types.table, t);
if (tgt == NULL) { if (tgt == NULL) {
LOGW("target type %s does not exist\n", t); LOGW("target type %s does not exist\n", t);
return 1; return 1;
} }
cls = hashtab_search(policydb->p_classes.table, c); cls = hashtab_search(mpdb->p_classes.table, c);
if (cls == NULL) { if (cls == NULL) {
LOGW("class %s does not exist\n", c); LOGW("class %s does not exist\n", c);
return 1; return 1;
} }
def = hashtab_search(policydb->p_types.table, d); def = hashtab_search(mpdb->p_types.table, d);
if (def == NULL) { if (def == NULL) {
LOGW("default type %s does not exist\n", d); LOGW("default type %s does not exist\n", d);
return 1; return 1;
@ -495,3 +487,10 @@ int add_type_rule(const char *s, const char *t, const char *c, const char *d, in
return 0; return 0;
} }
void strip_dontaudit() {
avtab_for_each(&mpdb->te_avtab, {
if (node->key.specified == AVTAB_AUDITDENY || node->key.specified == AVTAB_XPERMS_DONTAUDIT)
avtab_remove_node(&magisk_policydb->te_avtab, node);
})
}

23
native/jni/magiskpolicy/sepolicy.h
View File

@ -5,32 +5,15 @@
__BEGIN_DECLS __BEGIN_DECLS
// Global policydb // Global policydb
extern policydb_t *policydb; extern policydb_t *magisk_policydb;
// General hash table traversal
#define hash_for_each(table, slots, tab, cur, block) \
for (int __i = 0; __i < (tab)->slots; ++__i) { \
__typeof__(cur) __next; \
for (cur = (tab)->table[__i]; cur; cur = __next) { \
__next = cur->next; \
block \
} \
} \
// hashtab traversal
#define hashtab_for_each(hashtab, cur, block) \
hash_for_each(htable, size, hashtab, cur, block)
// avtab traversal
#define avtab_for_each(avtab, cur, block) \
hash_for_each(htable, nslot, avtab, cur, block)
int create_domain(const char *d); int create_domain(const char *d);
int set_domain_state(const char *s, int state); int set_domain_state(const char *s, int state);
int add_typeattribute(const char *domainS, const char *attr); int add_typeattribute(const char *type, const char *attr);
int add_rule(const char *s, const char *t, const char *c, const char *p, int effect, int n); int add_rule(const char *s, const char *t, const char *c, const char *p, int effect, int n);
int add_xperm_rule(const char *s, const char *t, const char *c, const char *range, int effect, int n); int add_xperm_rule(const char *s, const char *t, const char *c, const char *range, int effect, int n);
int add_type_rule(const char *s, const char *t, const char *c, const char *d, int effect); int add_type_rule(const char *s, const char *t, const char *c, const char *d, int effect);
int add_filename_trans(const char *s, const char *t, const char *c, const char *d, const char *o); int add_filename_trans(const char *s, const char *t, const char *c, const char *d, const char *o);
void strip_dontaudit();
__END_DECLS __END_DECLS