ec3705f2ed
Introduce new domain `magisk_client` and new file type `magisk_exec`. Connection to magiskd's always-on socket is restricted to magisk_client only. Whitelisted process domains can transit to magisk_client through executing files labelled magisk_exec. The main magisk binary shall be the only file labelled as magisk_exec throughout the whole system. All processes thus are no longer allowed to connect to magiskd directly without going through the proper magisk binary. Connection failures are silenced from audit logs with dontaudit rules, so crazy processes which traverse through all unix domain sockets to try connection can no longer check logcat to know the actual reason behind EACCES, leaking the denied process policy (which is u:r:magisk:s0). This also allows us to remove many rules that open up holes in untrusted_app domains that were used to make remote shell work properly. Since all processes establishing the remote shell are now restricted to the magisk_client domain, all these rules are moved to magisk_client. This makes Magisk require fewer compromises in Android's security model. Note: as of this commit, requesting new root access via Magisk Manager will stop working as Magisk Manager can no longer communicate with magiskd directly. This will be addressed in a future commit that involves changes in both native and application side.
43 lines
1.7 KiB
C++
43 lines
1.7 KiB
C++
#pragma once
|
|
|
|
// selinuxfs paths
|
|
#define SELINUX_MNT "/sys/fs/selinux"
|
|
#define SELINUX_ENFORCE SELINUX_MNT "/enforce"
|
|
#define SELINUX_POLICY SELINUX_MNT "/policy"
|
|
#define SELINUX_LOAD SELINUX_MNT "/load"
|
|
#define SELINUX_CONTEXT SELINUX_MNT "/context"
|
|
#define SELINUX_VERSION SELINUX_MNT "/policyvers"
|
|
|
|
// sepolicy paths
|
|
#define PLAT_POLICY_DIR "/system/etc/selinux/"
|
|
#define VEND_POLICY_DIR "/vendor/etc/selinux/"
|
|
#define PROD_POLICY_DIR "/product/etc/selinux/"
|
|
#define ODM_POLICY_DIR "/odm/etc/selinux/"
|
|
#define SYSEXT_POLICY_DIR "/system_ext/etc/selinux/"
|
|
#define SPLIT_PLAT_CIL PLAT_POLICY_DIR "plat_sepolicy.cil"
|
|
|
|
// Unconstrained domain the daemon and root processes run in
|
|
#define SEPOL_PROC_DOMAIN "magisk"
|
|
// Highly constrained domain, sole purpose is to connect to daemon
|
|
#define SEPOL_CLIENT_DOMAIN "magisk_client"
|
|
// Unconstrained file type that anyone can access
|
|
#define SEPOL_FILE_TYPE "magisk_file"
|
|
// Special file type to allow clients to transit to client domain automatically
|
|
#define SEPOL_EXEC_TYPE "magisk_exec"
|
|
|
|
extern void (*freecon)(char *con);
|
|
extern int (*setcon)(const char *con);
|
|
extern int (*getfilecon)(const char *path, char **con);
|
|
extern int (*lgetfilecon)(const char *path, char **con);
|
|
extern int (*fgetfilecon)(int fd, char **con);
|
|
extern int (*setfilecon)(const char *path, const char *con);
|
|
extern int (*lsetfilecon)(const char *path, const char *con);
|
|
extern int (*fsetfilecon)(int fd, const char *con);
|
|
void getfilecon_at(int dirfd, const char *name, char **con);
|
|
void setfilecon_at(int dirfd, const char *name, const char *con);
|
|
|
|
void selinux_builtin_impl();
|
|
void dload_selinux();
|
|
void restorecon();
|
|
void restore_tmpcon();
|