cd6eca1dc2
For match-all-type rules (e.g. "allow magisk * * *" used in Magisk), we used to iterate and apply rules on all existing types. However, this is actually unnecessary as all selinux types should have at least 1 attributes assigned to it (process types "domain", file context types "file_type" etc.). This means in order to create rules that applies to all types, we actually only need to create rules for all attributes. This optimization SIGNIFICANTLY reduces the patched sepolicy that is loaded into the kernel when running Magisk. For example on Pixel 4 XL running Android R DP4, the sepolicy sizes are patched (before) : 3455948 patched (after) : 843176 stock : 630229 The active sepolicy size actually impacts the performance of every single operation in the operating system, because the larger the policies gets, the longer it takes for the kernel to lookup and match rules.
29 lines
1.3 KiB
C++
29 lines
1.3 KiB
C++
#pragma once
|
|
|
|
#include <sepol/policydb/policydb.h>
|
|
#include <magiskpolicy.hpp>
|
|
|
|
// Internal APIs, do not use directly
|
|
struct sepol_impl : public sepolicy {
|
|
int set_attr(const char *attr_name, int type_val);
|
|
void check_avtab_node(avtab_ptr_t node);
|
|
avtab_ptr_t get_avtab_node(avtab_key_t *key, avtab_extended_perms_t *xperms);
|
|
bool add_rule(const char *s, const char *t, const char *c, const char *p, int effect, bool invert);
|
|
void add_rule(type_datum_t *src, type_datum_t *tgt, class_datum_t *cls, perm_datum_t *perm, int effect, bool invert);
|
|
void add_xperm_rule(type_datum_t *src, type_datum_t *tgt,
|
|
class_datum_t *cls, uint16_t low, uint16_t high, int effect, bool invert);
|
|
bool add_xperm_rule(const char *s, const char *t, const char *c, const char *range, int effect, bool invert);
|
|
bool add_type_rule(const char *s, const char *t, const char *c, const char *d, int effect);
|
|
bool add_filename_trans(const char *s, const char *t, const char *c, const char *d, const char *o);
|
|
bool add_genfscon(const char *fs_name, const char *path, const char *context);
|
|
bool create_domain(const char *type_name);
|
|
bool set_domain_state(const char *s, bool permissive);
|
|
bool add_typeattribute(const char *type, const char *attr);
|
|
void strip_dontaudit();
|
|
void allow_su_client(const char *type);
|
|
};
|
|
|
|
#define impl static_cast<sepol_impl *>(this)
|
|
|
|
void statement_help();
|