Magisk/native/jni/magiskhide/hide_policy.cpp

111 lines
2.9 KiB
C++
Raw Normal View History

2019-05-26 11:47:57 +02:00
#include <sys/mount.h>
2020-03-09 09:50:30 +01:00
#include <magisk.hpp>
#include <utils.hpp>
#include <selinux.hpp>
#include <resetprop.hpp>
2019-05-26 11:47:57 +02:00
2020-03-09 09:50:30 +01:00
#include "magiskhide.hpp"
2019-05-26 11:47:57 +02:00
using namespace std;
static const char *prop_key[] =
{ "ro.boot.vbmeta.device_state", "ro.boot.verifiedbootstate", "ro.boot.flash.locked",
"ro.boot.veritymode", "ro.boot.warranty_bit", "ro.warranty_bit", "ro.debuggable",
"ro.secure", "ro.build.type", "ro.build.tags", "ro.build.selinux",
"ro.vendor.boot.warranty_bit", "ro.vendor.warranty_bit", nullptr };
2019-05-26 11:47:57 +02:00
static const char *prop_value[] =
{ "locked", "green", "1",
"enforcing", "0", "0", "0",
"1", "user", "release-keys", "0",
"0", "0", nullptr };
2019-05-26 11:47:57 +02:00
void hide_sensitive_props() {
LOGI("hide_policy: Hiding sensitive props\n");
// Hide all sensitive props
for (int i = 0; prop_key[i]; ++i) {
auto value = getprop(prop_key[i]);
if (!value.empty() && value != prop_value[i])
setprop(prop_key[i], prop_value[i], false);
}
2020-02-17 17:44:10 +01:00
// Hide that we booted from recovery when magisk is in recovery mode
auto bootmode = getprop("ro.bootmode");
if (!bootmode.empty() && bootmode.find("recovery") != string::npos) {
setprop("ro.bootmode", "unknown", false);
}
bootmode = getprop("ro.boot.mode");
if (!bootmode.empty() && bootmode.find("recovery") != string::npos) {
setprop("ro.boot.mode", "unknown", false);
2020-03-12 12:55:44 +01:00
}
2020-02-17 17:44:10 +01:00
// Xiaomi cross region flash
auto hwc = getprop("ro.boot.hwc");
2020-02-17 18:13:26 +01:00
if (!hwc.empty() && hwc.find("CN") != string::npos) {
2020-02-17 17:44:10 +01:00
setprop("ro.boot.hwc", "GLOBAL", false);
}
auto hwcountry = getprop("ro.boot.hwcountry");
2020-02-17 18:13:26 +01:00
if (!hwcountry.empty() && hwcountry.find("China") != string::npos) {
2020-02-17 17:44:10 +01:00
setprop("ro.boot.hwcountry", "GLOBAL", false);
}
2019-05-26 11:47:57 +02:00
}
static inline void lazy_unmount(const char* mountpoint) {
if (umount2(mountpoint, MNT_DETACH) != -1)
LOGD("hide_policy: Unmounted (%s)\n", mountpoint);
}
void hide_daemon(int pid) {
2019-09-26 05:55:39 +02:00
run_finally fin([=]() -> void {
2019-05-26 11:47:57 +02:00
// Send resume signal
2019-06-27 09:28:34 +02:00
kill(pid, SIGCONT);
2019-05-26 11:47:57 +02:00
_exit(0);
});
hide_unmount(pid);
}
2019-05-26 11:47:57 +02:00
2019-06-23 12:53:41 +02:00
#define TMPFS_MNT(dir) (mentry->mnt_type == "tmpfs"sv && \
strncmp(mentry->mnt_dir, "/" #dir, sizeof("/" #dir) - 1) == 0)
void hide_unmount(int pid) {
2019-05-26 11:47:57 +02:00
if (switch_mnt_ns(pid))
return;
LOGD("hide_policy: handling PID=[%d]\n", pid);
2019-05-26 12:05:23 +02:00
char val;
int fd = xopen(SELINUX_ENFORCE, O_RDONLY);
xxread(fd, &val, sizeof(val));
close(fd);
// Permissive
if (val == '0') {
chmod(SELINUX_ENFORCE, 0640);
chmod(SELINUX_POLICY, 0440);
}
2019-05-26 11:47:57 +02:00
vector<string> targets;
// Unmount dummy skeletons and /sbin links
2019-06-23 12:53:41 +02:00
parse_mnt("/proc/self/mounts", [&](mntent *mentry) {
if (TMPFS_MNT(system) || TMPFS_MNT(vendor) || TMPFS_MNT(sbin) || TMPFS_MNT(product))
2019-06-23 12:53:41 +02:00
targets.emplace_back(mentry->mnt_dir);
2019-05-26 11:47:57 +02:00
return true;
});
for (auto &s : targets)
lazy_unmount(s.data());
targets.clear();
// Unmount all Magisk created mounts
2019-06-23 12:53:41 +02:00
parse_mnt("/proc/self/mounts", [&](mntent *mentry) {
if (strstr(mentry->mnt_fsname, BLOCKDIR))
targets.emplace_back(mentry->mnt_dir);
2019-05-26 11:47:57 +02:00
return true;
});
for (auto &s : targets)
lazy_unmount(s.data());
}