andreacavalli/Magisk
1
0
Fork 0
forked from MarcoBuster/Magisk
Code Issues Pull Requests Projects Releases Wiki Activity
5f1174de27
Magisk/native/jni/magiskpolicy/rules.cpp

206 lines
8.4 KiB
C++
Raw Normal View History

Small native code reorganization
2020-03-09 09:50:30 +01:00
#include <logging.hpp>
Minor code changes across all sources
2019-07-01 04:09:31 +02:00
#include <flags.h>
Small native code reorganization
2020-03-09 09:50:30 +01:00
#include <magiskpolicy.hpp>
Clean/refactor includes
2019-02-10 09:57:51 +01:00
Add xperm rules for Android O
2017-04-19 22:28:56 +02:00
#include "sepolicy.h"
Add built-in rules
2016-09-13 00:19:07 +02:00
Migrate MagiskInit to C++
2018-11-08 10:20:16 +01:00
static void allowSuClient(const char *target) {
Add rules for Android P
2018-03-11 00:23:30 +01:00
if (!sepol_exists(target))
return;
Major refactor on sepolicy
2018-04-14 21:13:01 +02:00
sepol_allow(target, SEPOL_PROC_DOMAIN, "unix_stream_socket", "connectto");
sepol_allow(target, SEPOL_PROC_DOMAIN, "unix_stream_socket", "getopt");
sepol_allow(SEPOL_PROC_DOMAIN, target, "fd", "use");
sepol_allow(SEPOL_PROC_DOMAIN, target, "fifo_file", ALL);
Cleanup and add new rules Close #607
2018-09-20 22:55:16 +02:00
// Allow binder service
sepol_allow(target, SEPOL_PROC_DOMAIN, "binder", "call");
sepol_allow(target, SEPOL_PROC_DOMAIN, "binder", "transfer");
Revert ioctl rules
2019-04-30 03:25:57 +02:00
// Allow termios ioctl
sepol_allow(target, "devpts", "chr_file", "ioctl");
sepol_allow(target, "untrusted_app_devpts", "chr_file", "ioctl");
sepol_allow(target, "untrusted_app_25_devpts", "chr_file", "ioctl");
sepol_allow(target, "untrusted_app_all_devpts", "chr_file", "ioctl");
Small sepolicy refactor and fixes
2019-11-19 11:20:18 +01:00
if (magisk_policydb->policyvers >= POLICYDB_VERSION_XPERMS_IOCTL) {
Revert ioctl rules
2019-04-30 03:25:57 +02:00
sepol_allowxperm(target, "devpts", "chr_file", "0x5400-0x54FF");
sepol_allowxperm(target, "untrusted_app_devpts", "chr_file", "0x5400-0x54FF");
sepol_allowxperm(target, "untrusted_app_25_devpts", "chr_file", "0x5400-0x54FF");
sepol_allowxperm(target, "untrusted_app_all_devpts", "chr_file", "0x5400-0x54FF");
}
Add built-in rules
2016-09-13 00:19:07 +02:00
}
Cleanup and add new rules Close #607
2018-09-20 22:55:16 +02:00
void sepol_magisk_rules() {
Temporarily suppress warnings when applying Magisk rules
2018-11-29 12:31:05 +01:00
// Temp suppress warnings
auto bak = log_cb.w;
log_cb.w = nop_log;
Cleanup and add new rules Close #607
2018-09-20 22:55:16 +02:00
// First prevent anything to change sepolicy except ourselves
sepol_deny(ALL, "kernel", "security", "load_policy");
if (!sepol_exists(SEPOL_PROC_DOMAIN))
sepol_create(SEPOL_PROC_DOMAIN);
if (!sepol_exists(SEPOL_FILE_DOMAIN))
sepol_create(SEPOL_FILE_DOMAIN);
sepol_permissive(SEPOL_PROC_DOMAIN);
sepol_attradd(SEPOL_PROC_DOMAIN, "mlstrustedsubject");
sepol_attradd(SEPOL_PROC_DOMAIN, "netdomain");
sepol_attradd(SEPOL_PROC_DOMAIN, "bluetoothdomain");
sepol_attradd(SEPOL_FILE_DOMAIN, "mlstrustedobject");
Start Magisk in SAR
2019-06-26 08:31:59 +02:00
// Let everyone access tmpfs files (for SAR sbin overlay)
sepol_allow(ALL, "tmpfs", "file", ALL);
magiskpolicy: rules: fix rootfs operations with SAR Magisk - while many newer devices cannot allow / (system partition) to be mounted rw due to compressed fs (e.g. erofs) or logical partitions, it should remain possible to alter rootfs files/directories on those that previously allowed it
2019-07-04 22:02:36 +02:00
// For normal rootfs file/directory operations when rw (for SAR / overlay)
sepol_allow("rootfs", "labeledfs", "filesystem", "associate");
Update sepolicy rules
2019-04-30 02:26:51 +02:00
// Let init transit to SEPOL_PROC_DOMAIN
Move sbin overlay creation to magiskinit
2019-02-09 07:51:46 +01:00
sepol_allow("kernel", "kernel", "process", "setcurrent");
sepol_allow("kernel", SEPOL_PROC_DOMAIN, "process", "dyntransition");
Cleanup and add new rules Close #607
2018-09-20 22:55:16 +02:00
// Let init run stuffs
sepol_allow("kernel", SEPOL_PROC_DOMAIN, "fd", "use");
sepol_allow("init", SEPOL_PROC_DOMAIN, "process", ALL);
Remove requirement to use early-init daemon We used to construct /sbin tmpfs overlay in early-init stage after SELinux is properly initialized. However the way it is implemented (forking daemon from magiskinit with complicated file waiting triggers) is extremely complicated and error prone. This commit moves the construction of the sbin overlay to pre-init stage. The catch is that since SELinux is not present at that point, proper selabel has to be reconstructed afterwards. Some additional SEPolicy rules are added to make sure init can access magisk binaries, and the secontext relabeling task is assigned to the main Magisk daemon.
2019-04-24 06:13:48 +02:00
sepol_allow("init", "tmpfs", "file", "getattr");
sepol_allow("init", "tmpfs", "file", "execute");
Cleanup and add new rules Close #607
2018-09-20 22:55:16 +02:00
// Shell, properties, logs
if (sepol_exists("default_prop"))
sepol_allow(SEPOL_PROC_DOMAIN, "default_prop", "property_service", "set");
sepol_allow(SEPOL_PROC_DOMAIN, "init", "unix_stream_socket", "connectto");
sepol_allow(SEPOL_PROC_DOMAIN, "rootfs", "filesystem", "remount");
if (sepol_exists("logd"))
sepol_allow(SEPOL_PROC_DOMAIN, "logd", "unix_stream_socket", "connectto");
sepol_allow(SEPOL_PROC_DOMAIN, SEPOL_PROC_DOMAIN, ALL, ALL);
// For sepolicy live patching
sepol_allow(SEPOL_PROC_DOMAIN, "kernel", "security", "read_policy");
sepol_allow(SEPOL_PROC_DOMAIN, "kernel", "security", "load_policy");
// Allow these processes to access MagiskSU
allowSuClient("init");
allowSuClient("shell");
allowSuClient("system_app");
allowSuClient("priv_app");
allowSuClient("platform_app");
allowSuClient("untrusted_app");
allowSuClient("untrusted_app_25");
allowSuClient("untrusted_app_27");
allowSuClient("update_engine");
Allow bootctl to run
2018-07-20 16:22:49 +02:00
// suRights
Major refactor on sepolicy
2018-04-14 21:13:01 +02:00
sepol_allow("servicemanager", SEPOL_PROC_DOMAIN, "dir", "search");
sepol_allow("servicemanager", SEPOL_PROC_DOMAIN, "dir", "read");
sepol_allow("servicemanager", SEPOL_PROC_DOMAIN, "file", "open");
sepol_allow("servicemanager", SEPOL_PROC_DOMAIN, "file", "read");
sepol_allow("servicemanager", SEPOL_PROC_DOMAIN, "process", "getattr");
sepol_allow("servicemanager", SEPOL_PROC_DOMAIN, "binder", "transfer");
sepol_allow(SEPOL_PROC_DOMAIN, "servicemanager", "dir", "search");
sepol_allow(SEPOL_PROC_DOMAIN, "servicemanager", "dir", "read");
sepol_allow(SEPOL_PROC_DOMAIN, "servicemanager", "file", "open");
sepol_allow(SEPOL_PROC_DOMAIN, "servicemanager", "file", "read");
sepol_allow(SEPOL_PROC_DOMAIN, "servicemanager", "process", "getattr");
sepol_allow(SEPOL_PROC_DOMAIN, "servicemanager", "binder", "transfer");
sepol_allow(SEPOL_PROC_DOMAIN, "servicemanager", "binder", "call");
Allow all context to SIGCLD magisk Fix #596
2018-09-11 17:04:46 +02:00
sepol_allow(ALL, SEPOL_PROC_DOMAIN, "process", "sigchld");
Add built-in rules
2016-09-13 00:19:07 +02:00
// allowLog
Major refactor on sepolicy
2018-04-14 21:13:01 +02:00
sepol_allow("logd", SEPOL_PROC_DOMAIN, "dir", "search");
sepol_allow("logd", SEPOL_PROC_DOMAIN, "file", "read");
sepol_allow("logd", SEPOL_PROC_DOMAIN, "file", "open");
sepol_allow("logd", SEPOL_PROC_DOMAIN, "file", "getattr");
Add built-in rules
2016-09-13 00:19:07 +02:00
// suBackL0
Major refactor on sepolicy
2018-04-14 21:13:01 +02:00
sepol_allow("system_server", SEPOL_PROC_DOMAIN, "binder", "call");
sepol_allow("system_server", SEPOL_PROC_DOMAIN, "binder", "transfer");
Cleanup and add new rules Close #607
2018-09-20 22:55:16 +02:00
sepol_allow(SEPOL_PROC_DOMAIN, "system_server", "binder", "call");
sepol_allow(SEPOL_PROC_DOMAIN, "system_server", "binder", "transfer");
Add built-in rules
2016-09-13 00:19:07 +02:00
// suBackL6
Separate public and private APIs
2017-04-15 13:26:29 +02:00
sepol_allow("surfaceflinger", "app_data_file", "dir", ALL);
sepol_allow("surfaceflinger", "app_data_file", "file", ALL);
sepol_allow("surfaceflinger", "app_data_file", "lnk_file", ALL);
sepol_attradd("surfaceflinger", "mlstrustedsubject");
Update built-in rules
2016-11-02 18:20:35 +01:00
// suMiscL6
Separate public and private APIs
2017-04-15 13:26:29 +02:00
if (sepol_exists("audioserver"))
sepol_allow("audioserver", "audioserver", "process", "execmem");
Add LiveBoot support
2017-06-07 05:42:51 +02:00
// Liveboot
Major refactor on sepolicy
2018-04-14 21:13:01 +02:00
sepol_allow("surfaceflinger", SEPOL_PROC_DOMAIN, "process", "ptrace");
sepol_allow("surfaceflinger", SEPOL_PROC_DOMAIN, "binder", "transfer");
sepol_allow("surfaceflinger", SEPOL_PROC_DOMAIN, "binder", "call");
sepol_allow("surfaceflinger", SEPOL_PROC_DOMAIN, "fd", "use");
sepol_allow("debuggerd", SEPOL_PROC_DOMAIN, "process", "ptrace");
Remove Samsung sepcific patches and small refactoring
2017-11-28 23:09:35 +01:00
// dumpsys
Major refactor on sepolicy
2018-04-14 21:13:01 +02:00
sepol_allow(ALL, SEPOL_PROC_DOMAIN, "fd", "use");
sepol_allow(ALL, SEPOL_PROC_DOMAIN, "fifo_file", "write");
sepol_allow(ALL, SEPOL_PROC_DOMAIN, "fifo_file", "read");
sepol_allow(ALL, SEPOL_PROC_DOMAIN, "fifo_file", "open");
sepol_allow(ALL, SEPOL_PROC_DOMAIN, "fifo_file", "getattr");
Allow bootctl to run
2018-07-20 16:22:49 +02:00
// bootctl
sepol_allow("hwservicemanager", SEPOL_PROC_DOMAIN, "dir", "search");
sepol_allow("hwservicemanager", SEPOL_PROC_DOMAIN, "file", "read");
sepol_allow("hwservicemanager", SEPOL_PROC_DOMAIN, "file", "open");
sepol_allow("hwservicemanager", SEPOL_PROC_DOMAIN, "process", "getattr");
sepol_allow("hwservicemanager", SEPOL_PROC_DOMAIN, "binder", "transfer");
Remove Samsung sepcific patches and small refactoring
2017-11-28 23:09:35 +01:00
Update rules
2017-12-31 12:20:49 +01:00
// For mounting loop devices, mirrors, tmpfs
Major refactor on sepolicy
2018-04-14 21:13:01 +02:00
sepol_allow(SEPOL_PROC_DOMAIN, "kernel", "process", "setsched");
sepol_allow(SEPOL_PROC_DOMAIN, "labeledfs", "filesystem", "mount");
sepol_allow(SEPOL_PROC_DOMAIN, "labeledfs", "filesystem", "unmount");
sepol_allow(SEPOL_PROC_DOMAIN, "tmpfs", "filesystem", "mount");
sepol_allow(SEPOL_PROC_DOMAIN, "tmpfs", "filesystem", "unmount");
Update rules
2017-11-22 09:03:57 +01:00
sepol_allow("kernel", ALL, "file", "read");
magiskpolicy: rules: fix writing to loop devices using upstream sepolicy
2019-07-13 23:36:29 +02:00
sepol_allow("kernel", ALL, "file", "write");
Complete minimal patch
2017-03-29 20:02:39 +02:00
Update sepolicy rules
2019-04-30 02:26:51 +02:00
// Allow us to do anything to any files/dir/links
Major refactor on sepolicy
2018-04-14 21:13:01 +02:00
sepol_allow(SEPOL_PROC_DOMAIN, ALL, "file", ALL);
sepol_allow(SEPOL_PROC_DOMAIN, ALL, "dir", ALL);
sepol_allow(SEPOL_PROC_DOMAIN, ALL, "lnk_file", ALL);
sepol_allow(SEPOL_PROC_DOMAIN, ALL, "blk_file", ALL);
sepol_allow(SEPOL_PROC_DOMAIN, ALL, "sock_file", ALL);
sepol_allow(SEPOL_PROC_DOMAIN, ALL, "chr_file", ALL);
sepol_allow(SEPOL_PROC_DOMAIN, ALL, "fifo_file", ALL);
Remove Samsung sepcific patches and small refactoring
2017-11-28 23:09:35 +01:00
Update sepolicy rules
2019-04-30 02:26:51 +02:00
// Allow us to do any ioctl on all block devices
Small sepolicy refactor and fixes
2019-11-19 11:20:18 +01:00
if (magisk_policydb->policyvers >= POLICYDB_VERSION_XPERMS_IOCTL)
Update sepolicy rules
2019-04-30 02:26:51 +02:00
sepol_allowxperm(SEPOL_PROC_DOMAIN, ALL, "blk_file", "0x0000-0xFFFF");
Allow all binder operations for root processes
2019-02-02 19:24:55 +01:00
// Allow all binder transactions
sepol_allow(ALL, SEPOL_PROC_DOMAIN, "binder", ALL);
Prevent any SELinux issues of root shell streams
2018-11-24 02:59:14 +01:00
// Super files
sepol_allow(ALL, SEPOL_FILE_DOMAIN, "file", ALL);
sepol_allow(ALL, SEPOL_FILE_DOMAIN, "dir", ALL);
sepol_allow(ALL, SEPOL_FILE_DOMAIN, "fifo_file", ALL);
sepol_allow(ALL, SEPOL_FILE_DOMAIN, "chr_file", ALL);
sepol_allow(SEPOL_FILE_DOMAIN, ALL, "filesystem", "associate");
Update rules
2017-07-13 18:49:40 +02:00
// For changing attributes
sepol_allow("rootfs", "tmpfs", "filesystem", "associate");
Add Magisk rules
2016-10-02 16:48:49 +02:00
// Xposed
Separate public and private APIs
2017-04-15 13:26:29 +02:00
sepol_allow("untrusted_app", "untrusted_app", "capability", "setgid");
sepol_allow("system_server", "dex2oat_exec", "file", ALL);
Support deodexed ROM on Oreo
2018-07-06 19:36:57 +02:00
// Support deodexed ROM on Oreo
sepol_allow("zygote", "dalvikcache_data_file", "file", "execute");
Proper addon.d-v2 support
2018-08-03 16:40:49 +02:00
Support deodexed ROM on Pie (Samsung) - cc @abrahamgcc
2019-02-17 16:34:22 +01:00
// Support deodexed ROM on Pie (Samsung)
sepol_allow("system_server", "dalvikcache_data_file", "file", "write");
sepol_allow("system_server", "dalvikcache_data_file", "file", "execute");
magiskpolicy: rules: standardize update_engine sepolicy when rooted The state of ROM A/B OTA addon.d-v2 support is an inconsistent mess currently: - LineageOS builds userdebug with permissive update_engine domain, OmniROM builds userdebug with a more restricted update_engine domain, and CarbonROM builds user with a hybrid closer to Omni's - addon.d-v2 scripts cannot function to the full extent they should when there is a more restricted update_engine domain sepolicy in place, which is likely why Lineage made update_engine completely permissive Evidence for the above: - many addon.d-v2 scripts only work (or fully work) on Lineage, see below - Magisk's addon.d-v2 script would work on Lineage without issue, but would work on Carbon and Omni only if further allow rules were added for basic things like "file read" and "dir search" suggesting these ROMs' addon.d-v2 is severely limited - Omni includes a /system/addon.d/69-gapps.sh script with the ROM itself (despite shipping without GApps), and with Magisk's more permissive sepolicy and no GApps installed it will remove important ROM files during OTA, resulting in a bootloop; the issue with shipping this script was therefore masked by Omni's overly restrictive update_engine sepolicy not allowing the script to function as intended The solution: - guarantee a consistent addon.d-v2 experience for users across ROMs when rooted with Magisk by making update_engine permissive as Lineage has - hopefully ROMs can work together to come up with something standard for unrooted addon.d-v2 function
2019-09-19 16:53:05 +02:00
// Allow update_engine/addon.d-v2 to run permissive on all ROMs
sepol_permissive("update_engine");
Remove all dontaudit in magisk rules
2018-11-29 12:28:37 +01:00
Fix compile errors
2019-11-23 23:18:55 +01:00
#if 0
Update sepolicy rules
2019-04-30 02:26:51 +02:00
// Remove all dontaudit in debug mode
Small sepolicy refactor and fixes
2019-11-19 11:20:18 +01:00
strip_dontaudit();
Update sepolicy rules
2019-04-30 02:26:51 +02:00
#endif
Temporarily suppress warnings when applying Magisk rules
2018-11-29 12:31:05 +01:00
log_cb.w = bak;
Integrate with unified daemon
2017-04-15 20:29:42 +02:00
}
Reference in New Issue Copy Permalink