Magisk/native/jni/utils/selinux.cpp

223 lines
5.6 KiB
C++
Raw Normal View History

#include <sys/xattr.h>
2018-09-27 06:09:59 +02:00
#include <dlfcn.h>
#include <unistd.h>
#include <fcntl.h>
2018-09-27 09:11:10 +02:00
#include <string.h>
#include <syscall.h>
#include <string_view>
2018-09-27 06:09:59 +02:00
2019-02-10 09:57:51 +01:00
#include <magisk.h>
#include <utils.h>
#include <selinux.h>
2018-09-27 06:09:59 +02:00
using namespace std::literals;
2018-09-27 06:09:59 +02:00
#define UNLABEL_CON "u:object_r:unlabeled:s0"
#define SYSTEM_CON "u:object_r:system_file:s0"
#define ADB_CON "u:object_r:adb_data_file:s0"
#define ROOT_CON "u:object_r:rootfs:s0"
2018-11-03 08:06:01 +01:00
#define MAGISK_CON "u:object_r:" SEPOL_FILE_DOMAIN ":s0"
2018-09-27 06:09:59 +02:00
// Stub implementation
2018-09-27 06:09:59 +02:00
static int stub(const char *) { return 0; }
2018-09-27 06:09:59 +02:00
static int stub(const char *, const char *) { return 0; }
2018-09-27 06:09:59 +02:00
static int stub(const char *, char **ctx) {
*ctx = strdup("");
2018-09-27 06:09:59 +02:00
return 0;
}
2019-03-14 11:34:22 +01:00
static int stub(int, const char *) { return 0; }
static int stub(int, char **ctx) {
*ctx = strdup("");
return 0;
}
// Builtin implementation
static void __freecon(char *s) {
free(s);
}
static int __setcon(const char *ctx) {
int fd = open("/proc/self/attr/current", O_WRONLY | O_CLOEXEC);
if (fd < 0)
return fd;
size_t len = strlen(ctx) + 1;
int rc = write(fd, ctx, len);
close(fd);
return rc != len;
}
static int __getfilecon(const char *path, char **ctx) {
char buf[1024];
int rc = syscall(__NR_getxattr, path, XATTR_NAME_SELINUX, buf, sizeof(buf) - 1);
2019-12-05 23:34:50 +01:00
if (rc >= 0)
2019-12-05 22:29:45 +01:00
*ctx = strdup(buf);
return rc;
}
static int __lgetfilecon(const char *path, char **ctx) {
char buf[1024];
int rc = syscall(__NR_lgetxattr, path, XATTR_NAME_SELINUX, buf, sizeof(buf) - 1);
2019-12-05 23:34:50 +01:00
if (rc >= 0)
2019-12-05 22:29:45 +01:00
*ctx = strdup(buf);
2019-03-14 11:34:22 +01:00
return rc;
}
static int __fgetfilecon(int fd, char **ctx) {
char buf[1024];
int rc = syscall(__NR_fgetxattr, fd, XATTR_NAME_SELINUX, buf, sizeof(buf) - 1);
2019-12-05 23:34:50 +01:00
if (rc >= 0)
2019-12-05 22:29:45 +01:00
*ctx = strdup(buf);
return rc;
}
static int __setfilecon(const char *path, const char *ctx) {
2019-12-05 22:29:45 +01:00
return syscall(__NR_setxattr, path, XATTR_NAME_SELINUX, ctx, strlen(ctx) + 1, 0);
}
static int __lsetfilecon(const char *path, const char *ctx) {
2019-12-05 22:29:45 +01:00
return syscall(__NR_lsetxattr, path, XATTR_NAME_SELINUX, ctx, strlen(ctx) + 1, 0);
2019-03-14 11:34:22 +01:00
}
static int __fsetfilecon(int fd, const char *ctx) {
2019-12-05 22:29:45 +01:00
return syscall(__NR_fsetxattr, fd, XATTR_NAME_SELINUX, ctx, strlen(ctx) + 1, 0);
}
2018-09-27 06:09:59 +02:00
// Function pointers
void (*freecon)(char *) = __freecon;
int (*setcon)(const char *) = stub;
int (*getfilecon)(const char *, char **) = stub;
int (*lgetfilecon)(const char *, char **) = stub;
2019-03-14 11:34:22 +01:00
int (*fgetfilecon)(int, char **) = stub;
int (*setfilecon)(const char *, const char *) = stub;
int (*lsetfilecon)(const char *, const char *) = stub;
2019-03-14 11:34:22 +01:00
int (*fsetfilecon)(int, const char *) = stub;
void getfilecon_at(int dirfd, const char *name, char **con) {
char path[4096];
fd_pathat(dirfd, name, path, sizeof(path));
if (lgetfilecon(path, con))
*con = strdup("");
}
void setfilecon_at(int dirfd, const char *name, const char *con) {
char path[4096];
fd_pathat(dirfd, name, path, sizeof(path));
lsetfilecon(path, con);
}
void selinux_builtin_impl() {
setcon = __setcon;
getfilecon = __getfilecon;
lgetfilecon = __lgetfilecon;
2019-03-14 11:34:22 +01:00
fgetfilecon = __fgetfilecon;
setfilecon = __setfilecon;
2019-02-24 20:14:03 +01:00
lsetfilecon = __lsetfilecon;
2019-03-14 11:34:22 +01:00
fsetfilecon = __fsetfilecon;
}
2018-09-28 00:26:41 +02:00
void dload_selinux() {
if (access("/system/lib/libselinux.so", F_OK))
return;
/* We only check whether libselinux.so exists but don't dlopen.
* For some reason calling symbols returned from dlsym
* will result to SEGV_ACCERR on some devices.
* Always use builtin implementations for SELinux stuffs. */
selinux_builtin_impl();
}
2018-09-27 06:09:59 +02:00
static void restore_syscon(int dirfd) {
struct dirent *entry;
DIR *dir;
2019-03-14 11:34:22 +01:00
char *con;
2018-09-27 06:09:59 +02:00
2019-03-14 11:34:22 +01:00
fgetfilecon(dirfd, &con);
2018-09-27 06:09:59 +02:00
if (strlen(con) == 0 || strcmp(con, UNLABEL_CON) == 0)
2019-03-14 11:34:22 +01:00
fsetfilecon(dirfd, SYSTEM_CON);
2018-09-27 06:09:59 +02:00
freecon(con);
dir = xfdopendir(dirfd);
while ((entry = xreaddir(dir))) {
if (entry->d_name == "."sv || entry->d_name == ".."sv)
2018-09-27 06:09:59 +02:00
continue;
2019-03-14 11:34:22 +01:00
int fd = openat(dirfd, entry->d_name, O_RDONLY | O_CLOEXEC);
2018-09-27 06:09:59 +02:00
if (entry->d_type == DT_DIR) {
restore_syscon(fd);
2019-03-14 11:34:22 +01:00
} else if (entry->d_type == DT_REG) {
fgetfilecon(fd, &con);
if (con[0] == '\0' || strcmp(con, UNLABEL_CON) == 0)
fsetfilecon(fd, SYSTEM_CON);
freecon(con);
} else if (entry->d_type == DT_LNK) {
getfilecon_at(dirfd, entry->d_name, &con);
if (con[0] == '\0' || strcmp(con, UNLABEL_CON) == 0)
setfilecon_at(dirfd, entry->d_name, con);
2018-09-27 06:09:59 +02:00
freecon(con);
}
2019-03-14 11:34:22 +01:00
close(fd);
2018-09-27 06:09:59 +02:00
}
}
static void restore_magiskcon(int dirfd) {
struct dirent *entry;
DIR *dir;
2019-03-14 11:34:22 +01:00
fsetfilecon(dirfd, MAGISK_CON);
fchown(dirfd, 0, 0);
2018-09-27 06:09:59 +02:00
dir = xfdopendir(dirfd);
while ((entry = xreaddir(dir))) {
if (entry->d_name == "."sv || entry->d_name == ".."sv)
2018-09-27 06:09:59 +02:00
continue;
2019-03-14 11:34:22 +01:00
int fd = xopenat(dirfd, entry->d_name, O_RDONLY | O_CLOEXEC);
2018-09-27 06:09:59 +02:00
if (entry->d_type == DT_DIR) {
restore_magiskcon(fd);
2019-03-14 11:34:22 +01:00
} else if (entry->d_type) {
fsetfilecon(fd, MAGISK_CON);
fchown(fd, 0, 0);
2018-09-27 06:09:59 +02:00
}
2019-03-14 11:34:22 +01:00
close(fd);
2018-09-27 06:09:59 +02:00
}
}
void restorecon() {
int fd;
fd = xopen(SELINUX_CONTEXT, O_WRONLY | O_CLOEXEC);
2018-09-28 00:26:41 +02:00
if (write(fd, ADB_CON, sizeof(ADB_CON)) >= 0)
2018-09-27 06:09:59 +02:00
lsetfilecon(SECURE_DIR, ADB_CON);
close(fd);
lsetfilecon(MODULEROOT, SYSTEM_CON);
fd = xopen(MODULEROOT, O_RDONLY | O_CLOEXEC);
2018-09-27 06:09:59 +02:00
restore_syscon(fd);
close(fd);
fd = xopen(DATABIN, O_RDONLY | O_CLOEXEC);
restore_magiskcon(fd);
close(fd);
2018-11-20 09:49:44 +01:00
}
void restore_rootcon() {
setfilecon("/sbin", ROOT_CON);
2019-06-26 08:31:59 +02:00
setfilecon(MAGISKTMP, ROOT_CON);
setfilecon(MIRRDIR, ROOT_CON);
setfilecon(BLOCKDIR, ROOT_CON);
2019-12-13 06:37:06 +01:00
auto dir = xopen_dir("/sbin");
int dfd = dirfd(dir.get());
2019-12-13 06:37:06 +01:00
for (dirent *entry; (entry = xreaddir(dir.get()));) {
if (entry->d_name == "."sv || entry->d_name == ".."sv)
continue;
setfilecon_at(dfd, entry->d_name, ROOT_CON);
}
setfilecon("/sbin/magisk.bin", MAGISK_CON);
setfilecon("/sbin/magisk", MAGISK_CON);
setfilecon("/sbin/magiskinit", MAGISK_CON);
}