From e136fb3a4fcba9d39f9c65bcfa521697f21694d3 Mon Sep 17 00:00:00 2001 From: Wang Han <416810799@qq.com> Date: Sun, 14 Mar 2021 14:45:40 +0800 Subject: [PATCH] Remove outdated sepolicies * Support deodexed ROM: This should not be done and dexpreopt is mandatory since P Xposed: Xposed handles them just fine, at least in the latest version 89.3 suMiscL6: For whatever audio mods, a leftover of phh time Liveboot and suBackL6: Was for CF.lumen and LiveBoot, not needed now * Also cleanup binder sepolicies since we allow all binder transactions. --- native/jni/magiskpolicy/rules.cpp | 29 ----------------------------- 1 file changed, 29 deletions(-) diff --git a/native/jni/magiskpolicy/rules.cpp b/native/jni/magiskpolicy/rules.cpp index af90f5c95..f2cf30b0b 100644 --- a/native/jni/magiskpolicy/rules.cpp +++ b/native/jni/magiskpolicy/rules.cpp @@ -154,7 +154,6 @@ void sepolicy::magisk_rules() { allow("servicemanager", SEPOL_PROC_DOMAIN, "file", "open"); allow("servicemanager", SEPOL_PROC_DOMAIN, "file", "read"); allow("servicemanager", SEPOL_PROC_DOMAIN, "process", "getattr"); - allow("servicemanager", SEPOL_PROC_DOMAIN, "binder", "transfer"); allow(ALL, SEPOL_PROC_DOMAIN, "process", "sigchld"); // allowLog @@ -163,22 +162,6 @@ void sepolicy::magisk_rules() { allow("logd", SEPOL_PROC_DOMAIN, "file", "open"); allow("logd", SEPOL_PROC_DOMAIN, "file", "getattr"); - // suBackL6 - allow("surfaceflinger", "app_data_file", "dir", ALL); - allow("surfaceflinger", "app_data_file", "file", ALL); - allow("surfaceflinger", "app_data_file", "lnk_file", ALL); - typeattribute("surfaceflinger", "mlstrustedsubject"); - - // suMiscL6 - allow("audioserver", "audioserver", "process", "execmem"); - - // Liveboot - allow("surfaceflinger", SEPOL_PROC_DOMAIN, "process", "ptrace"); - allow("surfaceflinger", SEPOL_PROC_DOMAIN, "binder", "transfer"); - allow("surfaceflinger", SEPOL_PROC_DOMAIN, "binder", "call"); - allow("surfaceflinger", SEPOL_PROC_DOMAIN, "fd", "use"); - allow("debuggerd", SEPOL_PROC_DOMAIN, "process", "ptrace"); - // dumpsys allow(ALL, SEPOL_PROC_DOMAIN, "fd", "use"); allow(ALL, SEPOL_PROC_DOMAIN, "fifo_file", "write"); @@ -191,7 +174,6 @@ void sepolicy::magisk_rules() { allow("hwservicemanager", SEPOL_PROC_DOMAIN, "file", "read"); allow("hwservicemanager", SEPOL_PROC_DOMAIN, "file", "open"); allow("hwservicemanager", SEPOL_PROC_DOMAIN, "process", "getattr"); - allow("hwservicemanager", SEPOL_PROC_DOMAIN, "binder", "transfer"); // For mounting loop devices, mirrors, tmpfs allow("kernel", ALL, "file", "read"); @@ -203,17 +185,6 @@ void sepolicy::magisk_rules() { // For changing file context allow("rootfs", "tmpfs", "filesystem", "associate"); - // Xposed - allow("untrusted_app", "untrusted_app", "capability", "setgid"); - allow("system_server", "dex2oat_exec", "file", ALL); - - // Support deodexed ROM on Oreo - allow("zygote", "dalvikcache_data_file", "file", "execute"); - - // Support deodexed ROM on Pie (Samsung) - allow("system_server", "dalvikcache_data_file", "file", "write"); - allow("system_server", "dalvikcache_data_file", "file", "execute"); - // Allow update_engine/addon.d-v2 to run permissive on all ROMs permissive("update_engine");