br0kenpixel/Magisk
1
0
Fork 0
mirror of https://github.com/topjohnwu/Magisk.git synced 2025-09-06 06:36:58 +00:00
Code Issues Packages Projects Releases 1 Wiki Activity

Guard log FIFO with SELinux

Browse Source
This commit is contained in:
topjohnwu
2023-11-04 23:59:11 -07:00
parent 72b39594d3
commit ac5ceb18c8
7 changed files with 43 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
native/src/sepolicy/rules.cpp
+13 -4
View File
@@ -19,6 +19,8 @@ void sepolicy::magisk_rules() {
typeattribute(SEPOL_PROC_DOMAIN, "bluetoothdomain");
type(SEPOL_FILE_TYPE, "file_type");
typeattribute(SEPOL_FILE_TYPE, "mlstrustedobject");
type(SEPOL_LOG_TYPE, "file_type");
typeattribute(SEPOL_LOG_TYPE, "mlstrustedobject");
// Make our root domain unconstrained
allow(SEPOL_PROC_DOMAIN, ALL, ALL, ALL);
@@ -37,10 +39,17 @@ void sepolicy::magisk_rules() {
allow(ALL, SEPOL_FILE_TYPE, "lnk_file", ALL);
allow(ALL, SEPOL_FILE_TYPE, "sock_file", ALL);
// Allow these processes to access MagiskSU
const char *clients[]{"zygote", "shell",
"system_app", "platform_app", "priv_app",
"untrusted_app", "untrusted_app_all"};
// Only allow zygote to open log pipe
allow("zygote", SEPOL_LOG_TYPE, "fifo_file", "open");
allow("zygote", SEPOL_LOG_TYPE, "fifo_file", "read");
// Allow all processes to output logs
allow("domain", SEPOL_LOG_TYPE, "fifo_file", "write");
// Allow these processes to access MagiskSU and output logs
const char *clients[] {
"zygote", "shell", "system_app", "platform_app",
"priv_app", "untrusted_app", "untrusted_app_all"
};
for (auto type: clients) {
if (!exists(type))
continue;