WeiguangTWK
/
LSPosed
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Refine SELinux rules for Xposed files (#149) 

1. The SELinux context label `magisk_file` is widely used by Zygisk implementation modules. It is improper for LSPosed to abuse this label for its own files. We replace it by `xposed_file`.
2. A new rule added according to the SELinux logs, which is needed to write to the mangaer's SharedPreference.
3. `xposed_data` is a new SELinux context label for XSharedPreference files, it is not meant to provide MAC restricted access but to conform with Android's rule: https://developer.android.com/about/versions/pie/android-9.0-changes-28#per-app-selinux.
4. We add attribute `mlstrustedobject` to ignore the `Multi-Level and Multi-Category Security` enforced on Android.
This commit is contained in:
JingMatrix 2025-01-05 13:39:42 +01:00
parent fba56a9927
commit 2bc0f0c716
6 changed files with 17 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
daemon/src/main/java/org/lsposed/lspd/service/ConfigFileManager.java
View File

@ -457,7 +457,7 @@ public class ConfigFileManager {
if (uid != -1) {
if (path.toFile().mkdirs()) {
try {
SELinux.setFileContext(path.toString(), "u:object_r:magisk_file:s0");
SELinux.setFileContext(path.toString(), "u:object_r:xposed_file:s0");
Os.chown(path.toString(), uid, uid);
Os.chmod(path.toString(), 0755);
} catch (ErrnoException e) {

2
daemon/src/main/java/org/lsposed/lspd/service/ConfigManager.java
View File

@ -299,7 +299,7 @@ public class ConfigManager {
try {
var perms = PosixFilePermissions.fromString("rwx--x--x");
Files.createDirectories(miscPath, PosixFilePermissions.asFileAttribute(perms));
walkFileTree(miscPath, f -> SELinux.setFileContext(f.toString(), "u:object_r:magisk_file:s0"));
walkFileTree(miscPath, f -> SELinux.setFileContext(f.toString(), "u:object_r:xposed_data:s0"));
} catch (IOException e) {
Log.e(TAG, Log.getStackTraceString(e));
}

6
daemon/src/main/java/org/lsposed/lspd/service/Dex2OatService.java
View File

@ -171,7 +171,7 @@ public class Dex2OatService implements Runnable {
Log.i(TAG, "Dex2oat wrapper daemon start");
var sockPath = getSockPath();
Log.d(TAG, "wrapper path: " + sockPath);
var magisk_file = "u:object_r:magisk_file:s0";
var xposed_file = "u:object_r:xposed_file:s0";
var dex2oat_exec = "u:object_r:dex2oat_exec:s0";
if (SELinux.checkSELinuxAccess("u:r:dex2oat:s0", dex2oat_exec,
"file", "execute_no_trans")) {
@ -179,8 +179,8 @@ public class Dex2OatService implements Runnable {
SELinux.setFileContext(WRAPPER64, dex2oat_exec);
setSockCreateContext("u:r:dex2oat:s0");
} else {
SELinux.setFileContext(WRAPPER32, magisk_file);
SELinux.setFileContext(WRAPPER64, magisk_file);
SELinux.setFileContext(WRAPPER32, xposed_file);
SELinux.setFileContext(WRAPPER64, xposed_file);
setSockCreateContext("u:r:installd:s0");
}
try (var server = new LocalServerSocket(sockPath)) {

2
daemon/src/main/java/org/lsposed/lspd/service/LSPManagerService.java
View File

@ -191,7 +191,7 @@ public class LSPManagerService extends ILSPManagerService.Stub {
private void ensureWebViewPermission(File f) {
if (!f.exists()) return;
SELinux.setFileContext(f.getAbsolutePath(), "u:object_r:magisk_file:s0");
SELinux.setFileContext(f.getAbsolutePath(), "u:object_r:xposed_file:s0");
try {
Os.chown(f.getAbsolutePath(), BuildConfig.MANAGER_INJECTED_UID, BuildConfig.MANAGER_INJECTED_UID);
} catch (ErrnoException e) {

2
magisk-loader/magisk_module/customize.sh
View File

@ -149,7 +149,7 @@ else
fi
set_perm_recursive "$MODPATH" 0 0 0755 0644
set_perm_recursive "$MODPATH/bin" 0 2000 0755 0755 u:object_r:magisk_file:s0
set_perm_recursive "$MODPATH/bin" 0 2000 0755 0755 u:object_r:xposed_file:s0
chmod 0744 "$MODPATH/daemon"
if [ "$(grep_prop ro.maple.enable)" == "1" ] && [ "$FLAVOR" == "zygisk" ]; then

10
magisk-loader/magisk_module/sepolicy.rule
View File

@ -1 +1,11 @@
allow dex2oat dex2oat_exec file execute_no_trans
allow shell shell dir write
type xposed_file file_type
typeattribute xposed_file mlstrustedobject
allow {installd isolated_app shell} xposed_file {file dir} *
type xposed_data file_type
typeattribute xposed_data mlstrustedobject
allow * xposed_data {file dir} *