Mirrors/Magisk
1
0
Fork 0
mirror of https://github.com/topjohnwu/Magisk.git synced 2025-06-12 13:17:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add hijack sepolicy support for rootfs devices

Browse Source 
On older Android versions, pre-mounting selinuxfs will lead to errors,
so we have to use a different method to block init's control flow.
Since all devices that falls in this catagory must both:

1. Be Android 8.0 - 9.0
2. Have early mount fstab in its device tree

We can actually use the same FIFO trick, but this time not on selinuxfs,
but on the read-only device tree nodes in sysfs or procfs. By mocking
the fstab/compatible node in the device tree, we can block init when
it attempts to do early mount; at that point, we can then mock selinuxfs
as we normally would, successfully hijack and inject patched sepolicy.
This commit is contained in:
topjohnwu
2022-03-16 20:01:26 -07:00
parent 49f259065d
commit e841aab9e7
4 changed files with 105 additions and 142 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
native/jni/init/mount.cpp
View File

@ -152,21 +152,6 @@ static void read_dt_fstab(BootConfig *config, vector<fstab_entry> &fstab) {
}
}
static void mount_with_dt(BootConfig *config) {
vector<fstab_entry> fstab;
read_dt_fstab(config, fstab);
for (const auto &entry : fstab) {
if (is_lnk(entry.mnt_point.data()))
continue;
// Derive partname from dev
sprintf(blk_info.partname, "%s%s", basename(entry.dev.data()), config->slot);
setup_block(true);
xmkdir(entry.mnt_point.data(), 0755);
xmount(blk_info.block_dev, entry.mnt_point.data(), entry.type.data(), MS_RDONLY, nullptr);
mount_list.push_back(entry.mnt_point);
}
}
static void avd_hack_mount(BootConfig *config) {
vector<fstab_entry> fstab;
read_dt_fstab(config, fstab);
@ -306,13 +291,12 @@ success:
xsymlink(custom_rules_dir.data(), path);
}
void RootFSInit::early_mount() {
void RootFSInit::prepare() {
self = mmap_data("/init");
magisk_cfg = mmap_data("/.backup/.magisk");
LOGD("Restoring /init\n");
rename(backup_init(), "/init");
mount_with_dt(config);
}
void SARBase::backup_files() {