android/SukiSU-Ultra
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

selinux: use grep to check api supports (#402)

Browse Source 
This checks `selinux_state` and `current_sid` supports in a raw way.
Feels more reliable than the version checks.

Supersedes #401, fixes #280, fixes #400.
This commit is contained in:
华
2023-04-20 15:22:03 +08:00
committed by GitHub
parent 3b9cab3432
commit 3452841752
4 changed files with 19 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
kernel/selinux/Makefile
View File

@@ -2,6 +2,13 @@ obj-y += selinux.o
obj-y += sepolicy.o obj-y += sepolicy.o
obj-y += rules.o obj-y += rules.o
ifeq ($(shell grep -q " current_sid(void)" $(srctree)/security/selinux/include/objsec.h; echo $$?),0)
ccflags-y += -DKSU_COMPAT_HAS_CURRENT_SID
endif
ifeq ($(shell grep -q "struct selinux_state " $(srctree)/security/selinux/include/security.h; echo $$?),0)
ccflags-y += -DKSU_COMPAT_HAS_SELINUX_STATE
endif
ccflags-y += -Wno-implicit-function-declaration -Wno-strict-prototypes -Wno-int-conversion ccflags-y += -Wno-implicit-function-declaration -Wno-strict-prototypes -Wno-int-conversion
ccflags-y += -Wno-macro-redefined -Wno-declaration-after-statement -Wno-unused-function ccflags-y += -Wno-macro-redefined -Wno-declaration-after-statement -Wno-unused-function

6
kernel/selinux/rules.c
View File

@@ -22,7 +22,7 @@ static struct policydb *get_policydb(void)
{ {
struct policydb *db; struct policydb *db;
// selinux_state does not exists before 4.19 // selinux_state does not exists before 4.19
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 9, 337) #ifdef KSU_COMPAT_USE_SELINUX_STATE
#ifdef SELINUX_POLICY_INSTEAD_SELINUX_SS #ifdef SELINUX_POLICY_INSTEAD_SELINUX_SS
struct selinux_policy *policy = rcu_dereference(selinux_state.policy); struct selinux_policy *policy = rcu_dereference(selinux_state.policy);
db = &policy->policydb; db = &policy->policydb;
@@ -170,9 +170,7 @@ static int get_object(char *buf, char __user *user_object, size_t buf_sz,
// reset avc cache table, otherwise the new rules will not take effect if already denied // reset avc cache table, otherwise the new rules will not take effect if already denied
static void reset_avc_cache() static void reset_avc_cache()
{ {
#if ((KERNEL_VERSION(4, 14, 0) <= LINUX_VERSION_CODE) && \ #ifndef KSU_COMPAT_USE_SELINUX_STATE
(LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 163))) || \
(LINUX_VERSION_CODE < KERNEL_VERSION(4, 9, 337))
avc_ss_reset(0); avc_ss_reset(0);
selnl_notify_policyload(0); selnl_notify_policyload(0);
selinux_status_update_policyload(0); selinux_status_update_policyload(0);

10
kernel/selinux/selinux.c
View File

@@ -2,7 +2,7 @@
#include "objsec.h" #include "objsec.h"
#include "linux/version.h" #include "linux/version.h"
#include "../klog.h" // IWYU pragma: keep #include "../klog.h" // IWYU pragma: keep
#if ((KERNEL_VERSION(4, 14, 0) <= LINUX_VERSION_CODE) && (LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 163))) || (LINUX_VERSION_CODE < KERNEL_VERSION(4, 9, 337)) #ifndef KSU_COMPAT_USE_SELINUX_STATE
#include "avc.h" #include "avc.h"
#endif #endif
@@ -57,7 +57,7 @@ if (!is_domain_permissive) {
void setenforce(bool enforce) void setenforce(bool enforce)
{ {
#ifdef CONFIG_SECURITY_SELINUX_DEVELOP #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 14, 163)) || ((KERNEL_VERSION(4, 10, 0) > LINUX_VERSION_CODE) && (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 9, 337))) #ifdef KSU_COMPAT_USE_SELINUX_STATE
selinux_state.enforcing = enforce; selinux_state.enforcing = enforce;
#else #else
selinux_enforcing = enforce; selinux_enforcing = enforce;
@@ -68,7 +68,7 @@ void setenforce(bool enforce)
bool getenforce() bool getenforce()
{ {
#ifdef CONFIG_SECURITY_SELINUX_DISABLE #ifdef CONFIG_SECURITY_SELINUX_DISABLE
#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 14, 163)) || ((KERNEL_VERSION(4, 10, 0) > LINUX_VERSION_CODE) && (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 9, 337))) #ifdef KSU_COMPAT_USE_SELINUX_STATE
if (selinux_state.disabled) { if (selinux_state.disabled) {
#else #else
if (selinux_disabled) { if (selinux_disabled) {
@@ -78,7 +78,7 @@ bool getenforce()
#endif #endif
#ifdef CONFIG_SECURITY_SELINUX_DEVELOP #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 14, 163)) || ((KERNEL_VERSION(4, 10, 0) > LINUX_VERSION_CODE) && (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 9, 337))) #ifdef KSU_COMPAT_USE_SELINUX_STATE
return selinux_state.enforcing; return selinux_state.enforcing;
#else #else
return selinux_enforcing; return selinux_enforcing;
@@ -88,7 +88,7 @@ bool getenforce()
#endif #endif
} }
#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 9, 337) #if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 10, 0)) && !defined(KSU_COMPAT_HAS_CURRENT_SID)
/* /*
* get the subjective security ID of the current task * get the subjective security ID of the current task
*/ */

5
kernel/selinux/selinux.h
View File

@@ -2,6 +2,11 @@
#define __KSU_H_SELINUX #define __KSU_H_SELINUX
#include "linux/types.h" #include "linux/types.h"
#include "linux/version.h"
#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0)) || defined(KSU_COMPAT_HAS_SELINUX_STATE)
#define KSU_COMPAT_USE_SELINUX_STATE
#endif
void setup_selinux(); void setup_selinux();