1
// #define MOCK_COMPAT    SELINUXMOCK "/compatible"
2
// #define MOCK_LOAD      SELINUXMOCK "/load"
3
// #define MOCK_ENFORCE   SELINUXMOCK "/enforce"
4

5
// #define SELINUX_LOAD /sys/fs/selinux/load
6
// #define SELINUX_ENFORCE /sys/fs/selinux/enforce
7

8
bool MagiskInit::hijack_sepolicy() {
9
    xmkdir(SELINUXMOCK, 0);
10

11
    if (access("/system/bin/init", F_OK) == 0) {
12
        // On 2SI devices, the 2nd stage init file is always a dynamic executable.
13
        dump_preload("/dev/preload.so", 0644);
14
        setenv("LD_PRELOAD", "/dev/preload.so", 1);
15
    }
16

17
    // Hijack the "load" and "enforce" node in selinuxfs to manipulate
18
    // the actual sepolicy being loaded into the kernel
19
    auto hijack = [&] {
20
        LOGD("Hijack [" SELINUX_LOAD "]\n");
21
        close(xopen(MOCK_LOAD, O_CREAT | O_RDONLY, 0600));
22
        xmount(MOCK_LOAD, SELINUX_LOAD, nullptr, MS_BIND, nullptr);
23
        LOGD("Hijack [" SELINUX_ENFORCE "]\n");
24
        mkfifo(MOCK_ENFORCE, 0644);
25
        xmount(MOCK_ENFORCE, SELINUX_ENFORCE, nullptr, MS_BIND, nullptr);
26
    };
27

28
    string dt_compat;
29
    if (access(SELINUX_ENFORCE, F_OK) != 0) {
30
        // selinuxfs not mounted yet. Hijack the dt fstab nodes first
31
        // and let the original init mount selinuxfs for us.
32
        // This only happens on Android 8.0 - 9.0
33
        // 省略......
34
    } else {
35
        hijack();
36
    }
37

38
    // Read all custom rules into memory
39
    string rules;
40
    if (auto dir = xopen_dir("/data/" PREINITMIRR)) {
41
        for (dirent *entry; (entry = xreaddir(dir.get()));) {
42
            auto name = "/data/" PREINITMIRR "/"s + entry->d_name;
43
            auto rule_file = name + "/sepolicy.rule";
44
            if (xaccess(rule_file.data(), R_OK) == 0 &&
45
                access((name + "/disable").data(), F_OK) != 0 &&
46
                access((name + "/remove").data(), F_OK) != 0) {
47
                LOGD("Load custom sepolicy patch: [%s]\n", rule_file.data());
48
                full_read(rule_file.data(), rules);
49
                rules += '\n';
50
            }
51
        }
52
    }
53

54
    // Create a new process waiting for init operations
55
    if (xfork()) {
56
        // In parent, return and continue boot process
57
        return true;
58
    }
59

60
    // 省略......
61

62
    // This open will block until init calls security_getenforce
63
    int fd = xopen(MOCK_ENFORCE, O_WRONLY);
64

65
    // Cleanup the hijacks
66
    umount2("/init", MNT_DETACH);
67
    xumount2(SELINUX_LOAD, MNT_DETACH);
68
    xumount2(SELINUX_ENFORCE, MNT_DETACH);
69

70
    // Load and patch policy
71
    auto sepol = unique_ptr<sepolicy>(sepolicy::from_file(MOCK_LOAD));
72
    sepol->magisk_rules();
73
    sepol->load_rules(rules);
74

75
    // Load patched policy into kernel
76
    sepol->to_file(SELINUX_LOAD);
77

78
    // Write to the enforce node ONLY after sepolicy is loaded. We need to make sure
79
    // the actual init process is blocked until sepolicy is loaded, or else
80
    // restorecon will fail and re-exec won't change context, causing boot failure.
81
    // We (ab)use the fact that init reads the enforce node, and because
82
    // it has been replaced with our FIFO file, init will block until we
83
    // write something into the pipe, effectively hijacking its control flow.
84

85
    string enforce = full_read(SELINUX_ENFORCE);
86
    xwrite(fd, enforce.data(), enforce.length());
87
    close(fd);
88

89
    // At this point, the init process will be unblocked
90
    // and continue on with restorecon + re-exec.
91

92
    // Terminate process
93
    exit(0);
94
}