TheArchive/Magisk
1
0
Fork 0
mirror of https://github.com/topjohnwu/Magisk.git synced 2024-12-17 21:47:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update README

Browse Source
This commit is contained in:
Pierre-Hugues Husson 2015-11-14 17:02:09 +01:00
parent 10712c5ec0
commit a8978a0d4d
1 changed files with 15 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
README.txt
View File

@ -1,36 +1,28 @@
Injects allow rules into binary SELinux kernel policies Injects allow rules into binary SELinux kernel policies
Injecting a rule: Injecting a rule:
$ ./sepolicy-inject -s shell -t system -c file -p read -P sepolicy -o sepolicy2 $ ./sepolicy-inject -s shell -t system -c file -p read -P sepolicy
libsepol.policydb_index_others: security: 1 users, 2 roles, 518 types, 14 bools
libsepol.policydb_index_others: security: 1 sens, 1024 cats
libsepol.policydb_index_others: security: 84 classes, 4539 rules, 162 cond rules
$ sesearch -A -s shell -t system -c file sepolicy Injecting multiple permissions:
Found 1 semantic av rules: $ ./sepolicy-inject -s shell -t system -c file -p read,write,open -P sepolicy
allow appdomain domain : file { ioctl read getattr lock open } ;
$ sesearch -A -s shell -t system -c file sepolicy2 Add a type_attribute to a domain:
Found 2 semantic av rules: $ ./sepolicy-inject -s su -a mlstrustedsubject -P sepolicy
allow shell system : file read ;
allow appdomain domain : file { ioctl read getattr lock open } ;
Injecting a permissive domain: Injecting a permissive domain:
$ ./sepolicy-inject -Z shell -P sepolicy -o sepolicy2 $ ./sepolicy-inject -Z shell -P sepolicy
$ seinfo sepolicy | grep Permissive
Permissives: 0 Polcap: 2
$ seinfo sepolicy2 | grep Permissive
Permissives: 1 Polcap: 2
Change a permissive domain to non-permissive: Change a permissive domain to non-permissive:
$ ./sepolicy-inject -z shell -P sepolicy -o sepolicy2 $ ./sepolicy-inject -z shell -P sepolicy
Test a SELinux type exists:
$ ./sepolicy-inject -e -s shell -P sepolicy
TODO: Test a SELinux class exists:
$ ./sepolicy-inject -e -c service_manager -P sepolicy
Insert multiple rules at the same time Add a transition:
Remove rules $ ./sepolicy-inject -s su_daemon -f device -c file -t su_device -P sepolicy
Use attributes
Add a filename transition:
$ ./sepolicy-inject -s su_daemon -f device -c file -g "socket" -t su_device -P sepolicy