Guard log FIFO with SELinux

native/src/core/lib.rs

@@ -4,7 +4,9 @@
 use base::Utf8CStr;
 use cert::read_certificate;
 use daemon::{daemon_entry, find_apk_path, get_magiskd, MagiskD};
-use logging::{android_logging, magisk_logging, zygisk_logging};
+use logging::{
+    android_logging, magisk_logging, zygisk_close_logd, zygisk_get_logd, zygisk_logging,
+};
 use resetprop::{persist_delete_prop, persist_get_prop, persist_get_props, persist_set_prop};
 
 mod cert;
@@ -30,6 +32,8 @@ pub mod ffi {
         fn android_logging();
         fn magisk_logging();
         fn zygisk_logging();
+        fn zygisk_close_logd();
+        fn zygisk_get_logd() -> i32;
         fn find_apk_path(pkg: &[u8], data: &mut [u8]) -> usize;
         fn read_certificate(fd: i32, version: i32) -> Vec<u8>;
         unsafe fn persist_get_prop(name: *const c_char, prop_cb: Pin<&mut PropCb>);

native/src/core/logging.rs

@@ -165,19 +165,13 @@ fn magisk_log_to_pipe(prio: i32, msg: &Utf8CStr) {
 
 static ZYGISK_LOGD: AtomicI32 = AtomicI32::new(-1);
 
-#[no_mangle]
-extern "C" fn zygisk_close_logd() {
+pub fn zygisk_close_logd() {
     unsafe {
         libc::close(ZYGISK_LOGD.swap(-1, Ordering::Relaxed));
     }
 }
 
-#[no_mangle]
-extern "C" fn zygisk_get_logd() -> i32 {
-    ZYGISK_LOGD.load(Ordering::Relaxed)
-}
-
-fn zygisk_log_to_pipe(prio: i32, msg: &Utf8CStr) {
+pub fn zygisk_get_logd() -> i32 {
     // If we don't have the log pipe set, open the log pipe FIFO. This could actually happen
     // multiple times in the zygote daemon (parent process) because we had to close this
     // file descriptor to prevent crashing.
@@ -207,10 +201,18 @@ fn zygisk_log_to_pipe(prio: i32, msg: &Utf8CStr) {
                 libc::close(ZYGISK_LOGD.swap(fd, Ordering::Relaxed));
             }
         } else {
-            // Cannot talk to pipe, abort
-            return;
+            return -1;
         }
     }
+    fd
+}
+
+fn zygisk_log_to_pipe(prio: i32, msg: &Utf8CStr) {
+    let fd = zygisk_get_logd();
+    if fd < 0 {
+        // Cannot talk to pipe, abort
+        return;
+    }
 
     // Block SIGPIPE
     let mut mask: sigset_t;

native/src/core/selinux.cpp

@@ -135,5 +135,5 @@ void restore_tmpcon() {
         setfilecon_at(dfd, entry->d_name, SYSTEM_CON);
 
     string logd = tmp + "/"s LOG_PIPE;
-    setfilecon(logd.data(), MAGISK_FILE_CON);
+    setfilecon(logd.data(), MAGISK_LOG_CON);
 }