From e136fb3a4fcba9d39f9c65bcfa521697f21694d3 Mon Sep 17 00:00:00 2001
From: Wang Han <416810799@qq.com>
Date: Sun, 14 Mar 2021 14:45:40 +0800
Subject: [PATCH] Remove outdated sepolicies

 * Support deodexed ROM: This should not be done and dexpreopt is mandatory since P
   Xposed: Xposed handles them just fine, at least in the latest version 89.3
   suMiscL6: For whatever audio mods, a leftover of phh time
   Liveboot and suBackL6: Was for CF.lumen and LiveBoot, not needed now

 * Also cleanup binder sepolicies since we allow all binder transactions.
---
 native/jni/magiskpolicy/rules.cpp | 29 -----------------------------
 1 file changed, 29 deletions(-)

diff --git a/native/jni/magiskpolicy/rules.cpp b/native/jni/magiskpolicy/rules.cpp
index af90f5c95..f2cf30b0b 100644
--- a/native/jni/magiskpolicy/rules.cpp
+++ b/native/jni/magiskpolicy/rules.cpp
@@ -154,7 +154,6 @@ void sepolicy::magisk_rules() {
     allow("servicemanager", SEPOL_PROC_DOMAIN, "file", "open");
     allow("servicemanager", SEPOL_PROC_DOMAIN, "file", "read");
     allow("servicemanager", SEPOL_PROC_DOMAIN, "process", "getattr");
-    allow("servicemanager", SEPOL_PROC_DOMAIN, "binder", "transfer");
     allow(ALL, SEPOL_PROC_DOMAIN, "process", "sigchld");
 
     // allowLog
@@ -163,22 +162,6 @@ void sepolicy::magisk_rules() {
     allow("logd", SEPOL_PROC_DOMAIN, "file", "open");
     allow("logd", SEPOL_PROC_DOMAIN, "file", "getattr");
 
-    // suBackL6
-    allow("surfaceflinger", "app_data_file", "dir", ALL);
-    allow("surfaceflinger", "app_data_file", "file", ALL);
-    allow("surfaceflinger", "app_data_file", "lnk_file", ALL);
-    typeattribute("surfaceflinger", "mlstrustedsubject");
-
-    // suMiscL6
-    allow("audioserver", "audioserver", "process", "execmem");
-
-    // Liveboot
-    allow("surfaceflinger", SEPOL_PROC_DOMAIN, "process", "ptrace");
-    allow("surfaceflinger", SEPOL_PROC_DOMAIN, "binder", "transfer");
-    allow("surfaceflinger", SEPOL_PROC_DOMAIN, "binder", "call");
-    allow("surfaceflinger", SEPOL_PROC_DOMAIN, "fd", "use");
-    allow("debuggerd", SEPOL_PROC_DOMAIN, "process", "ptrace");
-
     // dumpsys
     allow(ALL, SEPOL_PROC_DOMAIN, "fd", "use");
     allow(ALL, SEPOL_PROC_DOMAIN, "fifo_file", "write");
@@ -191,7 +174,6 @@ void sepolicy::magisk_rules() {
     allow("hwservicemanager", SEPOL_PROC_DOMAIN, "file", "read");
     allow("hwservicemanager", SEPOL_PROC_DOMAIN, "file", "open");
     allow("hwservicemanager", SEPOL_PROC_DOMAIN, "process", "getattr");
-    allow("hwservicemanager", SEPOL_PROC_DOMAIN, "binder", "transfer");
 
     // For mounting loop devices, mirrors, tmpfs
     allow("kernel", ALL, "file", "read");
@@ -203,17 +185,6 @@ void sepolicy::magisk_rules() {
     // For changing file context
     allow("rootfs", "tmpfs", "filesystem", "associate");
 
-    // Xposed
-    allow("untrusted_app", "untrusted_app", "capability", "setgid");
-    allow("system_server", "dex2oat_exec", "file", ALL);
-
-    // Support deodexed ROM on Oreo
-    allow("zygote", "dalvikcache_data_file", "file", "execute");
-
-    // Support deodexed ROM on Pie (Samsung)
-    allow("system_server", "dalvikcache_data_file", "file", "write");
-    allow("system_server", "dalvikcache_data_file", "file", "execute");
-
     // Allow update_engine/addon.d-v2 to run permissive on all ROMs
     permissive("update_engine");