Quantcast
Channel: 未分类 – Zhiwei Li
Viewing all articles
Browse latest Browse all 132

android 10 selinux增强

$
0
0

禁止访问温度传感器文件

magiskpolicy --live "deny untrusted_app sysfs_thermal  file * "
magiskpolicy --live "deny untrusted_app sysfs_thermal  lnk_file * " 
magiskpolicy --live "deny untrusted_app sysfs_thermal  dir * "

magiskpolicy --live "deny untrusted_app_27 sysfs_thermal  file * "
magiskpolicy --live "deny untrusted_app_27 sysfs_thermal  lnk_file * " 
magiskpolicy --live "deny untrusted_app_27 sysfs_thermal  dir * "

magiskpolicy --live "deny untrusted_app_25 sysfs_thermal  file * "
magiskpolicy --live "deny untrusted_app_25 sysfs_thermal  lnk_file * " 
magiskpolicy --live "deny untrusted_app_25 sysfs_thermal  dir * "

禁止向内核发送 netlink route 消息来获取 网络接口和路由信息

magiskpolicy --live "deny untrusted_app untrusted_app  netlink_route_socket * "
magiskpolicy --live "deny untrusted_app_27 untrusted_app_27  netlink_route_socket * "
magiskpolicy --live "deny untrusted_app_25 untrusted_app_25 netlink_route_socket * "

禁止通过ioctl来获取udp和tcp socket的属性,从而获取网口信息

magiskpolicy --live "deny untrusted_app untrusted_app udp_socket ioctl"
magiskpolicy --live "deny untrusted_app untrusted_app tcp_socket ioctl"
magiskpolicy --live "deny untrusted_app_27 untrusted_app_27 udp_socket ioctl"
magiskpolicy --live "deny untrusted_app_27 untrusted_app_27 tcp_socket ioctl"
magiskpolicy --live "deny untrusted_app_25 untrusted_app_25 udp_socket ioctl"
magiskpolicy --live "deny untrusted_app_25 untrusted_app_25 tcp_socket ioctl"

默认是ioctl 有 SIOCGIFCONF 消息,不能发送SIOCGIFHWADDR
这样,所有ioctl都被禁止掉


Viewing all articles
Browse latest Browse all 132

Latest Images

Trending Articles





Latest Images