Skip to content

Commit 4826a0d

Browse files
ys1231ys1231
committed
fix(sh): 🐛 Fix #19 Restore Selinux Context Settings
1 parent 396a9ad commit 4826a0d

2 files changed

Lines changed: 44 additions & 93 deletions

File tree

‎post-fs-data.sh‎

Lines changed: 44 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,10 @@ print_log() {
2424
echo "[$LOG_TAG] $@" >>$LOG_PATH
2525
}
2626

27-
move_user_cert() {
27+
move_custom_cert() {
2828
print_log "Backup user custom certificates"
2929
if [ "$(ls -A /data/local/tmp/cert)" ]; then
30-
cp -f /data/local/tmp/cert/* $MODDIR/certificates/
30+
cp -f /data/local/tmp/cert/* $MODDIR/certificates
3131
cp -f /data/local/tmp/cert/* /data/misc/user/0/cacerts-added/
3232
else
3333
print_log "The directory '/data/local/tmp/cert' is empty."
@@ -56,6 +56,28 @@ fix_system_permissions() {
5656
print_log "move cert status:$?"
5757
}
5858

59+
fix_system_permissions14() {
60+
# diff
61+
print_log "fix permissions: $1"
62+
chown -R system:system "$1"
63+
chown root:shell "$1"
64+
chmod -R 644 "$1"
65+
chmod 755 "$1"
66+
print_log "fix permissions: $?"
67+
}
68+
69+
set_selinux_context(){
70+
[ "$(getenforce)" = "Enforcing" ] || return 0
71+
default_selinux_context=u:object_r:system_file:s0
72+
selinux_context=$(ls -Zd $1 | awk '{print $1}')
73+
74+
if [ -n "$selinux_context" ] && [ "$selinux_context" != "?" ]; then
75+
chcon -R $selinux_context $2
76+
else
77+
chcon -R $default_selinux_context $2
78+
fi
79+
}
80+
5981
# Android version <= 13 execute
6082
if [ "$sdk_version_number" -le 33 ]; then
6183
print_log "start move cert !"
@@ -65,28 +87,38 @@ if [ "$sdk_version_number" -le 33 ]; then
6587
cp -u /data/misc/user/0/cacerts-added/* $MODDIR/certificates/
6688
# Android 13 or lower versions perform
6789
print_log "Backup user custom certificates"
68-
move_user_cert
90+
move_custom_cert
6991
fix_user_permissions
7092

71-
print_log "mount: /system/etc/security/cacerts/"
72-
mount -t tmpfs tmpfs /system/etc/security/cacerts/
93+
print_log "mount: /system/etc/security/cacerts"
94+
mount -t tmpfs tmpfs /system/etc/security/cacerts
7395
print_log "mount status:$?"
7496

75-
print_log "move cert: /system/etc/security/cacerts/"
76-
cp -f $MODDIR/certificates/* /system/etc/security/cacerts/
97+
print_log "move cert: /system/etc/security/cacerts"
98+
cp -f $MODDIR/certificates/* /system/etc/security/cacerts
7799
print_log "move cert status:$?"
78-
100+
fix_system_permissions
79101
print_log "certificates installed"
80102
else
81103

82104
print_log "start move cert !"
83105
print_log "current sdk version is $sdk_version_number"
84106
print_log "Backup system certificates"
85-
cp -u /apex/com.android.conscrypt/cacerts/* /data/adb/modules/MoveCertificate/certificates
86-
cp -u /data/misc/user/0/cacerts-added/* /data/adb/modules/MoveCertificate/certificates
107+
mount -t tmpfs tmpfs $MODDIR/certificates
108+
cp -u /apex/com.android.conscrypt/cacerts/* $MODDIR/certificates
109+
cp -u /data/misc/user/0/cacerts-added/* $MODDIR/certificates
87110
print_log "Backup user custom certificates"
88-
move_user_cert
111+
move_custom_cert
89112
fix_user_permissions
90-
fix_system_permissions /data/adb/modules/MoveCertificate/certificates
113+
fix_system_permissions14 $MODDIR/certificates
91114

115+
print_log "find system conscrypt directory"
116+
apex_dir=$(find /apex -type d -name "com.android.conscrypt@*")
117+
print_log "find conscrypt directory: $apex_dir"
118+
119+
set_selinux_context /apex/com.android.conscrypt/cacerts $MODDIR/certificates
120+
# These two directories are mapped to the same block
121+
mount -o bind $MODDIR/certificates /apex/com.android.conscrypt/cacerts
122+
mount -o bind $MODDIR/certificates $apex_dir/cacerts
123+
print_log "certificates installed"
92124
fi

‎service.sh‎

Lines changed: 0 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -5,84 +5,3 @@
55
# This will make sure your module will still work
66
# if Magisk change its mount point in the future
77
MODDIR=${0%/*}
8-
9-
# This script will be executed in post-fs-data mode
10-
# Android 14 cannot be earlier than Zygote
11-
sdk_version=$(getprop ro.build.version.sdk)
12-
# debug
13-
#sdk_version=34
14-
sdk_version_number=$(expr "$sdk_version" + 0)
15-
16-
# add logcat
17-
LOG_PATH="$MODDIR/install_14.log"
18-
LOG_TAG="iyue_MoveCertificate"
19-
20-
# Keep only one up-to-date log
21-
echo "[$LOG_TAG] Keep only one up-to-date log" >$LOG_PATH
22-
23-
print_log() {
24-
echo "[$LOG_TAG] $@" >>$LOG_PATH
25-
}
26-
27-
move_user_cert() {
28-
29-
if [ "$(ls -A /data/local/tmp/cert)" ]; then
30-
print_log "Backup user custom certificates"
31-
cp -f /data/local/tmp/cert/* $MODDIR/certificates/
32-
cp -f /data/local/tmp/cert/* /data/misc/user/0/cacerts-added/
33-
print_log "Backup user custom certificates status:$?"
34-
else
35-
print_log "The directory '/data/local/tmp/cert' is empty."
36-
fi
37-
38-
}
39-
40-
fix_user_permissions() {
41-
# "Fix permissions of the system certificate directory"
42-
print_log "fix user permissions: /data/misc/user/0/cacerts-added/"
43-
chown -R root:root /data/misc/user/0/cacerts-added/
44-
chmod -R 666 /data/misc/user/0/cacerts-added/
45-
chown system:system /data/misc/user/0/cacerts-added
46-
chmod 755 /data/misc/user/0/cacerts-added
47-
print_log "fix user permissions status:$?"
48-
}
49-
50-
fix_system_permissions() {
51-
# diff
52-
print_log "fix permissions: $1"
53-
chown -R system:system "$1"
54-
chown root:shell "$1"
55-
chmod -R 644 "$1"
56-
chmod 755 "$1"
57-
print_log "fix permissions: $?"
58-
}
59-
60-
# Android version >= 14 execute
61-
if [ "$sdk_version_number" -ge 34 ]; then
62-
63-
print_log "start move cert !"
64-
print_log "current sdk version is $sdk_version_number"
65-
print_log "Backup system certificates"
66-
cp -u /data/misc/user/0/cacerts-added/* $MODDIR/certificates/
67-
cp -u /apex/com.android.conscrypt/cacerts/* $MODDIR/certificates/
68-
print_log "Backup user custom certificates"
69-
move_user_cert
70-
fix_user_permissions
71-
fix_system_permissions $MODDIR/certificates
72-
73-
print_log "find system conscrypt directory"
74-
apex_dir=$(find /apex -type d -name "com.android.conscrypt@*")
75-
print_log "find conscrypt directory: $apex_dir"
76-
77-
print_log "Mounting certificates to zygote and apps"
78-
ZYGOTE_PID=$(pidof zygote || true)
79-
ZYGOTE64_PID=$(pidof zygote64 || true)
80-
81-
for Z_PID in "$ZYGOTE_PID" "$ZYGOTE64_PID"; do
82-
if [ -n "$Z_PID" ]; then
83-
nsenter --mount=/proc/$Z_PID/ns/mnt -- /bin/mount --bind $MODDIR/certificates /apex/com.android.conscrypt/cacerts
84-
nsenter --mount=/proc/$Z_PID/ns/mnt -- /bin/mount --bind $MODDIR/certificates $apex_dir/cacerts
85-
fi
86-
done
87-
print_log "certificates installed$?"
88-
fi

0 commit comments

Comments
 (0)