Enginex0
43a2301982
Injection into the soterserver app (platform_app domain, per recon) needs ptrace under SELinux enforcing. Add the grant mirroring the keystore one, in the base rule so it applies to both variants: allow crash_dump platform_app process * The per-UID NDJSON write grant is debug-only: appended for debug builds in build.gradle.kts's isDebug doLast, mirroring the existing keystore media_rw_data_file grant. Keeping it out of the base rule stops an external-storage write from leaking into release. No soter_server SELinux type exists; platform_app is the soterserver app domain. Runtime policy (KSU/magiskpolicy) grants this past the compile-time neverallow; on-device avc verification is 10.V. Checkpoint 10.C.
21 lines
915 B
Plaintext
21 lines
915 B
Plaintext
allow keystore {adb_data_file shell_data_file} file *
|
|
allow crash_dump keystore process *
|
|
|
|
# SOTER Layer-A (10.C): ptrace inject into soterserver (platform_app). The debug NDJSON
|
|
# media_rw_data_file grant is debug-only — appended for debug builds in app/build.gradle.kts.
|
|
allow crash_dump platform_app process *
|
|
|
|
allow ksu self:tcp_socket { create connect read write getopt setopt }
|
|
allow ksu node:tcp_socket node_bind
|
|
allow ksu port:tcp_socket name_connect
|
|
allow magisk self:tcp_socket { create connect read write getopt setopt }
|
|
allow magisk node:tcp_socket node_bind
|
|
allow magisk port:tcp_socket name_connect
|
|
|
|
allow ksu self:udp_socket { create connect read write getopt setopt }
|
|
allow ksu node:udp_socket node_bind
|
|
allow ksu port:udp_socket name_connect
|
|
allow magisk self:udp_socket { create connect read write getopt setopt }
|
|
allow magisk node:udp_socket node_bind
|
|
allow magisk port:udp_socket name_connect
|