Skip to content

Commit c5558e8

Browse files
grant-hgrant-h
committed
Initial commit
Moving on to policy extraction Fix AOSP system image selection (system_other ignore) Fix sedump to properly handle allowxperm AVType Add partial SEAndroid graphing Handle treble firmware images, parse selinux/capabilities xattrs Fix capabilities decoding Add example policies logic: DAG traversal prototypes Begin overlay of file_contexts Extract link target during walk Handle two firmware image types: /system as rootfs and /boot as rootfs More progress on instationation. Path-finding debugging logic: pro 3 hurts Begin back-propagating domain transitions to relate to files logic: circle graph support in pro 5 Improve overlay path search to take into account indirect type membership refactor extract -> process, saving to file db Complete refactor including complete policy saving logic: pro 6 self edges verified Create processing pipeline and initial graph2prolog converter logic: dac sync logic: dac is working Use SFDP graphviz for collision free layout chown outputed policy files Create mapping from AID to name. Display dac info on graph Fix skipping of self-edges (prevented key objects from being created) Move cutify to function and remove objects only used by a single subject Save init and prop files during extraction Assigned friendly labels to nodes during overlay process File contexts bug Android init boot simulation Handle 8.0 images and above Refactor policy instantiation Refactor of graph building. Must easier to reason about sub/obj now * Recover dynamic transitions (can build process hierarchy from SEPolicy) * Separate sub/obj inflation from graph linking * Divide all steps into own functions * Bring everything under a class for shared state Fix android version parsing process tree graphing build process tree and handle android quirks Add hwservice_manager as IPC object type for 9.0 Debug graph flag Color process tree based on capabilities Begin simulating permission flow Bring initrc parsing into spec with reference Determine object owner based off of a lot of methods Improve debugging cmdline Android 9 missing classes and fixes Chown output directory hierarchy during extract Initrc files ignore actions/commands before first section Recover dyntransition executables using filesystem search + graph focus set Fix missing /vendor partition extraction Ignore SVG Initrc temporary fix for missing AID name/number mappings Expand graph attributes, flatten function, prolog emission logic: add cutoff parameter Boot all the way to system_server logic: capability and filter support Make process ty actually subject Add missing NET_BT_STACK group uevent parsing and ls-style filesystem listing logic: support for external attack surface and a lot of code refact to better support wildcard queries logic: sort the findall results logic: readme on different query interfaces SO MUCH CODE - boot android, inflate uevents, chmod, chown, mkdir Recover fstab and add mount points for SELinux labeling Parse fstab, apply genfs as last resort for missing files Policy inst. fixes, ground-truth script Further instantiate the graph (split IPC nodes) Add LG 7.0 for interest Enable pickle for instantiated graph (had to fix circular deps) Now I can iterated on Prolog quickly Fully inst. files Sailfish pl facts logic: sea impl for swi Interactive prolog REPL Logic: add main for compilation Fix repl with new sealogic version Emit file modes! Split /dev and /sys into R/W ports, Fix dropped IPC Emit proc caps Add cap facts.pl multiq interface Add S7 facts load save queries Add main2,3,4,5 for binaries Add stats New extract script Stat modifications logic: add query response length Add realpath to associate services, fix FC heuristic Untrusted apps booted! S8+ facts Fix USB object tag bug :( Pass inst to prolog logic: more queries logic: boarding Convert raw log to names logic: bug fix on dac - dont treat execute as write Add G955 stats file Speed up policy loading for quick stats Path to firmware name ignore url params Add timing for prolog queries and change input format Add tab completion for commands (args next) Handle ctrl+c during prolog prompt Generate prolog binaries per policy Add requirements.txt Migrate policy path to shared directory Add README with installation instructions Add additional usage for the README Fix README typos add eval logs eval on ext usb Add better warnings to subject group inflation Add ability to display paths with trusted/untrusted nodes Fix saved file path generation for non-relative policy Do not consider files under /sys to be special These files are mainly informative instead of carrying untrusted data from external sources. Save external attack surface tags to objects This will allow their tags to be queried later. Set trusted and untrusted components and recompile prolog helpers Dont tag non-instantiated FileNode, prefer fileobj eval: new ext att queries for atd add print_special command add print_trusted cmd add nfc eval Support LG .image files during extraction Change SELinux capability processing assert -> warning Add tab completion for process/object during queries Pass in ASP to Prolog Add Prolog path diff command Add more prolog helpers Fix prolog compilation and add swi-prolog to deps Add notes on requiring Prolog from PPA Handle missing prolog inst-map and always recompile all helpers Fix errors when loading inst-map
0 parents  commit c5558e8

File tree

116 files changed

+2728923
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

116 files changed

+2728923
-0
lines changed

‎.gitignore

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
*.swp
2+
*.swo
3+
4+
.plq
5+
missing-fc-report.txt
6+
7+
inst*
8+
facts.pl
9+
extract/
10+
policy/
11+
*.pyc
12+
__pycache__
13+
*.svg

‎README.md

+155
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
# BigMAC
2+
3+
Extract, process, and query Android security policies from Android firmware.
4+
5+
USENIX Presentation: https://www.usenix.org/conference/usenixsecurity20/presentation/hernandez
6+
7+
## Installation
8+
9+
Clone the main repository:
10+
```
11+
git clone https://github.com/FICS/BigMAC
12+
```
13+
14+
Make a Python 3 virtual environment:
15+
```
16+
cd BigMAC/
17+
virtualenv -p python3 venv
18+
```
19+
20+
Activate the virtual environment (do this for each terminal):
21+
```
22+
source venv/bin/activate
23+
```
24+
25+
Your prompt will now look like:
26+
```
27+
(venv) $
28+
```
29+
30+
Install sefcontext-parser (it's not on pip):
31+
```
32+
git clone https://github.com/jakev/sefcontext-parser
33+
cd sefcontext-parser
34+
python setup.py install
35+
```
36+
37+
Install swi-prolog (8.0.X and above is needed):
38+
```
39+
sudo apt-add-repository ppa:swi-prolog/stable
40+
sudo apt-get update
41+
sudo apt-get install swi-prolog
42+
```
43+
44+
Install libsepol (a different version than distros have is needed):
45+
46+
```
47+
git clone --branch libsepol-2.7 https://github.com/SELinuxProject/selinux.git
48+
```
49+
50+
Install the required build dependencies:
51+
```
52+
sudo apt install build-essential flex bison swig python-dev graphviz libgraphviz-dev pkg-config libaudit-dev
53+
```
54+
55+
Apply the [selinux.patch](selinux.patch) below to selinux to make sure that it will be buildable. Apply the patch like this:
56+
57+
```
58+
$ cd selinux
59+
$ patch -p1 < ../selinux.patch
60+
```
61+
62+
Build a specific libsepol to be able to parse Android sepolicy files:
63+
```
64+
make -j # this may not completely build. as long as sepol is built, continue to install step
65+
sudo make install # you MUST install before building setools
66+
```
67+
68+
Get setools for use in Python:
69+
```
70+
git clone https://github.com/TresysTechnology/setools.git
71+
cd setools
72+
git checkout 856b56accba14 # required to match with libsepol version
73+
```
74+
75+
Apply the [setools.patch](setools.patch) below to setools to make sure that it will be buildable. Apply the patch like this:
76+
77+
```
78+
$ cd setools
79+
$ patch -p1 < ../setools.patch
80+
patching file setup.py
81+
```
82+
83+
Build and install setools.
84+
Make sure the `SEPOL_SRC` points to the correct path:
85+
86+
```
87+
SEPOL_SRC=$(pwd)/../selinux/libsepol/ python3 setup.py build_ext build_py install
88+
```
89+
90+
Go back to the main BigMAC directory and install all pip requirements:
91+
```
92+
BigMAC/ $ pip install -r requirements.txt
93+
```
94+
95+
Try running the process.py main file:
96+
```
97+
$ ./process.py
98+
BigMAC Android Policy Processor
99+
by Grant Hernandez (https://hernan.de/z)
100+
usage: process.py [-h] --vendor VENDOR [--debug] [--debug-init] [--skip-boot]
101+
[--draw-graph] [--focus-set FOCUS_SET] [--save] [--load]
102+
[--save-policy] [--list-objects] [--dont-expand-objects]
103+
[--prolog]
104+
policy_name
105+
process.py: error: the following arguments are required: --vendor, policy_name
106+
```
107+
108+
If you see the usage, all imports are correctly installed. Now move on to the next section to get started.
109+
110+
## Basic Usage
111+
112+
### Policy Processing
113+
114+
Extract out the `eval/eval-policy.tar.gz` file included in the repo for some example policies. For extracting your own from firmware we are working to stream line this process. See the [tools/](tools/) for more information.
115+
116+
To start, process a single image from a vendor and print out the log, but don't save anything. Use this to sanity check your saved policies and policy processing code.
117+
```
118+
./process.py --vendor aosp policy/aosp/sailfish-ppr2.181005.003.a1-factory-dec6298c
119+
./process.py --vendor aosp sailfish-ppr2.181005.003.a1-factory-dec6298c # equivalent to above
120+
```
121+
122+
The saved policies directory is set in the `config.py` file.
123+
124+
If you want to process a policy an interact with the final results using IPython, add the `--debug` flag.
125+
126+
```
127+
./process.py --debug --vendor aosp sailfish-ppr2.181005.003.a1-factory-dec6298c
128+
...
129+
In [0]: inst
130+
Out[0]: <overlay.SEPolicyInst at 0x7ff0a8fd2d30>
131+
```
132+
133+
Try viewing and playing with `inst.processes`, `inst.subjects`, and `inst.objects`!
134+
135+
Processing the entire policy into a graph takes time. The final results can be saved and loaded to speed things up.
136+
137+
```
138+
./process.py --vendor aosp sailfish-ppr2.181005.003.a1-factory-dec6298c --save
139+
./process.py --vendor aosp sailfish-ppr2.181005.003.a1-factory-dec6298c --load --debug # you can load from now on
140+
```
141+
142+
The saved database will be under the firmware specific policy directory under the `db/` sub directory.
143+
144+
To run prolog queries against the policy, add the `--prolog` command. The first time you do this, you will need to compile the prolog helpers.
145+
```
146+
./process.py --vendor aosp sailfish-ppr2.181005.003.a1-factory-dec6298c --load --prolog
147+
query>
148+
```
149+
150+
Prolog mode will fully instantiate the graph and emit Prolog facts and
151+
binaries. The facts from the last run will be stored in the current directory
152+
under `facts.pl`. This is compiled together with helper functions that will
153+
enable you to query against a static binary of facts, greatly speeding up
154+
queries. These binaries are stored in the `db/` sub directory of the firmware
155+
and can be run manually if you wish.

‎android/__init__.py

Whitespace-only changes.

‎android/android_filesystem_config.h

+202
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,202 @@
1+
/*
2+
* Copyright (C) 2007 The Android Open Source Project
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
/*
18+
* This file is consumed by build/tools/fs_config and is used
19+
* for generating various files. Anything #define AID_<name>
20+
* becomes the mapping for getpwnam/getpwuid, etc. The <name>
21+
* field is lowercased.
22+
* For example:
23+
* #define AID_FOO_BAR 6666 becomes a friendly name of "foo_bar"
24+
*
25+
* The above holds true with the exception of:
26+
* mediacodec
27+
* mediaex
28+
* mediadrm
29+
* Whose friendly names do not match the #define statements.
30+
*
31+
* Additionally, AID_OEM_RESERVED_START and AID_OEM_RESERVED_END
32+
* can be used to define reserved OEM ranges used for sanity checks
33+
* during the build process. The rules are, they must end with START/END
34+
* The proper convention is incrementing a number like so:
35+
* AID_OEM_RESERVED_START
36+
* AID_OEM_RESERVED_1_START
37+
* AID_OEM_RESERVED_2_START
38+
* ...
39+
* The same applies to the END.
40+
* They are not required to be in order, but must not overlap each other and
41+
* must define a START and END'ing range. START must be smaller than END.
42+
*/
43+
44+
#ifndef _ANDROID_FILESYSTEM_CONFIG_H_
45+
#define _ANDROID_FILESYSTEM_CONFIG_H_
46+
47+
#include <sys/types.h>
48+
49+
#if !defined(__ANDROID_VNDK__) && !defined(EXCLUDE_FS_CONFIG_STRUCTURES)
50+
#include <private/fs_config.h>
51+
#endif
52+
53+
/* This is the master Users and Groups config for the platform.
54+
* DO NOT EVER RENUMBER
55+
*/
56+
57+
#define AID_ROOT 0 /* traditional unix root user */
58+
/* The following are for LTP and should only be used for testing */
59+
#define AID_DAEMON 1 /* traditional unix daemon owner */
60+
#define AID_BIN 2 /* traditional unix binaries owner */
61+
62+
#define AID_SYSTEM 1000 /* system server */
63+
64+
#define AID_RADIO 1001 /* telephony subsystem, RIL */
65+
#define AID_BLUETOOTH 1002 /* bluetooth subsystem */
66+
#define AID_GRAPHICS 1003 /* graphics devices */
67+
#define AID_INPUT 1004 /* input devices */
68+
#define AID_AUDIO 1005 /* audio devices */
69+
#define AID_CAMERA 1006 /* camera devices */
70+
#define AID_LOG 1007 /* log devices */
71+
#define AID_COMPASS 1008 /* compass device */
72+
#define AID_MOUNT 1009 /* mountd socket */
73+
#define AID_WIFI 1010 /* wifi subsystem */
74+
#define AID_ADB 1011 /* android debug bridge (adbd) */
75+
#define AID_INSTALL 1012 /* group for installing packages */
76+
#define AID_MEDIA 1013 /* mediaserver process */
77+
#define AID_DHCP 1014 /* dhcp client */
78+
#define AID_SDCARD_RW 1015 /* external storage write access */
79+
#define AID_VPN 1016 /* vpn system */
80+
#define AID_KEYSTORE 1017 /* keystore subsystem */
81+
#define AID_USB 1018 /* USB devices */
82+
#define AID_DRM 1019 /* DRM server */
83+
#define AID_MDNSR 1020 /* MulticastDNSResponder (service discovery) */
84+
#define AID_GPS 1021 /* GPS daemon */
85+
#define AID_UNUSED1 1022 /* deprecated, DO NOT USE */
86+
#define AID_MEDIA_RW 1023 /* internal media storage write access */
87+
#define AID_MTP 1024 /* MTP USB driver access */
88+
#define AID_UNUSED2 1025 /* deprecated, DO NOT USE */
89+
#define AID_DRMRPC 1026 /* group for drm rpc */
90+
#define AID_NFC 1027 /* nfc subsystem */
91+
#define AID_SDCARD_R 1028 /* external storage read access */
92+
#define AID_CLAT 1029 /* clat part of nat464 */
93+
#define AID_LOOP_RADIO 1030 /* loop radio devices */
94+
#define AID_MEDIA_DRM 1031 /* MediaDrm plugins */
95+
#define AID_PACKAGE_INFO 1032 /* access to installed package details */
96+
#define AID_SDCARD_PICS 1033 /* external storage photos access */
97+
#define AID_SDCARD_AV 1034 /* external storage audio/video access */
98+
#define AID_SDCARD_ALL 1035 /* access all users external storage */
99+
#define AID_LOGD 1036 /* log daemon */
100+
#define AID_SHARED_RELRO 1037 /* creator of shared GNU RELRO files */
101+
#define AID_DBUS 1038 /* dbus-daemon IPC broker process */
102+
#define AID_TLSDATE 1039 /* tlsdate unprivileged user */
103+
#define AID_MEDIA_EX 1040 /* mediaextractor process */
104+
#define AID_AUDIOSERVER 1041 /* audioserver process */
105+
#define AID_METRICS_COLL 1042 /* metrics_collector process */
106+
#define AID_METRICSD 1043 /* metricsd process */
107+
#define AID_WEBSERV 1044 /* webservd process */
108+
#define AID_DEBUGGERD 1045 /* debuggerd unprivileged user */
109+
#define AID_MEDIA_CODEC 1046 /* mediacodec process */
110+
#define AID_CAMERASERVER 1047 /* cameraserver process */
111+
#define AID_FIREWALL 1048 /* firewalld process */
112+
#define AID_TRUNKS 1049 /* trunksd process (TPM daemon) */
113+
#define AID_NVRAM 1050 /* Access-controlled NVRAM */
114+
#define AID_DNS 1051 /* DNS resolution daemon (system: netd) */
115+
#define AID_DNS_TETHER 1052 /* DNS resolution daemon (tether: dnsmasq) */
116+
#define AID_WEBVIEW_ZYGOTE 1053 /* WebView zygote process */
117+
#define AID_VEHICLE_NETWORK 1054 /* Vehicle network service */
118+
#define AID_MEDIA_AUDIO 1055 /* GID for audio files on internal media storage */
119+
#define AID_MEDIA_VIDEO 1056 /* GID for video files on internal media storage */
120+
#define AID_MEDIA_IMAGE 1057 /* GID for image files on internal media storage */
121+
#define AID_TOMBSTONED 1058 /* tombstoned user */
122+
#define AID_MEDIA_OBB 1059 /* GID for OBB files on internal media storage */
123+
#define AID_ESE 1060 /* embedded secure element (eSE) subsystem */
124+
#define AID_OTA_UPDATE 1061 /* resource tracking UID for OTA updates */
125+
#define AID_AUTOMOTIVE_EVS 1062 /* Automotive rear and surround view system */
126+
#define AID_LOWPAN 1063 /* LoWPAN subsystem */
127+
#define AID_HSM 1064 /* hardware security module subsystem */
128+
#define AID_RESERVED_DISK 1065 /* GID that has access to reserved disk space */
129+
#define AID_STATSD 1066 /* statsd daemon */
130+
#define AID_INCIDENTD 1067 /* incidentd daemon */
131+
#define AID_SECURE_ELEMENT 1068 /* secure element subsystem */
132+
/* Changes to this file must be made in AOSP, *not* in internal branches. */
133+
134+
#define AID_SHELL 2000 /* adb and debug shell user */
135+
#define AID_CACHE 2001 /* cache access */
136+
#define AID_DIAG 2002 /* access to diagnostic resources */
137+
138+
/* The range 2900-2999 is reserved for OEM, and must never be
139+
* used here */
140+
#define AID_OEM_RESERVED_START 2900
141+
#define AID_OEM_RESERVED_END 2999
142+
143+
/* The 3000 series are intended for use as supplemental group id's only.
144+
* They indicate special Android capabilities that the kernel is aware of. */
145+
#define AID_NET_BT_ADMIN 3001 /* bluetooth: create any socket */
146+
#define AID_NET_BT 3002 /* bluetooth: create sco, rfcomm or l2cap sockets */
147+
#define AID_INET 3003 /* can create AF_INET and AF_INET6 sockets */
148+
#define AID_NET_RAW 3004 /* can create raw INET sockets */
149+
#define AID_NET_ADMIN 3005 /* can configure interfaces and routing tables. */
150+
#define AID_NET_BW_STATS 3006 /* read bandwidth statistics */
151+
#define AID_NET_BW_ACCT 3007 /* change bandwidth statistics accounting */
152+
#define AID_READPROC 3009 /* Allow /proc read access */
153+
#define AID_WAKELOCK 3010 /* Allow system wakelock read/write access */
154+
#define AID_UHID 3011 /* Allow read/write to /dev/uhid node */
155+
156+
/* The range 5000-5999 is also reserved for OEM, and must never be used here. */
157+
#define AID_OEM_RESERVED_2_START 5000
158+
#define AID_OEM_RESERVED_2_END 5999
159+
160+
#define AID_EVERYBODY 9997 /* shared between all apps in the same profile */
161+
#define AID_MISC 9998 /* access to misc storage */
162+
#define AID_NOBODY 9999
163+
164+
#define AID_APP 10000 /* TODO: switch users over to AID_APP_START */
165+
#define AID_APP_START 10000 /* first app user */
166+
#define AID_APP_END 19999 /* last app user */
167+
168+
#define AID_CACHE_GID_START 20000 /* start of gids for apps to mark cached data */
169+
#define AID_CACHE_GID_END 29999 /* end of gids for apps to mark cached data */
170+
171+
#define AID_EXT_GID_START 30000 /* start of gids for apps to mark external data */
172+
#define AID_EXT_GID_END 39999 /* end of gids for apps to mark external data */
173+
174+
#define AID_EXT_CACHE_GID_START 40000 /* start of gids for apps to mark external cached data */
175+
#define AID_EXT_CACHE_GID_END 49999 /* end of gids for apps to mark external cached data */
176+
177+
#define AID_SHARED_GID_START 50000 /* start of gids for apps in each user to share */
178+
#define AID_SHARED_GID_END 59999 /* end of gids for apps in each user to share */
179+
180+
/*
181+
* This is a magic number in the kernel and not something that was picked
182+
* arbitrarily. This value is returned whenever a uid that has no mapping in the
183+
* user namespace is returned to userspace:
184+
* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/linux/highuid.h?h=v4.4#n40
185+
*/
186+
#define AID_OVERFLOWUID 65534 /* unmapped user in the user namespace */
187+
188+
#define AID_ISOLATED_START 99000 /* start of uids for fully isolated sandboxed processes */
189+
#define AID_ISOLATED_END 99999 /* end of uids for fully isolated sandboxed processes */
190+
191+
#define AID_USER 100000 /* TODO: switch users over to AID_USER_OFFSET */
192+
#define AID_USER_OFFSET 100000 /* offset for uid ranges for each user */
193+
194+
/*
195+
* android_ids has moved to pwd/grp functionality.
196+
* If you need to add one, the structure is now
197+
* auto-generated based on the AID_ constraints
198+
* documented at the top of this header file.
199+
* Also see build/tools/fs_config for more details.
200+
*/
201+
202+
#endif

0 commit comments

Comments
 (0)