[Magisk] rodken:
Verbatim from the developer(s) of Magisk Alpha:

magisk may lead to leakage of device unique identifiers

Affected versions: All versions before 27.0, and under special circumstances all versions after 27003 Affected devices: Android11 and higher devices

Details

Starting from Android 11, the system restricts user applications from using netlink's RTM_GETLINK to read the network card mac address. This is achieved by customizing SELinux to add flag bits. This modification is rejected by Linux upstream and is an Android-specific modification.

Prior to 27.0, magisk used the upstream libselinux library, so this Android-specific flag was lost when patching sepolicy, resulting in the restriction not being enabled properly and any application being able to read the mac address.

After 27.0, magisk enables restrictions unconditionally for all devices. However, some devices that have been upgraded to new kernels support processing this flag, but the sepolicy in the user space is not ready, causing all processes to be restricted. The intuitive manifestation is that they cannot connect to WiFi.

Starting from 27003, magisk parses the flag of the old sepolicy and copies it to the new sepolicy, and the original problem is solved.

Magisk's sepolicy real-time patching function reads the current sepolicy from the kernel and reloads the sepolicy after patching the rules. Due to bugs in the kernel, Android-specific flags will not be reported to user space, and the current sepolicy read by magisk will never have this specific flag. So after sepolicy was patched in real time, the restriction was disabled and all applications could read the mac address.

This kernel bug can be fixed using https://android-review.googlesource.com/c/kernel/common/+/3009995 , but for unknown reasons Google requested that the patch be submitted to Linux upstream, and then it was said that this Android-specific bug should be deleted. Function. In short, the patch is currently refused to be merged by Google, and there is nothing we can do about it. Compared with being unable to connect to WiFi, it is acceptable to leak the mac address after patching the sepolicy in real time.

Utilization

We observed that popular apps are using RTM_GETLINK to obtain the device mac address. At least one app detects magisk by determining that Android 11+ devices can still read mac addresses.

suggestion

Devices prior to Android 11 are not affected. Other devices should be upgraded to magisk 27.0. If WiFi is not available, upgrade to 27003. When using 27003+, do not use sepolicy live patching, check all modules and root applications and ask their developers to switch to sepolicy.rule.

Related Links

magisk causes mac address to leak https://github.com/topjohnwu/Magisk/issues/7636

magisk breaks WiFi https://github.com/topjohnwu/Magisk/issues/7764

magisk copies Android specific flags to new sepolicy https://github.com/topjohnwu/selinux/commit/48fcf8bba0635dc597bef75994294fd055d9f0ba

Implementation of Android-specific flags in the kernel (only the policydb_read() function is processed, and the policydb_write() function is forgotten)https://android.googlesource.com/ke...dacce6fbc6fchttps://android.googlesource.com/ kernel/common/+/bdf56fbea560eea1e9c2793d69ba13cca2596d7d

Kernel repair patch, processing policydb_write() function https://android-review.googlesource.com/c/kernel/common/+/3009995

Acknowledgments

aviraxp https://t.me/qianqianzhuang/33