Android系统源码中SeLinux的配置

分类：Android, Java 阅读 (3,166)

3月 312020

转载请注明原文地址：http://bcoder.com/java/configuration-of-selinux-in-android-system-source-code

模块中定义的sepolicy策略文件目录如下加入到系统编译中：

在BoardConfig.mk中找BOARD_SEPOLICY_DIRS，将你的sepolicy目录加到这个变量中，如下所示：

BOARD_SEPOLICY_DIRS := \
       device/fsl/imx8/sepolicy \
       packages/services/Car/evs/sepolicy \
       device/fsl/mek_8q/sepolicy

BOARD_SEPOLICY_DIRS := \

device/fsl/imx8/sepolicy \

packages/services/Car/evs/sepolicy \

device/fsl/mek_8q/sepolicy

如何定义域？

在/system/sepolicy/public/attributes文件中输入如下的行来定义

attribute evs_domain;

1	attribute evs_domain;

如何定义某个目录或者应用文件的安全上下文？

首先在/system/sepolicy/private/file_contexts中定义如下：

/system/bin/my_app                                          u:object_r:my_app_exec:s0

1	/system/bin/my_app u:object_r:my_app_exec:s0

然后创建my_app.te的文件来定义具体的规则：

根据logcat中的avc denied的log生成合适的seLinux规则。

我们可以在logcat中看到类似如下的日志：

04-01 07:55:37.768  5155  5155 I evs_app : type=1400 audit(0.0:20): avc: denied { read } for name="egl" dev="mmcblk0p4" ino=1732 scontext=u:r:evs_app:s0 tcontext=u:object_r:system_file:s0 tclass=dir permissive=1
04-01 07:55:37.768  5155  5155 I evs_app : type=1400 audit(0.0:21): avc: denied { open } for path="/system/lib64/egl" dev="mmcblk0p4" ino=1732 scontext=u:r:evs_app:s0 tcontext=u:object_r:system_file:s0 tclass=dir permissive=1
04-01 07:55:37.768  2879  2879 E SELinux : avc:  denied  { find } for interface=android.hardware.automotive.vehicle::IVehicle pid=5155 scontext=u:r:evs_app:s0 tcontext=u:object_r:hal_vehicle_hwservice:s0 tclass=hwservice_manager permissive=1
04-01 07:55:37.936  5155  5155 I evs_app : type=1400 audit(0.0:22): avc: denied { call } for scontext=u:r:evs_app:s0 tcontext=u:r:hal_configstore_default:s0 tclass=binder permissive=1
04-01 07:55:37.941  2879  2879 E SELinux : avc:  denied  { find } for interface=android.hardware.configstore::ISurfaceFlingerConfigs pid=5155 scontext=u:r:evs_app:s0 tcontext=u:object_r:hal_configstore_ISurfaceFlingerConfigs:s0 tclass=hwservice_manager permissive=1
04-01 07:55:42.928  5181  5181 I evs_app : type=1400 audit(0.0:23): avc: denied { call } for scontext=u:r:evs_app:s0 tcontext=u:r:hal_configstore_default:s0 tclass=binder permissive=1

04-01 07:55:37.768 5155 5155 I evs_app : type=1400 audit(0.0:20): avc: denied { read } for name="egl" dev="mmcblk0p4" ino=1732 scontext=u:r:evs_app:s0 tcontext=u:object_r:system_file:s0 tclass=dir permissive=1

04-01 07:55:37.768 5155 5155 I evs_app : type=1400 audit(0.0:21): avc: denied { open } for path="/system/lib64/egl" dev="mmcblk0p4" ino=1732 scontext=u:r:evs_app:s0 tcontext=u:object_r:system_file:s0 tclass=dir permissive=1

04-01 07:55:37.768 2879 2879 E SELinux : avc: denied { find } for interface=android.hardware.automotive.vehicle::IVehicle pid=5155 scontext=u:r:evs_app:s0 tcontext=u:object_r:hal_vehicle_hwservice:s0 tclass=hwservice_manager permissive=1

04-01 07:55:37.936 5155 5155 I evs_app : type=1400 audit(0.0:22): avc: denied { call } for scontext=u:r:evs_app:s0 tcontext=u:r:hal_configstore_default:s0 tclass=binder permissive=1

04-01 07:55:37.941 2879 2879 E SELinux : avc: denied { find } for interface=android.hardware.configstore::ISurfaceFlingerConfigs pid=5155 scontext=u:r:evs_app:s0 tcontext=u:object_r:hal_configstore_ISurfaceFlingerConfigs:s0 tclass=hwservice_manager permissive=1

04-01 07:55:42.928 5181 5181 I evs_app : type=1400 audit(0.0:23): avc: denied { call } for scontext=u:r:evs_app:s0 tcontext=u:r:hal_configstore_default:s0 tclass=binder permissive=1

我们可以通过audit2allow工具把上面的log转换成合适的规则，配置在策略文件中，如果没有安装过这个工具先安装工具，如下：

sudo apt install policycoreutils

1	sudo apt install policycoreutils

将相关的log保存到一个文件中，如avclog.txt，然后执行下面的命令来生成规则：

audit2allow -i avclog.txt

1	audit2allow -i avclog.txt

打赏

Sorry, the comment form is closed at this time.