\u8cc7\u6599\u4f86\u6e90\uff1ahttp:\/\/www.vaststargames.com\/read.php?tid=168<\/p>\n\n\n\n
\u6b64\u7bc7\u5beb\u5f97\u5f88\u5b8c\u6574\u4e14\u6613\u61c2\uff0c\u70ba\u4e86\u9810\u9632\u4e4b\u5f8c\u5931\u806f\uff0c\u56e0\u6b64\u5728\u9019\u88e1\u5099\u4efd<\/p>\n\n\n\n\n\n\n\n
\u4e00\u3001SELinux\u662f\u4ec0\u9ebc\uff1f<\/strong> enforce\u6a21\u5f0f\uff1a\u5f37\u5236\u6a21\u5f0f\uff0c\u5fc5\u9808\u6709\u7d44\u614b\u6b0a\u9650\u624d\u80fd\u8a2a\u554f\/\u64cd\u4f5c SELinux\u9ed8\u8a8d\u662f\u6253\u958b\u7684\u3002\u6211\u5011\u53ef\u4ee5\u5728\u7a97\u53e3\u547d\u4ee4\u5217\u4e0b\u8f38\u5165\u547d\u4ee4getenforce\u4f86\u67e5\u770b\u6211\u5011\u7684\u88dd\u7f6e\u7684SELinux\u72c0\u614b\u3002\u6211\u5011\u53ef\u4ee5\u5728\u547d\u4ee4\u5217\u4e0b\u8f38\u5165\u547d\u4ee4\uff1asetenforce 0\u66ab\u6642\u6027\u7684\u5c07SELinux\u95dc\u9589\uff0c\u5982\u679c\u9700\u8981\u6c38\u4e45\u95dc\u9589\uff0c\u9700\u8981\u6211\u5011\u7de8\u8b6f\u8edf\u9ad4\u4e4b\u524d\uff0c\u5728uboot\u548ckernel\u7a0b\u5f0f\u78bc\u4e2d\u5c07androidboot.selinux\u5c6c\u6027\u8a2d\u5b9a\u70badisable\u3002<\/p>\n\n\n\n \u4e8c\u3001\u5b89\u5168\u4e0a\u4e0b\u6587\u6a19\u7c64<\/strong> \u770b\u5230\u4e00\u500b\u5b8c\u6574\u7684\u5b89\u5168\u4e0a\u4e0b\u6587\u5b83\u7531\u56db\u90e8\u5206\u7d44\u6210\uff1au,r,init,s0 \u4e09\u3001\u5982\u4f55\u7d44\u614bSELinux\u7684\u7b56\u7565<\/strong> * file_contexts \u7d44\u614b\u7528\u65bc\u5728\u5efa\u69cb\uff08\u4f8b\u5982\uff0c\u7cfb\u7d71\u5206\u5340\uff09\u548c\u57f7\u884c\u968e\u6bb5\uff08\u4f8b\u5982\uff0c\u88dd\u7f6e\u7bc0\u9ede\u3001\u670d\u52d9\u5957\u63a5\u5b57\u6a94\u6848 \u8207\u88dd\u7f6e\u76f8\u95dc\u7684\u7b56\u7565\u6a94\u6848\u4f4d\u65bc device\/xxxxxxx\/common\/sepolicy \u76ee\u9304\u4e2d\u3002<\/p>\n\n\n\n \u5728\u7d44\u614b\u898f\u5247\u4e4b\u524d\uff0c\u6211\u5011\u9996\u5148\u8981\u77e5\u9053\u4ec0\u9ebc\u662f\u898f\u5247\uff1f<\/p>\n\n\n\n \u898f\u5247\u5c31\u662f\u91dd\u5c0ddomain\u5c0d\u8c61\u7684\uff0c\u4e0a\u9762\u6211\u5011\u8aaa\u904e\uff0c\u6bcf\u4e00\u500b\u8655\u7406\u7a0b\u5e8f\u90fd\u5c6c\u65bc\u4e00\u500bdomain\uff08\u57df\uff09\uff0c\u898f\u5247\u5c31\u662f\u8a2d\u5b9a\u54ea\u500bdomain\uff08\u57df\uff09\u7684\u5c0d\u8c61\uff08\u5c31\u662f\u8655\u7406\u7a0b\u5e8f\uff09\u80fd\u5920\u5c0d\u54ea\u4e9btype\uff08\u985e\u578b\uff09\u7684\u76ee\u6a19\u5c0d\u8c61\uff08\u6a94\u6848\u6216\u8005\u5c6c\u6027\u6216\u8005\u88dd\u7f6e\uff09\u5177\u6709\u54ea\u6709\u64cd\u4f5c\uff08\u522a\u9664\u554a\uff0c\u8a2a\u554f\u554a\u7b49\u7b49\uff09\uff0c\u9019\u5c31\u662f\u898f\u5247\uff01<\/p>\n<\/blockquote>\n\n\n\n \u7d44\u614b\u898f\u5247\u6211\u5011\u4e00\u822c\u5beb\u5728device\/xxxxxxx\/common\/sepolicy\u76ee\u9304\u4e0b\u7684te\u6a94\u6848\u4e2d\u3002\u53ef\u4ee5\u770b\u5230\u9019\u500b\u76ee\u9304\u4e0b\u6709\u5f88\u591a\u7684te\u6a94\u6848\u3002 \/system\/bin\/preinstall u:object_r:preinstall_exec:s0<\/p>\n<\/blockquote>\n\n\n\n \u53ef\u4ee5\u770b\u5230\uff0c\u6211\u5011\u7d66preinstall\u7684\u985e\u578b\u53d6\u540d\u53eb\uff1apreinstall_exec\u3002\u70ba\u5565\u53eb\u9019\u500b\u540d\u5b57\uff1f\u6211\u5011\u7a0d\u5f8c\u4ecb\u7d39\uff01 \u6211\u5011\u5728device\/xxxxxxx\/common\/sepolicy\/\u76ee\u9304\u4e0b\u65b0\u5efa\u4e00\u500b\u6a94\u6848\uff0c\u53d6\u540d\u5c31\u53ebpreinstall.te:<\/p>\n\n\n\n \/\/\u9019\u53e5\u8a71\u662f\u8072\u660e\u4e00\u500b\u65b0\u7684domain\uff0c\u540d\u5b57\u53eb\uff1apreinstall \u9019\u6a23\u5beb\u5b8c\u4e86\u4e4b\u5f8c\uff0c\u6211\u5011\u5c31\u4e86\u81ea\u5df1\u7684domain\uff0c\u53ef\u4ee5\u958b\u59cb\u7d66\u81ea\u5df1\u7684domain\u4e3b\u9ad4\u8a2d\u5b9a\u6b0a\u9650\u4e86\uff0c\u5b89\u88ddAPP\uff0c\u6211\u5011\u9700\u8981\u5f9e\/data\u76ee\u9304\u4e0b\u8b80\u53d6\u6a94\u6848\uff0c\u90a3\u9ebc\u9019\u500bdata\u76ee\u9304\u7684\u5b58\u53d6\u6b0a\u5982\u4f55\u5beb\u5462\uff1f ls -Z \u5176\u4e2d\u7684vendor_file\u5c31\u662f\u6211\u5011\u7684type\u4e86\u3002\u5beb\u6b0a\u9650\u547d\u4ee4\u4e4b\u524d\uff0c\u6211\u5011\u628a\u6a19\u6e96\u516c\u5f0f\u62ff\u51fa\u4f86\uff1a<\/p>\n\n\n\n [section_rule] [section_domain] [section_target] [section_action]<\/p>\n<\/blockquote>\n\n\n\n section_rule:\u898f\u5247\u540d\u7a31\uff0c\u5e38\u7528\u7684\u6709\uff1aallow\u5141\u8a31\uff0cdontaudit\u4e0d\u8a18\u9304\uff0cneverallow\u4e0d\u5141\u8a31\u3002 \u90a3\u9ebc\u5f88\u7c21\u55ae\u4e86\uff0c\u6211\u5011\u5c31\u80fd\u5beb\u51fa\u6211\u5011\u7684\u5b8c\u6574\u7684te\u6a94\u6848\u4e86\uff1a<\/p>\n\n\n\n type preinstall domain \u9084\u6709\u4e00\u4e9b\u6211\u5011\u6c92\u60f3\u5230\u7684\u6b0a\u9650\uff0c\u5c31\u9700\u8981\u6293\u53d6\u5217\u5370dmesg | grep avc\u67e5\u770b\u9055\u53cd\u4e86\u90a3\u4e9b\u898f\u5247\uff1a\u53ef\u4ee5\u4f7f\u7528 linux \u5de5\u5177 allow2audit \u53ef\u4ee5\u5c07\u9055\u53cd\u898f\u5247\u7684 avc \u8a18\u9304\u751f\u6210\u653e\u884c\u898f\u5247 (\u9069\u5408\u65bcdmesg \u6240\u6709\u8f38\u51fa\uff0c\u521d\u671f\u7684\u958b\u767c\u968e\u6bb5)\u3002\u4e5f\u53ef\u4ee5\u624b\u52d5\u4f86\u5beb\u898f\u5247\uff0c\u4f8b\u5982\u5217\u5370\u5982\u4e0b\uff1a<\/p>\n\n\n\n type=1400audit(1386760471.880:7):avc: denied {entrypoint}for pid=1227comm=“init”path=“\/ \u6211\u5011\u5f9escontext\u4e2d\u7372\u53d6\u5230domain:healthd,\u5f9etcontext\u4e2d\u7372\u53d6\u5230type:rootfs\uff0ctclass:file allow healthd rootfs:file entrypoint;<\/p>\n<\/blockquote>\n\n\n\n \u5c07\u4ee5\u4e0arule\u8a9e\u53e5\u5beb\u9032\u540d\u5b57\u70ba\u201chealthd.te\u201d\u7684\u6a94\u6848\u4e2d\uff0c\u91cd\u65b0\u7de8\u8b6f\u5373\u53ef\uff01\u7136\u5f8c\u91cd\u65b0\u6e2c\u8a66\uff0c\u5728\u6293\u53d6\u5217\u5370\u770b\u770b\u662f\u5426\u9084\u6709\u7f3a\u5931\u7684\u5217\u5370\uff0c\u53cd\u8986\u5e7e\u6b21\u5c31OK\u4e86\uff01<\/p>\n\n\n\n \u56db\u3001App\u61c9\u7528\u7684\u5b89\u5168\u4e0a\u4e0b\u6587\u6a19\u7c64<\/strong> <!– Platform dev key in AOSP –> <!– Media key in AOSP –> <signer signature=”@NETWORK_STACK” > \u53ef\u4ee5\u770b\u5230\u9ed8\u8a8d\u9019\u88e1\u4e4b\u5b9a\u7fa9\u4e86\u4e09\u500bseinfo\uff0c\u5982\u679c\u6211\u5011APP\u7684\u7c3d\u540d\u4e0d\u5728\u9019\u5e7e\u500b\u88e1\u9762\uff0c\u90a3\u9ebcseinfo\u6703\u53d6\u503c\u70ba\u201cdefault\u201d\u3002\u78ba\u5b9a\u4e86seinfo\u5f8c\uff0c\u518d\u6839\u64dasystem\/sepolicy\/private\/seapp_contexts\u6a94\u6848\u78ba\u8a8ddoamain\u548ctype\uff1a<\/p>\n\n\n\n neverallow isEphemeralApp=true domain=((?!ephemeral_app).)*<\/p>\n\n\n\n isSystemServer=true domain=system_server_startup<\/p>\n\n\n\n user=_app seinfo=platform name=com.android.traceur domain=traceur_app type=app_data_file levelFrom=all \u4ee5\u4e0a\u6587\u4e2d\u7d05\u8272\u5b57\u9019\u884c\u70ba\u4f8b\uff1a\u7576user\u662fsystem\u6642\uff0cseinfo\u662fplatform\uff0c\u90a3\u9ebc\u5b83\u7684domain\u5c31\u662fsystem_app\uff0c\u5b83\u7684\u6a94\u6848type\u5c31\u662fsystem_app_data_file\u3002 #define AID_ROOT 0 \/* traditional unix root user *\/ #define AID_SYSTEM 1000 \/* system server *\/<\/p>\n\n\n\n #define AID_RADIO 1001 \/* telephony subsystem, RIL *\/ \u90a3\u5982\u679c\u6211\u5011\u7684APP\u662f\u7b2c\u4e09\u65b9APP\uff0c\u5b89\u88dd\u5f8c\u4ed6\u7684user\u4e00\u822c\u662f\u9019\u7a2e\u5f62\u5f0f\u7684\uff1au0_xxx\uff0c\u90a3\u9ebc\u9019\u4e9bAPP\u5728seapp_contexts\u6a94\u6848\u4e2d\u600e\u9ebc\u8868\u793a\u5462\uff1fAndroid\u7cfb\u7d71\u5c0d\u65bc\u6240\u6709\u7684\u4e0d\u662f\u7cfb\u7d71\u9810\u5b9a\u7fa9\u7684user\u7684\u5176\u4ed6\uff0c\u5168\u90e8\u8868\u793a\u70ba\uff1a”_app”\uff0c\u901a\u904e\u4e0a\u6587\u4e2d\u7684\u85cd\u8272\u5b57\u578b\u53ef\u4ee5\u770b\u5230\uff0c\u9019\u4e9bAPP\u57fa\u672c\u4e0a\u88ab\u8a8d\u5b9a\u70badomain\uff1auntrusted_app, untrusted_app_27, untrusted_app_25 \u3002<\/p>\n\n\n\n \u518d\u5f9e\u4e0a\u8ff0\u7da0\u8272\u7684\u884c\u53ef\u4ee5\u770b\u5230\uff0c\u9084\u53ef\u4ee5\u7528APP\u7684\u8655\u7406\u7a0b\u5e8fname\u4f86\u5339\u914d\u3002 user=system seinfo=platform domain=mytest_app name=com.mytest.app type=mytest_app_data_file<\/p>\n<\/blockquote>\n\n\n\n \u524d\u63d0\u662fmytest_app\u9019\u500bdomain\u548cmytest_app_data_file\u9019\u500btype\u4e5f\u8981\u624b\u52d5\u7684\u5b9a\u7fa9\u3002
SELinux\u662f\u4e00\u5957\u5b8c\u6574\u7684\u5b89\u5168\u7b56\u7565\uff0c\u6700\u958b\u59cb\u662f\u7f8e\u570b\u570b\u5bb6\u5b89\u5168\u57df\u548c\u4e00\u4e9b\u516c\u53f8\u806f\u5408\u8a2d\u8a08\u70ba\u4e86\u91dd\u5c0dLinux\u7cfb\u7d71\u7684\u5b89\u5168\u96b1\u60a3\u800c\u7522\u751f\u7684\u4e00\u5957\u7cfb\u7d71\uff0c\u5b83\u70ba\u6bcf\u4e00\u500b\u8655\u7406\u7a0b\u5e8f\uff0c\u6bcf\u4e00\u500b\u6a94\u6848\uff0c\u6bcf\u4e00\u500b\u5c6c\u6027\u90fd\u5b9a\u7fa9\u4e86\u6a19\u7c64\uff0c\u7528\u4f86\u63a7\u5236\u8655\u7406\u7a0b\u5e8f\u5c0d\u6a94\u6848\u7684\u64cd\u4f5c\u7684\u6b0a\u9650\u63a7\u5236\uff01
\u5728Android\u88e1\u9762\uff0cSELinux\u6709\u4e09\u7a2e\u72c0\u614b\uff1a<\/p>\n\n\n\n\n
permissive\u6a21\u5f0f\uff1a\u5bec\u5bb9\u6a21\u5f0f\uff0c\u5217\u5370\u8a18\u9304\u51fa\u73fe\u7684\u8d8a\u6b0a\u884c\u70ba\uff0c\u4f46\u662f\u4e0d\u7981\u6b62\u8a72\u8a2a\u554f\/\u64cd\u4f5c
disable\uff1a\u95dc\u9589\u6a21\u5f0f\uff0c\u95dc\u9589SELinux\uff0c\u53ef\u4ee5\u81ea\u7531\u8a2a\u554f<\/p>\n<\/blockquote>\n\n\n\n
\u4e0a\u9762\u6709\u63d0\u5230SELinux\u7cfb\u7d71\u4e2d\uff0c\u6bcf\u4e00\u500b\u5c0d\u8c61\uff08\u8655\u7406\u7a0b\u5e8f\u548c\u6a94\u6848\u6216\u8005\u88dd\u7f6e\uff09\u90fd\u6709\u81ea\u5df1\u7684\u5b89\u5168\u6a19\u7c64\u3002\u5728\u5e8f\u5217\u57e0\u4e0b\uff0c\u901a\u904eps -Z\u547d\u4ee4\u53ef\u4ee5\u67e5\u770b\u8655\u7406\u7a0b\u5e8f\u7684\u5b89\u5168\u4e0a\u4e0b\u6587\u6a19\u7c64\uff0c\u53ef\u4ee5\u901a\u904els -Z\u67e5\u770b\u6a94\u6848\u7684\u5b89\u5168\u4e0a\u4e0b\u6587\u6a19\u7c64\uff0c\u4f8b\u5982\uff1a<\/p>\n\n\n\n\n
\n
u\uff1a\u8868\u793a\u4f7f\u7528\u8005\uff0cAndroid\u7cfb\u7d71\u7684SELinux\u4e2d\u4e4b\u5b9a\u7fa9\u4e86\u4e00\u500b\u4f7f\u7528\u8005\uff0c\u6240\u6709\u7684\u8655\u7406\u7a0b\u5e8f\u90fd\u5c6c\u65bc\u540c\u4e00\u500b\u5b89\u5168\u4f7f\u7528\u8005\uff0c\u53eb\u505a\uff1au
r\uff1a\u8868\u793a\u89d2\u8272\uff0c\u8868\u793a\u9019\u662f\u4e00\u500b\u8655\u7406\u7a0b\u5e8f\u7684\u5b89\u5168\u4e0a\u4e0b\u6587\uff0c\u548c\u6a94\u6848\u7684\u5b89\u5168\u4e0a\u4e0b\u6587\uff08object_r\uff09\uff0c\u5c6c\u6027\u4e0a\u4e0b\u6587\u548c\u5176\u4ed6\u4e0a\u4e0b\u6587\u5f7c\u6b64\u5340\u5206
init\uff1a\u9019\u500b\u6b04\u4f4d\u5c0d\u65bc\u8655\u7406\u7a0b\u5e8f\u6216\u8005\u670d\u52d9\u4f86\u8aaa\uff0c\u662f\u8868\u793a\u8655\u7406\u7a0b\u5e8f\u904b\u884c\u7684\u57df\uff0c\u4e5f\u53eb\uff1adomain\uff08\u5f8c\u9762\u7d44\u614b\u898f\u5247\u7684\u6642\u5019\u6703\u9047\u5230\uff09\uff0c\u800c\u5c0d\u65bc\u6a94\u6848\u6216\u8005\u5176\u4ed6\u5c0d\u8c61\u4f86\u8aaa\uff0c\u53ef\u4ee5\u7406\u89e3\u70ba\u985e\u578btype\u3002\u6839\u64da\u4e0d\u540c\u7684\u5c0d\u8c61\uff08\u6709\u7684\u662f\u6a94\u6848\uff0c\u6709\u7684\u662f\u88dd\u7f6e\uff0c\u6709\u7684\u662f\u8655\u7406\u7a0b\u5e8f\uff09\uff0cAndroid\u5b9a\u7fa9\u4e86100\u591a\u500b\u4e0d\u540c\u7684\u95dc\u9375\u5b57\u4f86\u5340\u5225\u9019\u4e9b\u8655\u7406\u7a0b\u5e8f\u7684\u57df\u548c\u6a94\u6848\u548c\u88dd\u7f6e\u7684\u985e\u578b\u3002
s0\uff1a\u5b89\u5168\u7b49\u7d1a\uff0c\u7b2c\u56db\u5217\u5c08\u70ba\u591a\u7d1a\u5b89\u5168\u529f\u80fd\uff08\u64f4\u5c55 MLS\uff09\u800c\u8a2d\u8a08\uff0cMLS \u662f\u4e00\u7a2e\u8a2a\u554f\u6a5f\u5236\uff0c\u53ef\u589e\u52a0\u5b89\u5168\u4e0a\u4e0b\u6587\u548c\u683c\u5f0f\u654f\u611f\u5ea6 [: \u985e\u5225\u5217\u8868] [-\u654f\u611f\u5ea6 [: \u985e\u5225\u5217\u8868]]\uff0c\u4f8b\u5982 s0 – s15: c0 – c1023\uff0c\u800c\u5728\u7576\u524dAndroid \u7248\u672c\u4e2d\u4e0d\u9700\u8981\u985e\u5225\u3002
\u5728Android\u7cfb\u7d71\u4e2d\uff0c\u6211\u5011\u53ea\u9700\u8981\u91cd\u9ede\u95dc\u6ce8\u7b2c\u4e8c\u548c\u7b2c\u4e09\u500b\u6b04\u4f4d\uff0c\u5c31\u662f\u89d2\u8272\u548c\u57df\/\u985e\u578b\u3002<\/p>\n\n\n\n
SEAndroid \u7b56\u7565\u6e90\u4f4d\u65bc SDK system\/sepolicy \u76ee\u9304\u3002\u8a72\u7b56\u7565\u5305\u62ec\u7528\u65bc\u751f\u6210 SELinux \u6838\u5fc3\u7b56\u7565\u6a94\u6848\u7684\u539f\u59cb\u6a94\uff1afile_contexts \u7d44\u614b\u3001property_contexts \u7d44\u614b\u3001seapp_contexts \u7d44\u614b\u548c mac_permissions.xml \u7d44\u614b\u3002<\/p>\n\n\n\n\n
\u548c\u7531 init.rc \u5efa\u7acb\u7684\/\u8cc7\u6599\u76ee\u9304\u7b49\uff09\u6a19\u8a18\u6a94\u6848\u3002
* property_contexts \u88ab\u7528\u65bc\u6307\u5b9a Android \u5c6c\u6027\u7684\u5b89\u5168\u4e0a\u4e0b\u6587\uff0c\u4f9b\u67e5\u770b\u6b0a\u9650\u3002
* seapp_contexts \u7d44\u614b\u88ab\u7528\u65bc\u6a19\u8a18\u61c9\u7528\u8655\u7406\u7a0b\u5e8f\u548c\u61c9\u7528\u7a0b\u5f0f\u5305\u76ee\u9304\u3002
* mac_permissions.xml \u7d44\u614b\u662f\u4e2d\u4ecb\u8edf\u9ad4 MAC \u7b56\u7565<\/p>\n<\/blockquote>\n\n\n\n\n
\u90a3\u9ebc\u5177\u9ad4\u61c9\u8a72\u5982\u4f55\u4f86\u7de8\u5beb\u5462\uff1f\u9019\u88e1\u6211\u5011\u8209\u4e00\u500b\u4f8b\u5b50\u4f86\u8aaa\u660e\uff1a\u5047\u5982\u6211\u5011\u8981\u5728init.rc\u6a94\u6848\u4e2d\u555f\u52d5\u4e00\u500bservice\uff0c\u4ed6\u7684\u529f\u80fd\u662f\u5728\u958b\u6a5f\u7684\u6642\u5019\u5b89\u88dd\u4e00\u4e9bAPP\uff0c\u6211\u5011\u5df2\u7d93\u7de8\u8b6f\u597d\u4e86\u9019\u500bservice\u7684\u53ef\u57f7\u884c\u6a94\u6848\uff1apreinstall\u3002
1.\u9996\u5148\u525b\u525b\u4e0a\u9762\u8b1b\u4e86\uff0c\u6bcf\u4e00\u500b\u5c0d\u8c61\u4e0d\u7ba1\u662f\u6a94\u6848\u9084\u662f\u5c6c\u6027\u9084\u662f\u88dd\u7f6e\uff0c\u5728SELinux\u4e0b\u90fd\u6709\u4e00\u500b\u5b89\u5168\u4e0a\u4e0b\u6587\uff0c\u6211\u5011\u9996\u5148\u8981\u5b9a\u7fa9\u6211\u5011\u7684\u53ef\u57f7\u884c\u6a94\u6848preinstall\u7684\u5b89\u5168\u4e0a\u4e0b\u6587\uff0c\u9019\u500b\u4e0a\u9762\u6709\u4ecb\u7d39\u662f\u5728device\/xxxxxxx\/common\/sepolicy\/file_contexts\u6a94\u6848\u4e2d\u8a2d\u5b9a\u7684\uff1a\u6309\u7167\u4e0a\u9762\u4ecb\u7d39\u7684\u5b89\u5168\u4e0a\u4e0b\u6587\u683c\u5f0f\uff0c4\u500b\u90e8\u5206\uff0c\u6211\u5011\u5b9a\u7fa9\u70ba\uff1a<\/p>\n\n\n\n\n
\u4e0a\u9762\u8aaa\u4e86\u898f\u5247\u7684\u4e3b\u9ad4\u662fdomain\uff0c\u90a3\u9ebc\u9019\u88e1\uff0c\u6211\u5011\u7684domain\u662f\u4ec0\u9ebc\u5462\uff1f\u6211\u5011\u7684preinstall\u662f\u5beb\u5728init.rc\u4e2d\uff0c\u662ffork\u81eainit\u8655\u7406\u7a0b\u5e8f\u7684\uff0cinit\u8655\u7406\u7a0b\u5e8f\u7684domain\u7cfb\u7d71\u5df2\u7d93\u7d44\u614b\u4e86\uff0c\u5b83\u7684domain\u5c31\u53eb\u505a\u201cinit\u201d\u3002\u5728SELinux\u7684\u7cfb\u7d71\u4e2d\uff0c\u5b50\u8655\u7406\u7a0b\u5e8ffork\u7236\u8655\u7406\u7a0b\u5e8f\uff0c\u4ed6\u5011\u7684domain\u4e5f\u662f\u9ed8\u8a8d\u7e7c\u627f\u81ea\u7236\u8655\u7406\u7a0b\u5e8f\uff0c\u6240\u4ee5\u6211\u5011\u7684preinstall\u6240\u5728\u7684\u5b50\u8655\u7406\u7a0b\u5e8f\u7684\u57df\u9ed8\u8a8d\u4e5f\u662f\u201cinit\u201d\u3002\u90a3\u6211\u5011\u662f\u4e0d\u662f\u53ef\u4ee5\u958b\u59cb\u91dd\u5c0d\u201cinit\u201d\u9019\u500bdomain\u958b\u59cb\u7de8\u5beb\u898f\u5247\u4e86\u5462\uff1f\u7b54\u6848\u662f\u4e0d\u80fd\uff01\u56e0\u70bainit\u8655\u7406\u7a0b\u5e8f\u57df\u662f\u7cfb\u7d71\u7684\uff0c\u8ca0\u8cac\u5f88\u591a\u57fa\u790e\u7684\u5de5\u4f5c\uff0c\u800c\u6211\u5011\u7684preinstall\u8655\u7406\u7a0b\u5e8f\u548cinit\u8655\u7406\u7a0b\u5e8f\u6c92\u6709\u4ec0\u9ebc\u95dc\u4fc2\u548c\u806f\u7d61\uff0c\u662f\u5f7c\u6b64\u7368\u7acb\u7684\u5169\u500b\u529f\u80fd\uff0c\u5728SELinux\u7684\u539f\u5247\u4e0a\uff0c\u61c9\u8a72\u5c07preinstall\u8655\u7406\u7a0b\u5e8f\u57df\u5f9einit\u8655\u7406\u7a0b\u5e8f\u57df\u4e2d\u55ae\u7368\u51fa\u4f86\uff0c\u50c5\u91dd\u5c0dpreinstall\u5b50\u8655\u7406\u7a0b\u5e8f\u57df\u7d44\u614b\u8a72\u6709\u7684\u6b0a\u9650\uff0c\u800c\u4e0d\u662f\u76f4\u63a5\u5728init\u8655\u7406\u7a0b\u5e8f\u57df\u7684\u57fa\u790e\u4e0a\u65b0\u589e\u7f3a\u5c11\u7684\u6b0a\u9650\uff0c\u9019\u6a23\u4e5f\u662f\u70ba\u4e86\u7b26\u5408SELinux\u7684\u898f\u7bc4\uff01\u90a3\u9ebc\u554f\u984c\u4f86\u4e86\uff0c\u600e\u9ebc\u5efa\u7acbpreinstall\u81ea\u5df1\u7684\u7684domain\u5462\uff1f<\/p>\n\n\n\n\n
type preinstall domain<\/strong><\/p>\n\n\n\n
\/\/\u9019\u53e5\u8a71\u662f\u8072\u660e\u4e00\u500b\u65b0\u7684type\uff0c\u540d\u5b57\u53eb\uff1apreinstall_exec\uff0c\u6211\u5011\u4e4b\u524d\u5728file_contexts\u4e2d\u5f15\u7528\u4e86\u9019\u500btype\u7684\u3002
\/\/\u5f8c\u9762\u7684exec_type\u5c31\u662f\u8aaa\u628a\u6211\u5011\u65b0\u7684preinstall_exec\u548c\u7cfb\u7d71\u5b9a\u7fa9\u597d\u7684exec_type\u95dc\u806f\u8d77\u4f86\uff0c\u53ef\u4ee5\u985e\u6bd4\u65bcjava\u7684\u7e7c\u627f\uff0c\u5b50\u985e\u7e7c\u627f\u7236\u985e\u7684\u5c6c\u6027\u7684\u6982\u5ff5\u3002\u56e0\u70ba\u6211\u5011\u7684preinstall\u662f\u500b\u53ef\u57f7\u884c\u6a94\u6848\uff0c\u6240\u4ee5\u6211\u5011\u7e7c\u627f\u4e86\u7cfb\u7d71\u7684exec_type\uff0c\u800c\u4e0d\u662fdevice_type\u5f88\u597d\u7406\u89e3\u5427\uff0c\u4e5f\u53ef\u4ee5\u540c\u6642\u95dc\u806f\u591a\u500btype\uff0c\u4f8b\u5982\uff1atype preinstall_exec exec_type vendor_type\uff0c\u5c31\u662f\u8aaa\u6211\u7684preinstall_type\u540c\u6642\u548cexec_type\u548cvendor_type\u5177\u6709\u76f8\u540c\u7684\u5c6c\u6027\u3002
type preinstall_exec exec_type<\/strong><\/p>\n\n\n\n
\/\/\u9019\u4e0b\u9762\u9019\u53e5\u8a71\u7684\u65b9\u6cd5\u5be6\u73fe\u5728\u539f\u59cb\u78bc\u4e2d\u7684te_macros\u6a94\u6848\u4e2d\uff0c\u610f\u601d\u6211\u5927\u6982\u7ffb\u8b6f\u4e00\u4e0b\u5c31\u662f\uff1a
\u7576init\u8655\u7406\u7a0b\u5e8f\u4e2d\u57f7\u884c\u4e86\u201cpreinstall_exec\u201d type\u7684\u6a94\u6848\u6642\uff0c\u5c07\u65b0\u7684\u5b50\u8655\u7406\u7a0b\u5e8f\u7684domain\u5f9e\u9ed8\u8a8d\u7684init\u8f49\u63db\u5230preinstall\u9019\u500bdomain
init_daemon_trans(preinstall)<\/strong><\/p>\n<\/blockquote>\n\n\n\n
\u9996\u5148\u6211\u5011\u53ef\u4ee5\u5728\u547d\u4ee4\u5217\u4e0b\u901a\u904els -Z\u67e5\u770b\u4e00\u4e0bdata\u76ee\u9304\u7684\u5b89\u5168\u4e0a\u4e0b\u6587\uff1a<\/p>\n\n\n\n\n
data u:object_r:vendor_file:s0<\/p>\n<\/blockquote>\n\n\n\n\n
section_domain\uff1adomain\u57df\uff0c\u5c0d\u54ea\u4e00\u500bdomain\u9032\u884c\u64cd\u4f5c\uff0c\u5c31\u5beb\u54ea\u500b\u540d\u5b57\u3002
section_target\uff1a\u64cd\u4f5c\u7684\u5c0d\u8c61type\u8cc7\u8a0a\uff0c\u6709\u5b89\u5168\u4e0a\u4e0b\u6587\u7684\u4e2dtype\uff0c\u5f8c\u9762\u52a0\u5192\u865f\uff0c\u52a0\u4e00\u500bclass\u7d44\u6210\u3002class\u6709file\uff0cdir\uff0cfd\u7b49\u7b49\uff0c\u5177\u9ad4\u53ef\u4ee5\u5728security_classes\u6a94\u6848\u4e2d\u53ef\u4ee5\u67e5\u770b\u3002
section_action\uff1a\u5177\u9ad4\u7684\u52d5\u4f5c\uff0c\u8b80read\uff0c\u5bebwrite\uff0c\u5efa\u7acbcreate\u7b49\uff0c\u5177\u9ad4\u53ef\u4ee5\u5728access_vectors\u6a94\u6848\u4e2d\u67e5\u770b\uff01<\/p>\n\n\n\n\n
type preinstall_exec exec_type
init_daemon_trans(preinstall)
allow preinstall vendor_file:file read<\/p>\n<\/blockquote>\n\n\n\n\n
sbin\/healthd”dev=“rootfs”ino=4396scontext=u:r:healthd:s0tcontext=u:object_r:rootfs:s0tclass=file<\/p>\n<\/blockquote>\n\n\n\n
\u6240\u4ee5\u6211\u5011\u53ef\u4ee5\u5beb\u51farule\u5982\u4e0b\uff1a<\/p>\n\n\n\n\n
\u4e0a\u9762\u4ecb\u7d39\u4e86\u6211\u5011\u7684\u4e8c\u9032\u5236\u53ef\u57f7\u884c\u6a94\u6848\u4e00\u822c\u90fd\u662f\u901a\u904edomain\u9077\u79fb\u4f86\u78ba\u5b9a\u81ea\u5df1\u7684domain\uff0c\u800cAPP\u61c9\u7528\u7684\u5b89\u5168\u4e0a\u659c\u7d0b\u6a19\u7c64\u537b\u4e0d\u4e00\u6a23\uff0c\u9019\u88e1\u6211\u5011\u55ae\u7368\u4ecb\u7d39\u3002
seinfo<\/strong>
\u6211\u5011\u90fd\u77e5\u9053APP\u90fd\u6703\u88ab\u7c3d\u540d\uff0c\u4e00\u822c\u6709\u9019\u56db\u7a2e\u7c3d\u540d\uff1aplatform\uff0cmedia\uff0ctest\uff0cshared\u3002\u800cSELinux\u7cfb\u7d71\u5c31\u662f\u6839\u64daAPP\u88ab\u7c3d\u540d\u7684\u4e0d\u540c\uff0c\u5b9a\u7fa9\u4e86\u4e0d\u540c\u7684seinfo(\u5b89\u5168\u8cc7\u8a0a)\u6982\u5ff5\u3002\u5728system\/sepolicy\/private\/mac_permissions.xml\u6a94\u6848\u4e2d\u5b9a\u7fa9\u4e86\u6839\u64da\u4e0d\u540c\u7684\u7c3d\u540d\u4f86\u78ba\u5b9a\u4e0d\u540c\u7684seinfo\uff1a<\/p>\n\n\n\n\n
<signer signature=”@PLATFORM” >
<seinfo value=”platform” \/>
<\/signer><\/p>\n\n\n\n
<signer signature=”@MEDIA” >
<seinfo value=”media” \/>
<\/signer><\/p>\n\n\n\n
<seinfo value=”network_stack” \/>
<\/signer><\/p>\n<\/blockquote>\n\n\n\n\n
user=system seinfo=platform domain=system_app type=system_app_data_file<\/mark>
user=bluetooth seinfo=platform domain=bluetooth type=bluetooth_data_file
user=network_stack seinfo=network_stack domain=network_stack levelFrom=all type=radio_data_file
user=nfc seinfo=platform domain=nfc type=nfc_data_file
user=secure_element seinfo=platform domain=secure_element levelFrom=all
user=radio seinfo=platform domain=radio type=radio_data_file
user=shared_relro domain=shared_relro
user=shell seinfo=platform domain=shell name=com.android.shell type=shell_data_file
user=webview_zygote seinfo=webview_zygote domain=webview_zygote
user=_isolated domain=isolated_app levelFrom=all
user=_app seinfo=app_zygote domain=app_zygote levelFrom=all
user=_app seinfo=media domain=mediaprovider name=android.process.media type=app_data_file levelFrom=user<\/mark>
user=_app seinfo=platform domain=platform_app type=app_data_file levelFrom=user
user=_app isEphemeralApp=true domain=ephemeral_app type=app_data_file levelFrom=all
user=_app isPrivApp=true domain=priv_app type=privapp_data_file levelFrom=user
user=_app minTargetSdkVersion=29 domain=untrusted_app type=app_data_file levelFrom=all
user=_app minTargetSdkVersion=28 domain=untrusted_app_27 type=app_data_file levelFrom=all
user=_app minTargetSdkVersion=26 domain=untrusted_app_27 type=app_data_file levelFrom=user
user=_app domain=untrusted_app_25 type=app_data_file levelFrom=user
user=_app minTargetSdkVersion=28 fromRunAs=true domain=runas_app levelFrom=all
user=_app fromRunAs=true domain=runas_app levelFrom=user<\/mark><\/p>\n<\/blockquote>\n\n\n\n
\u9019\u88e1\u7684user\u662f\u6307\u7684APP\u7684uid\uff0c\u7cfb\u7d71\u6703\u70ba\u6bcf\u4e00\u500b\u61c9\u7528\u5206\u914d\u4e00\u500buid\uff0c\u5b9a\u7fa9\u5728system\/core\/include\/private\/android_filesystem_config.h\u6a94\u6848\u4e2d\uff0candroid\u7cfb\u7d71\u9ed8\u8a8d\u4fdd\u7559\u4e861000-9999\u4e4b\u5167\u7684uid\uff0c\u4f8b\u59821000\u5c31\u662f\u8868\u793asystem\uff1a<\/p>\n\n\n\n\n
\/* The following are for LTP and should only be used for testing *\/
#define AID_DAEMON 1 \/* traditional unix daemon owner *\/
#define AID_BIN 2 \/* traditional unix binaries owner *\/<\/p>\n\n\n\n
#define AID_BLUETOOTH 1002 \/* bluetooth subsystem *\/
#define AID_GRAPHICS 1003 \/* graphics devices *\/
#define AID_INPUT 1004 \/* input devices *\/
#define AID_AUDIO 1005 \/* audio devices *\/
#define AID_CAMERA 1006 \/* camera devices *\/<\/p>\n<\/blockquote>\n\n\n\n
\u5982\u679c\u6211\u5011\u9700\u8981\u91dd\u5c0d\u6211\u5011\u7684\u67d0\u4e00\u500b\u9810\u88dd\u5728system\u76ee\u9304\u4e0b\u4f7f\u7528platform\u7c3d\u540d\u7684APP\u55ae\u7368\u4e00\u500b\u5b89\u5168\u4e0a\u4e0b\u6587\uff0c\u6211\u5011\u53ea\u9700\u8981\u5728\u6211\u5011\u81ea\u5df1\u7684SELinux\u76ee\u9304device\/xxxxxxx\/common\/sepolicy\/private\u76ee\u9304\u65b0\u589eseapp_contexts\u6a94\u6848\uff0c\u65b0\u589e\u4e00\u689d\uff1a<\/p>\n\n\n\n\n
\u6709\u4e86\u55ae\u7368\u7684domain\uff0c\u6211\u5011\u53ef\u4ee5\u91dd\u5c0d\u9019\u500bAPP\u55ae\u7368\u7d44\u614b\u6b0a\u9650\u4e86\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"