sunwave fp &Android 5.0 selinux配置笔记_v0.2

Project name sunwave fp &Android 5.0 selinux配置笔记Document ref [Document ref]

Version V0.2

Release date 2016.03.17

Owner Jone.Chen

2016.02.26 0.1 Initial Jone.Chen 2016.03.17 0.2 Initial Jone.Chen

目录

1文件目录 (4)

2修改BoardConfig.mk (4)

3修改*.te文件 (4)

3.1device.te (4)

3.2file.te (4)

3.3file_contexts (4)

3.4service.te (5)

3.5service_contexts (5)

3.6servicemanager.te (5)

3.7shell.te (5)

3.8system_app.te (5)

3.9system_server.te (6)

3.10untrusted_app.te (6)

4fpserver.te (6)

5相关问题注意事项 (8)

1文件目录

device\mediatek\common\sepolicy

device\sprd\scx35l\sepolicy\

2修改BoardConfig.mk

device\mediatek\common\BoardConfig.mk

在 BOARD_SEPOLICY_UNION 宏后加入fpserver.te

#SELinux: MTK added

BOARD_SEPOLICY_UNION := \

fpserver.te

3修改*.te文件

3.1 device.te

device\mediatek\common\sepolicy\device.te

type sunwave_device, dev_type;

3.2file.te

device\mediatek\common\sepolicy\file.te

type sunwave_data_file, file_type, data_file_type;

3.3file_contexts

device\mediatek\common\sepolicy\file_contexts

/dev/sunwave_fp u:object_r:sunwave_device:s0

/system/bin/fpserver u:object_r:fpserver_exec:s0

注意：

/dev/sunwave_fp 为驱动设备节点名称

/system/bin/fpserver 为服务应用程序，要更名为小写。

3.4service.te

device\mediatek\common\sepolicy\service.te

type fpserver_service, service_manager_type;

3.5service_contexts

device\mediatek\common\sepolicy\service_contexts

media.fp u:object_r:fpserver_service:s0

fingerManager u:object_r:system_server_service:s0

3.6 servicemanager.te

device\mediatek\common\sepolicy\servicemanager.te

allow servicemanager fpserver:dir { search };

allow servicemanager fpserver:file { open read write };

allow servicemanager fpserver:process { getattr };

3.7 shell.te

device\mediatek\common\sepolicy\shell.te

allow shell sunwave_device:chr_file {open read write ioctl};

3.8 system_app.te

device\mediatek\common\sepolicy\system_app.te

allow system_app sunwave_device:chr_file {open read write ioctl}; allow system_app fpserver:binder call;

allow system_app system_server_service:service_manager {add};

3.9 system_server.te

device\mediatek\common\sepolicy\system_server.te

allow system_server sunwave_device:chr_file {open read write ioctl};

3.10 untrusted_app.te

device\mediatek\common\sepolicy\untrusted_app.te

allow untrusted_app sunwave_device:chr_file {open read write ioctl};

4fpserver.te

device\mediatek\common\sepolicy\fpserver.te

type fpserver, domain;

type fpserver_exec, exec_type, file_type;

typeattribute fpserver mlstrustedsubject;

init_daemon_domain(fpserver)

r_dir_file(fpserver, sdcard_type)

binder_use(fpserver)

binder_call(fpserver, binderservicedomain)

binder_call(fpserver, appdomain)

binder_service(fpserver)

allow fpserver self:process execmem;

allow fpserver kernel:system module_request;

allow fpserver sdcard_type:file write;

allow fpserver fuse:dir create_dir_perms;

allow fpserver fuse:file create_file_perms;

allow fpserver self:capability { dac_override dac_read_search }; allow fpserver fpserver_service:service_manager add;

r_dir_file(fpserver, sunwave_data_file)

allow fpserver sunwave_data_file:dir ra_dir_perms;

allow fpserver sunwave_data_file:file create_file_perms;

allow fpserver sunwave_device:chr_file { open read write ioctl rw_file_perms};

allow fpserver system_data_file:dir create_dir_perms;

allow fpserver system_data_file:file create_file_perms;

allow fpserver system_file:file {read open execute_no_trans execute};

allow fpserver shell_exec:file { read open execute_no_trans execute };

allow fpserver app_data_file:dir {read write open ioctl execute search getattr add_name create_dir_p erms};

allow fpserver app_data_file:file {read write open ioctl create_file_perms};

allow fpserver apk_data_file:file {read write open ioctl create_file_perms};

allow fpserver apk_data_file:dir {read write open ioctl execute search getattr add_name create_dir_p erms};

allow fpserver fpserver:netlink_socket {create bind connect listen accept write read setopt getopt get attr ioctl};

allow fpserver fpserver:netlink_route_socket { create_socket_perms nlmsg_read nlmsg_write create i octl bind };

allow fpserver fpserver:udp_socket { create ioctl bind };

allow fpserver fpserver:tcp_socket { create ioctl bind };

allow fpserver fpserver:packet_socket { create ioctl bind};

allow fpserver fpserver:netlink_kobject_uevent_socket { create setopt bind write read ioctl};

allow fpserver ueventd:dir search;

allow fpserver ueventd:file { create write read open };

allow fpserver block_device:dir { search };

allow fpserver mmcblk_device:blk_file { open read write rw_file_perms};

allow fpserver untrusted_app:process { signull };

allow fpserver system_data_file:file { write open create setattr };

allow fpserver system_data_file:dir { write open add_name create setattr };

allow fpserver system_app_data_file:file { write open create setattr getattr };

allow system_app fpserver_service:service_manager add;

5相关问题注意事项

a.fpserver在代码编译时名为FpServer因而要更改名字,

另外更名后device\mediatek\mt6735\init.mt6735.rc文件也要做相应的修改 service fp /system/bin/fpserver

class main

user root

b.编译是要先mmm device\mediatek\common 编译一下。

c.有可能要重新new 一下工程