SELinux权限问题

1、property权限问题

开发时遇到一个问题，在系统代码中调用获取prop，获取不到，报出如下权限问题

Line 3864: 11-28 10:41:45.085   819   819 W Binder:819_5: type=1400 audit(0.0:41): avc: denied { read } for name="u:object_r:vendor_hwversion_prop:s0" dev="tmpfs" ino=12664 scontext=u:r:system_server:s0 tcontext=u:object_r:vendor_hwversion_prop:s0 tclass=file permissive=0

修改如下

device\qcom\sepolicy\vendor\msm8937\system_server.te

添加获取prop权限

get_prop(system_server, vendor_hwversion_prop)

2、自定义property

Android 14以后，Android规范了property相关定义，系统默认属性分为了

system_internal_prop，system_restricted_prop，system_public_prop

vendor_internal_prop，vendor_restricted_prop，vendor_public_prop

例如：如果在vendor定义相关属性，需要在system分区使用

2.1、vendor分区

需在Vendor分区中property_contexts中添加申明

/LA.UM.9.14.1.r1/device/qcom/sepolicy_vndr/generic/vendor/common/property_contexts

比如声明my.oem.conf.开头的property

my.oem.conf.               u:object_r:my_oem_prop:s0

/LA.UM.9.14.1.r1/device/qcom/sepolicy_vndr/generic/vendor/common/property.te

vendor_public_prop(my_oem_prop);

2.2、System分区

    不需在System分区中property_contexts中再次申明，否则会出现打包报错，但是需要在property.te修改申明vendor_public_prop(my_oem_prop);

LA.QSSI.14.0.r1/system/sepolicy/public/property.te

vendor_public_prop(my_oem_prop);

3、SELINUX报错

[  148.290891] init: Command 'start vendor_diag' action=persist.ucloud.diag.enabled=1 (/vendor/etc/init/hw/init.qcom.rc:763) took 1ms and failed: Could not start service: File /system/vendor/bin/diag_socket_log(labeled "u:object_r:vendor_diag_exec:s0") has incorrect label or no domain transition from u:r:init:s0 to another SELinux domain defined. Have you configured your service correctly? https://source.android.com/security/selinux/device-policy#label_new_services_and_address_denials. Note: this error shows up even in permissive mode in order to make auditing denials possible.

检查相关自动转化

domain_auto_trans(init, vendor_diag_exec, diagtest)