Android L1版本上的kernel module加载：sepolicy, kernel, .ko

来源：互联网发布：手机淘宝店铺装修布局编辑：程序博客网时间：2024/05/22 02:15

背景在Android KK 4.4 版本后，Google 有正式有限制的启用SELinux, 来增强android 的安全保护。
SELinux 分成enforcing mode 和 permissive mode, enforcing mode 会强制性限制访问; 而
permissve mode 只审查权限, 但不限制, 即不会产生实质性影响.
KK 版本, Google 只有限制的启用SELinux, 即只有针对netd, installd, zygote, vold 以及它们
直接fork 出的child process 使用enforcing mode, 但不包括zygote fork的普通app.
从L版本起，全面开启SELinux, 几乎所有的process 都使enforcing mode。项目修改原因1. 项目新增红外设备；
2. IR驱动是作为ko加载；

上述两项，都会因为SELinux而出现失败情况。修改方法设备：device/mediatek/common/sepolicy/device.te type mmcblk1_block_device, dev_type; type mmcblk1p1_block_device, dev_type; type spm_device, dev_type;+type ir_scx_device, dev_type; 工厂测试模式中的设备：device/mediatek/common/sepolicy/factory.te allow factory mtd_device:chr_file rw_file_perms; allow factory self:capability sys_resource; allow factory pro_info_device:chr_file { read write ioctl open};++# Date 2015.9.22+# Add by +allow factory ir_scx_device:chr_file { read write ioctl open }; 文件系统中的设备：device/mediatek/common/sepolicy/file_contexts /dev/ttyACM0 u:object_r:ttyACM_device:s0 /dev/hrm u:object_r:hrm_device:s0+### Add by +/dev/ir_scx(/.*)? u:object_r:ir_scx_device:s0 META测试中的设备：device/mediatek/common/sepolicy/meta_tst.te # Date: WK15.18 # Purpose: CCT open lens driver fail allow meta_tst lens_device:chr_file { read write open ioctl };++# Date 2015.9.22+# Add by +allow meta_tst ir_scx_device:chr_file { read write ioctl open }; 给予system process操作设备的权限：device/mediatek/common/sepolicy/system_server.te allow system_server nvdata_file:dir search; allow system_server nvdata_file:file { read getattr open };+# Date: 2015.9.22+# add by +allow system_server ir_scx_device:chr_file { read write ioctl open };
设置ueventd的设备属性：device/{vendor}/{project}/ueventd.{chip}.rc /dev/devmap 0440 root system /dev/mali0 0666 system graphics /dev/gps 0660 gps system+/dev/ir_scx 0660 system system 在init.project.rc中执行insmod操作：device/{vendor}/{project}/init.project.rc chmod 0660 /dev/ttyMT2 chown system system /dev/ttyMT2# Add for Consumer IR chmod 0777 /system/lib/modules/ir_scx.ko insmod /system/lib/modules/ir_scx.ko
ko insmod操作：device/mediatek/common/sepolicy/init.teallow init frp_block_device:blk_file relabelto;allow init userdata_block_device:blk_file relabelto;# Date : 2015.9.23# Operation : Migration # Purpose : support to load kernel modules.allow init self:capability { sys_module };

0 0