用户自行开发的app需要访问底层serial port。我们开发的app
在SELinux(或SEAndroid)中分为主要三种类型(根据user不同,也有其他的domain类型):
1)untrusted_app 第三方app,没有Android平台签名,没有system权限
2)platform_app
有android平台签名,没有system权限
3)system_app
有android平台签名和system权限
从上面划分,权限等级,理论上:untrusted_app < platform_app < system_app
APP的domain和type
查看seapp_contexts文件,APP的domain和type由user和seinfo两个参数决定。
Policy files
以 *.te 结尾的文件是 SELinux 政策源代码文件,用于定义域及其标签。
标签、规则和域
规则采用以下形式:allow domains types:classes permissions;,其中:
Domain - 一个进程或一组进程的标签。也称为域类型,因为它只是指进程的类型。
Type - 一个对象(例如,文件、套接字)或一组对象的标签。
Class - 要访问的对象(例如,文件、套接字)的类型。
Permission - 要执行的操作(例如,读取、写入)。
QSSI11/device/qcom/sepolicy_vndr
添加serial port对象的标签
定义标签的类型:
diff --git a/generic/vendor/common/device.te b/generic/vendor/common/device.te
index e80846f..9372a3d 100644
--- a/generic/vendor/common/device.te
+++ b/generic/vendor/common/device.te
@@ -67,3 +67,5 @@
type vendor_qce_device, dev_type;
type vendor_npu_device, dev_type;
type vendor_qmcs_block_device, dev_type;
+# for serialtester app
+type vendor_serialtester_dev, dev_type, mlstrustedobject;
添加对象(我们要操作的串口设备文件)的标签:
diff --git a/generic/vendor/common/file_contexts b/generic/vendor/common/file_contexts
index 4946d1c..6188613 100644
--- a/generic/vendor/common/file_contexts
+++ b/generic/vendor/common/file_contexts
@@ -95,6 +95,7 @@
/dev/socket/pps u:object_r:vendor_pps_socket:s0
/dev/nq-nci u:object_r:nfc_device:s0
/dev/ttyHS0 u:object_r:hci_attach_dev:s0
+/dev/ttyHS1 u:object_r:vendor_serialtester_dev:s0
/dev/wlan u:object_r:vendor_wlan_device:s0
/dev/socket/qmux_radio(/.*)? u:object_r:vendor_qmuxd_socket:s0
/dev/socket/qcrild(/.*)? u:object_r:vendor_rild_socket:s0
添加访问权限
添加untrusted_app对serial port的访问权限:
diff --git a/generic/vendor/common/shell.te b/generic/vendor/common/shell.te
index cd3fb78..67cd02d 100644
--- a/generic/vendor/common/shell.te
+++ b/generic/vendor/common/shell.te
@@ -32,3 +32,4 @@
# allow shell users to control kgsl perfcounters
allow shell vendor_sysfs_kgsl_shell:file rw_file_perms;
+allow shell vendor_serialtester_dev:chr_file rw_file_perms;
diff --git a/generic/vendor/common/untrusted_app.te b/generic/vendor/common/untrusted_app.te
new file mode 100644
index 0000000..8a344f8
--- /dev/null
+++ b/generic/vendor/common/untrusted_app.te
@@ -0,0 +1,29 @@
+# typeattribute untrusted_app mlstrustedsubject;
+typeattribute untrusted_app coredomain;
+allow untrusted_app vendor_serialtester_dev:chr_file { read write open ioctl getattr };
权限组添加:
QSSI11/device/qcom/common / rootdir/etc/init.qcom.rc
on init
# Support legacy paths
symlink /sdcard /mnt/sdcard
symlink /sdcard /storage/sdcard0
# Create cgroup mount point for memory
mkdir /sys/fs/cgroup/memory/bg 0750 root system
write /sys/fs/cgroup/memory/bg/memory.swappiness 140
write /sys/fs/cgroup/memory/bg/memory.move_charge_at_immigrate 1
chown root system /sys/fs/cgroup/memory/bg/tasks
chmod 0660 /sys/fs/cgroup/memory/bg/tasks
chown system system /sys/class/leds/red/brightness
chmod 0664 /sys/class/leds/red/brightness
chown system system /sys/class/leds/green/brightness
chmod 0664 /sys/class/leds/green/brightness
chown system system /sys/class/leds/blue/brightness
chmod 0664 /sys/class/leds/blue/brightness
chown system system /dev/ttyHS1
chmod 0666 /dev/ttyHS1
测试命令
测试串口:
adb disable-verity
adb root
adb shell cat dev/ttyHS1
查看权限:
Mobile:/dev # ls -l tty*
crw-rw-rw- 1 root root 5, 0 1970-01-02 10:07 tty
crw------- 1 root root 235, 0 1970-01-02 10:07 ttyEUD0
crw-rw---- 1 bluetooth net_bt 511, 0 1970-01-02 10:07 ttyHS0
crw-rw-rw- 1 system system 511, 1 1970-01-02 10:07 ttyHS1
crw------- 1 root root 234, 0 1970-01-02 10:07 ttyMSM0
1.ps - Z可以查看当前进程(主体)安全上下文。
ls - Z可以查看当前文件(客体)安全上下文。