开机logcat启动
2018-4-9
如何让系统开机后就自动抓取log呢
在rc中启动logcat
service get_log /system/bin/logcat -f/data/local/tmp/log.txt
class main
oneshot
尝试在系统启动的时候,由init进程fork出logcat进程,通过logcat -f /data/local/tmp/log.txt
命令把logd中的log写到文件/data/local/tmp/log.txt中。
但是程序启动后就退出了
init:service get_log does not have a SELinux domain defined
我们需要给logcat进程一个domain
查看logcat文件的属性
$ ls -Z /system/bin/logcat
u:object_r:logcat_exec:s0 /system/bin/logcat
我们尝试赋予其shell域,shell domain的权限可以在shell.te文件中查看到
在te文件中添加
domain_auto_trans(init,logcat_exec, shell)
但是执行后还是报错,权限不足
<36>[ 15.362700] .(3)[413:logd.auditd]type=1400 audit(1514808356.420:97): avc:denied { dac_override } for pid=627 comm="logcat" capability=1scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=capability permissive=0
<36>[ 15.374908] .(3)[413:logd.auditd]type=1400 audit(1514808356.420:98): avc:denied { dac_read_search } for pid=627 comm="logcat" capability=2scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=capability permissive=0
<36>[ 15.394592] .(3)[413:logd.auditd]type=1400 audit(1514808356.420:99): avc:denied { sys_nice } for pid=627 comm="logcat" capability=23scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=capability permissive=0
针对这些报错添加对应的allow赋权
allow shell shell: capability { dac_read_search dac_override sys_nice };
结果编译出错
neverallow check failed at out/target/product/TPhone/obj/ETC/plat_sepolicy.cil_intermediates/plat_sepolicy.cil:8523from system/sepolicy/private/app.te:342
(neverallowbase_typeattr_156self (capability (chown dac_override dac_read_search fowner fsetid kill setgidsetuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_rawipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacctsys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod leaseaudit_write audit_control setfcap)))
<root>
allow atout/target/product/ TPhone/obj/ETC/plat_sepolicy.cil_intermediates/plat_sepolicy.cil:12770
(allow shell shell (capability (dac_overridedac_read_search sys_nice)))
Failed to generate binary
和neverallow冲突,在源码中搜不到base_typeattr_156
看起来是基本的属性shell等不允许这样赋权
那我们就给logcat进程新建一个domain logcat_d
进行
domain_auto_trans(init,logcat_exec, logcat_d)
# /proc/pid/
allow logcat_d self:capability { fowner chowndac_override fsetid sys_nice sys_resource net_admin sys_module};
# files
allow logcat_d sdcard_type:dir create_dir_perms;
allow logcat_d sdcard_type:file create_file_perms;
#data/anr
allow logcat_d anr_data_file:dir create_dir_perms;
allow logcat_d anr_data_file:filecreate_file_perms;
#data/local/tmp
allow logcat_d shell_data_file:dircreate_dir_perms;
allow logcat_d shell_data_file:filecreate_file_perms;
allow logcat_d proc:file rw_file_perms;
allow logcat_d logdr_socket:sock_file write;
allow logcat_d logd:unix_stream_socket connectto;
开机后就可以启动logcat写log到文件了