【背景】:
在调试的过程中需要修改selinux权限,并快速验证修改是否有效或者修改后可以构建成功,以及常见问题处理
【快速调试验证】:
可以通过以下命令快速构建确认修改的selinux是否能够构建通过,以及验证:
$make selinux_policy //构建selinux规则
验证:
adb push out\target\product\sc138\system\etc\selinux /system/etc/
adb push out\target\product\sc138\vendor\etc\selinux /vendor/etc/
有的规则push无效,需要整编版本验证。
【常见错误】:
错误1:“neverallow check failed at out/soong/.intermediates/system/sepolicy/userdebug_plat_sepolicy.cil/android_common/userdebug_plat_sepolicy.cil:22906 from system/sepolicy/private/property.te:47”
FAILED: out/soong/.intermediates/system/sepolicy/userdebug_plat_sepolicy.cil/android_common/userdebug_plat_sepolicy.cil
out/soong/host/linux-x86/bin/checkpolicy -C -M -c 30 -o out/soong/.intermediates/system/sepolicy/userdebug_plat_sepolicy.cil/android_common/userdebug_plat_sepolicy.cil out/soong/.intermediates/system/sepolicy/userdebug_plat_sepolicy.conf/android_common/conf && cat system/sepolicy/private/technical_debt.cil >> out/soong/.intermediates/system/sepolicy/userdebug_plat_sepolicy.cil/android_common/userdebug_plat_sepolicy.cil && out/soong/host/linux-x86/bin/secilc -m -M true -G -c 30 out/soong/.intermediates/system/sepolicy/userdebug_plat_sepolicy.cil/android_common/userdebug_plat_sepolicy.cil -o /dev/null -f /dev/null # hash of input list: d6ecc2c4e157ea76b3d37465aa507252a4901a59eb2d9f9a33d3c2a8d1c7f7be
neverallow check failed at out/soong/.intermediates/system/sepolicy/userdebug_plat_sepolicy.cil/android_common/userdebug_plat_sepolicy.cil:22906 from system/sepolicy/private/property.te:47
(neverallow base_typeattr_223 base_typeattr_751 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
<root>
allow at out/soong/.intermediates/system/sepolicy/userdebug_plat_sepolicy.cil/android_common/userdebug_plat_sepolicy.cil:26253
(allow vendor_init init_service_status_private_prop (file (read)))
Failed to generate binary
可以看到system/sepolicy/private/property.te文件47行的权限和自己新增的权限冲突,所以需要根据冲突原因修改对应的te文件限制。
-neverallow { domain -coredomain } {
+neverallow { domain -coredomain -vendor_init } {