selinux配置

https://github.com/phhusson/sepolicy-inject

A. 版本有remount权限，可直接添加到版本
B. sepolicy-inject push到手机的/data/local/tmp,sepolicy-inject 给工具赋权限 777

Line 9123: [ 3043.848311] (1)[731:logd.auditd][20220708_10:02:03.695154]@1 type=1400 audit(1657245723.689:5572): avc: denied { read } for comm="HwBinder:20018_" name="videodump" dev="dm-45" ino=471 scontext=u:r:mediacodec:s0 tcontext=u:object_r:vendor_data_file:s0 tclass=dir permissive=1



adb shell ./data/local/tmp/sepolicy-inject -s mediacodec -t vendor_data_file -c dir -p search -l 
adb shell ./data/local/tmp/sepolicy-inject -s mediacodec -t vendor_data_file -c dir -p getattr -l 

adb shell cat /data/seinfo.txt


mediacodec.te
allow mediacodec vendor_data_file:file { setattr getattr rw_file_perms open create unlink};
allow mediacodec vendor_data_file:dir { search getattr write read add_name create open remove_name rmdir};

b:
1.编译:
在system/sepolicy/vendor 目录修改后直接在工程根目录编译

./prebuilts/build-tools/linux-x86/bin/ninja -f ./out/combined-pineapple.ninja selinux_policy

2.生成物

out\target\product\pineapple\vendor\etc\selinux\vendor_sepolicy.cil

3.替换(可能无效, 需要整编构建)

adb push "\\172.16.215.102\share\work\8650\out\target\product\pineapple\vendor\etc\selinux\vendor_sepolicy.cil" /vendor/etc/selinux

修改scontext

adb shell chcon -v u:object_r:vendor_videofilter_data_file:s0 /data/vendor/videofilter
adb root && adb shell ls /data/ -Z
u:object_r:vendor_data_file:s0                    vendor
u:object_r:vendor_videofilter_data_file:s0           videofilter