Android Selinux详解[四]--新增服务标签相关

在工作过程中，SElinux常用的有以下几个文件可用于新增标签

可用于加标签的文件名	含义	对应的声明文件名(一般会声明的地方，根本上放哪里都可以)
file_contexts	给 文件/目录/节点 新增标签	file.te
genfs_contexts	给节点新增标签，与上一个不同的是，不用执行restorecon操作	file.te
hwservice_contexts	给hal服务新增标签	hwservice.te
property_contexts	给属性新增标签	property.te
seapp_contexts	给APP新增标签	untrusted_app.te app.te...等等
service_contexts	给系统服务新增标签	service.te

service有以下几种声明，相应解释如下

service type声明类型	解释
system_server_service	All service_manager types created by system_server
app_api_service	services which should be available to all but isolated apps
ephemeral_app_api_service	services which should be available to all ephemeral apps
system_api_service	services which export only system_api
protected_service	services which are explicitly disallowed for untrusted apps to access
vendor_service	services which served by vendor and also using the copy of libbinder on system (for instance via libbinder_ndk). services using a different copy of libbinder currently need their own context manager (e.g. vndservicemanager)
service_manager_type	由于系统服务最后都是添加到service manager中管理的，所以系统服务的type声明都会有携带此type。

Android源码中有很多服务相关的标签声明，比如如下：

http://aospxref.com/android-12.0.0_r3/xref/system/sepolicy/public/service.te

可以看到，有如下几种标签声明

service manage直接add的service
type audioserver_service,       service_manager_type;

system server创建的service，如果是新增的java层系统服务，并且由system server拉起，则基本都是如下声明
type battery_service, system_server_service, service_manager_type;

带有system_api_service的说明只有system api的服务
type adb_service, system_api_service, system_server_service, service_manager_type;

带有app_api_service的声明说明除了isolated apps外，其他APP都可以访问的
type alarm_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;

hal服务声明
type hal_audio_service, vendor_service, protected_service, service_manager_type;
type hal_audiocontrol_service, vendor_service, service_manager_type;

在sepolicy/public/service.te这里还有一个neverallow，此neverallow意思为不允许domain与对非service_manager_type vndservice_manager_type类型的service进行add find权限。

# servicemanager handles registering or looking up named services.
# It does not make sense to register or lookup something which is not a service.
# Trigger a compile error if this occurs.
neverallow domain ~{ service_manager_type vndservice_manager_type }:service_manager { add find };

服务的type声明是和你的功能强相关的，你可以根据你的功能去进行相应的type声明。

假如你新增了一个系统java service，那么一般声明如下，也就是说必须携带system_server_service和service_manager_type，其他的看情况

type xxx_service, system_server_service, service_manager_type;

type xxx_service, system_api_service, system_server_service, service_manager_type;

type xxx_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;

假设你新增了一个native层service，那么一般的声明如下，也就是说必须携带service_manager_type，并且不能携带system_server_service：

type yyy_service, service_manager_type;

type yyy_service, app_api_service, service_manager_type;

type yyy_service, app_api_service, system_api_service, service_manager_type;

所以经过上述解释，是否对服务该怎样进行type有一定的了解了呢。

假设你新增了一个hal层service，那么一般的声明如下，也就是说必须携带vendor_service和service_manager_type：

type zzz_service, vendor_service, service_manager_type;