android security te总结

最新推荐文章于 2024-09-10 08:36:36 发布

afanty2015

最新推荐文章于 2024-09-10 08:36:36 发布

阅读量809

点赞数

分类专栏： linux android 文章标签： android

本文链接：https://blog.csdn.net/yong_xu/article/details/121156752

版权

android 同时被 2 个专栏收录

14 篇文章

订阅专栏

linux

3 篇文章

订阅专栏

关于android security te文件书写总结

te文件的基本书写规范，就不赘叙了，这里说的是另一种情况下的关于te配置的情况
案例如下:在tp驱动中实现文件读写操作具体操作/data 分区
在书写驱动后发现在anroid启动前对该分区的操作应该是无效的，因为此时kernel 还没执行到init.c 即system 分区等其他分区尚未建立
所以该读写操作只能在android 系统跑完开机动画后，可以响应 tp 触摸事件后。
通常会报如下错误:

[ 37.573986] <0>.(0)[214:logd.auditd]type=1400 audit(1262304237.850:29): avc: denied { write } for pid=167 comm=“mtk-tpd” name="/" dev=“dm-0” ino=2 scontext=u:r:kernel:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=1
检查的知当前kernel.te文件并未有权限操作/data 目录，所以加上
allow kernel system_data_file:dir { open write read create add_name remove_name setattr };
allow kernel system_data_file:file { open write read create };

编译后发现报错:allow kernel system_data_file:file { open write read create }; 此项一直不过不允许有write create
out 目录下的obj/ETC/sepolicy_intermediates/policy.conf文件显示
neverallow {
domain
-system_server
-system_app
-init
-installd # for relabelfrom and unlink, check for this in explicit neverallow
} system_data_file:file { append create link unlink relabelfrom rename setattr write };

do not grant anything greater than r_file_perms and relabelfrom unlink

to installd

neverallow installd system_data_file:file ~{ { getattr open read ioctl lock } relabelfrom unlink };
但很明显如果不加上write create ，运行后还是会有权限问题。所以此处必须还有其他技巧未能掌握，查看其他使用了system_data_file:file 相关权限的te书写发现
file_type_auto_trans(surfaceflinger, system_data_file, sf_bqdump_data_file);
所以加上 file_type_auto_trans(surfaceflinger, system_data_file, sf_bqdump_data_file);
再次编译发现成功。
其实是想找出
neverallow {
domain
-system_server
-system_app
-init
-installd # for relabelfrom and unlink, check for this in explicit neverallow
} system_data_file:file { append create link unlink relabelfrom rename setattr write };

do not grant anything greater than r_file_perms and relabelfrom unlink

to installd

neverallow installd system_data_file:file ~{ { getattr open read ioctl lock } relabelfrom unlink };

是在哪里编译生成的，结果未能找到，希望下次能再深入了解linux sepolicy 。
最后附上代码以供参考

device/mediatek/common/sepolicy/kernel.te
file_type_auto_trans(kernel, system_data_file, nvdata_file);
allow kernel system_data_file:dir { open write read create add_name remove_name setattr };
allow kernel system_data_file:file { open read };

文件路径改为 /data/misc/

void demo_write_file(void)
{
    struct file *flp = NULL;
    u8 *refp = NULL;
    s32 ret = 0;
    refp = kzalloc(PAGE_SIZE, GFP_KERNEL);
    GTP_INFO("demo_write_file begin");
    if (refp == NULL) {
       GTP_INFO("[demo_write_file] Alloc memory for ref failed.use default ref");
       return;
    }
    flp = filp_open("/data/misc/iqs.txt", O_RDWR | O_CREAT, 0666);
    if (!IS_ERR(flp)){
       GTP_INFO("demo_write_file file success!");
       flp->f_op->llseek(flp, 0, SEEK_SET);
       //iqs_hex_array[238*64 + 32 + 2]
       memset(refp,0,64);
       ret = flp->f_op->read(flp, (char *)refp, 63, &flp->f_pos);
       //refp[63] = 0;
       GTP_INFO("demo_write_file read ret %d ",ret);
       if (ret > 0){
         GTP_INFO("demo_write_file read ret %s ",refp);
       }else {
         snprintf(refp, 64, "iqs Maj verison is:%d Min verison is:%d\r\n",iqs_hex_array[238*64 + 32 + 2],iqs_hex_array[238*64 + 32 + 3]);
         //file_len = sizeof(refp);
         GTP_INFO("demo_write_file refp sizeof is:%d strlen is:%d ",(u32)(sizeof(refp)),(u32)(strlen(refp)));
         flp->f_op->write(flp, (char *)refp, (u32)(strlen(refp)), &flp->f_pos);
         //flp->f_op->write(flp, (char *)refp, ref_len, &flp->f_pos);
       }
      filp_close(flp, NULL);
      kfree(refp);
    }
    GTP_INFO("demo_write_file end");
    return;
}