将具有Android高音体系结构的供应商服务添加到ServiceManager [SELinux政策] [英] Add vendor service to ServiceManager with android treble architecture[SELinux policy]

问题描述

注意:我是SELinux政策的新手，并遵循 vndservicemanager(由Android制定)

Note: I am beginner in SELinux policy and followed vndservicemanager by Android

我有一个Java服务(MyService)，该服务在BootComplete接收器上启动.现在，我在MyService.java的onCreate中将myservice添加到ServiceManager.

I have a java service(MyService) that starts on the BootComplete receiver. Now i am adding myservice to ServiceManager in onCreate of MyService.java.

ServiceManager.addService(mysystemservice, mybinder);

根据高音架构，通过在应用程序的Android.mk中添加以下内容，将我的应用程序移至供应商图像分区.

As per treble architecture, I moved my application to vendor image partition by adding below in Android.mk of application.

LOCAL_VENDOR_MODULE := true

我对OEM SELinux政策进行了以下更改，早些时候它是为系统服务编写的，因为我将应用程序移至供应商，因此对供应商服务进行了更改，同时提供了旧的和当前的SE政策.

I made below changes in OEM SELinux policy, earlier it was written for system service now as i moved application to vendor so made changes for vendor service, providing both old and current SE policy.

创建的上下文"my_service"

Created Context "my_service"

OLD

在 private/service_contexts

mysystemservice u:object_r:my_service:s0

现在

在 vendor/common/vndservice_contexts

mysystemservice u:object_r:my_service:s0

定义的服务类型

OLD

在 public/service.te

type my_service，service_manager_type;

现在

在 vendor/common/vndservice.te

type my_service，vndservice_manager_type;

现在授予添加权限

Now giving add permission

OLD

在 public/servicemanager.te

允许system_app my_service:service_manager添加；

现在

在 abc.te

type abc, domain;
type abc_exec, exec_type, vendor_file_type, file_type;

init_daemon_domain(abc)

vndbinder_use(abc)

binder_call(abc, system_app)

add_service(abc, my_service)

allow abc  my_service:service_manager  find;
allow abc  my_service:service_manager  add; 

经过上述更改并进行了完整构建，我可以看到我的服务上下文是out/product/target/vendor/etc/selinux/vndservice_contexts..in的一部分，代替out/product/target/system.

After above changes and giving full build I can see my service context is part of out/product/target/vendor/etc/selinux/vndservice_contexts..inplace of out/product/target/system.

但是一旦Myservice.java尝试通过

But once Myservice.java try to add "mysystemservice" in ServiceManager by

ServiceManager.addService(mysystemservice，mybinder);

ServiceManager.addService(mysystemservice, mybinder);

我低于** avc被拒绝**错误

I get below **avc denied ** error

E/SELinux:avc:为service = mysystemservice pid = 7588 uid = 1000 scontext = u:r:system_app:s0 tcontext = u:object_r:default_android_service:s0 tclass = service_manager permissive = 0拒绝{添加}2019-11-14 12:44:39.613 592-592/?E/ServiceManager:add_service('mysystemservice'，b0)uid = 1000-权限被拒绝

我们在上面的日志中可以看到，目标上下文使用默认的" tcontext = u:object_r:default_android_service:s0 "代替" my_service "

As we can see in log above Target context is taking default "tcontext=u:object_r:default_android_service:s0" inplace of "my_service"

注意:如果我保留对系统映像的更改，则一切正常，唯一的问题是将SE策略更改移至供应商时.

Note: If i keep changes for system image everything works fine only issue is when i move SE policy changes to vendor.

请让我知道我是否错过了某件事或以其他任何方式添加服务.

Please let me know if i missed something or any other way is to add Service.

推荐答案

我可以看到的一个问题是您使用的是 abc.te ，但是您尚未在 seapp_context中定义它在 vendor/common/中.

One problem I can see is that you are using abc.te, but you have not defined this in your seapp_context inside vendor/common/.

您应该定义如下内容:

user=system
seinfo=platform
name=your.package.name
domain=adbc
type=system_app_data_file

此更改后， avc 错误将指向 abc 应用域.

After this change avc error will point to abc app domain.

这篇关于将具有Android高音体系结构的供应商服务添加到ServiceManager [SELinux政策]的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！