Android 9.0 (P版本) SystemServer中的服務配置se linux許可權
阿新 • • 發佈：2018-12-11
## １． SystemServer 的服務定義 Android P_9.0\frameworks\base\services\java\com\android\server\SystemServer.java
/** * Starts a miscellaneous grab bag of stuff that has yet to be refactored * and organized. */ private void startOtherServices() { try { fadiWakeupWatcherService fadiWakeupWatcherService = new fadiWakeupWatcherService(); ServiceManager.addService("fadi_wakeupwatcher", fadiWakeupWatcherService.asBinder()); } catch (Throwable e) { Slog.e(TAG, "Failure starting fadiWakeupWatcherService", e); }
## 2． 沒有配置Se-Linux許可權的報錯日誌
01-01 00:05:05.381284 933 933 E SystemServer: Failure starting fadiAppLockService 01-01 00:05:05.381284 933 933 E SystemServer: java.lang.SecurityException 01-01 00:05:05.381284 933 933 E SystemServer: at android.os.BinderProxy.transactNative(Native Method) 01-01 00:05:05.381284 933 933 E SystemServer: at android.os.BinderProxy.transact(Binder.java:1127) 01-01 00:05:05.381284 933 933 E SystemServer: at android.os.ServiceManagerProxy.addService(ServiceManagerNative.java:153) 01-01 00:05:05.381284 933 933 E SystemServer: at android.os.ServiceManager.addService(ServiceManager.java:184) 01-01 00:05:05.381284 933 933 E SystemServer: at android.os.ServiceManager.addService(ServiceManager.java:155) 01-01 00:05:05.381284 933 933 E SystemServer: at com.android.server.SystemServer.startOtherServices(SystemServer.java:2000) 01-01 00:05:05.381284 933 933 E SystemServer: at com.android.server.SystemServer.run(SystemServer.java:456) 01-01 00:05:05.381284 933 933 E SystemServer: at com.android.server.SystemServer.main(SystemServer.java:311) 01-01 00:05:05.381284 933 933 E SystemServer: at java.lang.reflect.Method.invoke(Native Method) 01-01 00:05:05.381284 933 933 E SystemServer: at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:493) 01-01 00:05:05.381284 933 933 E SystemServer: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:891) 01-01 00:05:05.383128 933 933 E SystemServer: Failure starting fadiWakeupWatcherService 01-01 00:05:05.383128 933 933 E SystemServer: java.lang.SecurityException 01-01 00:05:05.383128 933 933 E SystemServer: at android.os.BinderProxy.transactNative(Native Method) 01-01 00:05:05.383128 933 933 E SystemServer: at android.os.BinderProxy.transact(Binder.java:1127) 01-01 00:05:05.383128 933 933 E SystemServer: at android.os.ServiceManagerProxy.addService(ServiceManagerNative.java:153) 01-01 00:05:05.383128 933 933 E SystemServer: at android.os.ServiceManager.addService(ServiceManager.java:184) 01-01 00:05:05.383128 933 933 E SystemServer: at android.os.ServiceManager.addService(ServiceManager.java:155) 01-01 00:05:05.383128 933 933 E SystemServer: at com.android.server.SystemServer.startOtherServices(SystemServer.java:2008) 01-01 00:05:05.383128 933 933 E SystemServer: at com.android.server.SystemServer.run(SystemServer.java:456) 01-01 00:05:05.383128 933 933 E SystemServer: at com.android.server.SystemServer.main(SystemServer.java:311) 01-01 00:05:05.383128 933 933 E SystemServer: at java.lang.reflect.Method.invoke(Native Method) 01-01 00:05:05.383128 933 933 E SystemServer: at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:493) 01-01 00:05:05.383128 933 933 E SystemServer: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:891)
隨著Android系統對安全的要求越來越高，不斷加強SE-LINUX的管理，有些服務我們需要進行定製配置才能正常使用
上述是表徵服務服務啟動，我們需要根據原始碼配置進行，關鍵字檢索，查詢"fadi_applock"和"fadi_wakeupwatcher"關鍵字
查詢"fadi_applock"和"fadi_wakeupwatcher"關鍵字 01-01 00:05:05.382320 324 324 E SELinux : avc: denied { add } for service=fadi_wakeupwatcher pid=933 uid=1000 scontext=u:r:system_server:s0 tcontext=u:object_r:default_android_service:s0 tclass=service_manager permissive=0
上述日誌有一個配置公式，這裡舉個demo,但是我們目前還沒對該服務進行SE-LINUX定義，故配置公式暫時不需要，故這裡介紹9.0的配置方法
01-01 00:05:05.382320 324 324 E SELinux : avc: denied { add } for service=fadi_wakeupwatcher pid=933 uid=1000 scontext=u:r:system_server:s0 tcontext=u:object_r:default_android_service:s0 tclass=service_manager permissive=0
allow system_server fadi_wakeupwatcher :service_manager { add };
01-01 00:05:05.380074 324 324 E SELinux : avc: denied { add } for service=fadi_applock pid=933 uid=1000 scontext=u:r:system_server:s0 tcontext=u:object_r:default_android_service:s0 tclass=service_manager permissive=0
01-01 00:05:05.380221 324 324 E ServiceManager: add_service('fadi_applock',8f) uid=1000 - PERMISSION DENIED
allow system_server fadi_applock :service_manager { add };
4.demo
01-03 10:31:35.585148 331 331 E SELinux : avc: denied { find } for service=xxx_applock pid=5499 uid=10087 scontext=u:r:untrusted_app_25:s0:c512,c768 tcontext=u:object_r:xxx_applock_service:s0 tclass=service_manager permissive=1
allow untrusted_app_25 xxx_applock_service:service_manager { find };
## 3． Andorid 9.0 配置SE LINUX許可權
3.1 定義SE-Linux
分別在下面2個檔案進行配置
- Android P_9.0\system\sepolicy\public\service.te
# fadi SE-Linux
type fadi_wakeupwatcher_service, system_api_service, system_server_service, service_manager_type;
type fadi_applock_service, system_api_service, system_server_service, service_manager_type;
type fadi_longshot_service, system_api_service, system_server_service, service_manager_type;
- Android P_9.0\system\sepolicy\private\service_contexts
# fadi SE-Linux
fadi_wakeupwatcher u:object_r:fadi_wakeupwatcher_service:s0
fadi_applock u:object_r:fadi_applock_service:s0
fadi_longshot u:object_r:fadi_longshot_service:s0
然後編譯一下
3.2 編譯報錯1 解決
FAILED: out/target/product/fadi6761_l05/obj/ETC/sepolicy_freeze_test_intermediates/sepolicy_freeze_test
/bin/bash -c "(diff -rq system/sepolicy/prebuilts/api/28.0/public system/sepolicy/public ) && (diff -rq system/sepolicy/prebuilts/api/28.0/private system/sepolicy/private ) && (touch out/target/product/fadi6761_l05/obj/ETC/sepolicy_freeze_test_intermediates/sepolicy_freeze_test )"
檔案 system/sepolicy/prebuilts/api/28.0/public/service.te 和 system/sepolicy/public/service.te 不同
將system/sepolicy/prebuilts/api/28.0/public 和system/sepolicy/public對應的檔案內容保持一致即可
繼續make -j24 2>&1 |tee build.log編譯
3.3 編譯報錯2 解決
根據報錯提示，進行檔案新增與補充
[ 43% 179/410] build out/target/product/fadi6761_l05/obj/ETC/treble_sepolicy_tests_26.0_intermediates/treble_sepolicy_tests_26.0
FAILED: out/target/product/fadi6761_l05/obj/ETC/treble_sepolicy_tests_26.0_intermediates/treble_sepolicy_tests_26.0
[ 43% 180/410] build out/target/product/fadi6761_l05/obj/ETC/treble_sepolicy_tests_27.0_intermediates/treble_sepolicy_tests_27.0
FAILED: out/target/product/fadi6761_l05/obj/ETC/treble_sepolicy_tests_27.0_intermediates/treble_sepolicy_tests_27.0
新增對應的許可權定義 Android P_9.0\system\sepolicy\private\compat\26.0\26.0.cil
(typeattributeset fadi_wakeupwatcher_service_26_0 (fadi_wakeupwatcher_service))
(typeattributeset fadi_applock_service_26_0 (fadi_applock_service))
(typeattributeset fadi_longshot_service_26_0 (fadi_longshot_service))
Android P\Android P_9.0\system\sepolicy\private\compat\27.0\27.0.cil
(typeattributeset fadi_wakeupwatcher_service_27_0 (fadi_wakeupwatcher_service))
(typeattributeset fadi_applock_service_27_0 (fadi_applock_service))
(typeattributeset fadi_longshot_service_27_0 (fadi_longshot_service))
繼續make -j24 2>&1 |tee build.log編譯
3.4 編譯報錯3 解決
報錯日誌
FAILED: out/target/product/fadi6761_l05/obj/ETC/treble_sepolicy_tests_26.0_intermediates/26.0_compat
/bin/bash -c "out/host/linux-x86/bin/secilc -m -M true -G -N -c 30 out/target/product/fadi6761_l05/obj/ETC/plat_sepolicy.cil_intermediates/plat_sepolicy.cil system/sepolicy/private/compat/26.0/26.0.cil
system/sepolicy/prebuilts/api/26.0/nonplat_sepolicy.cil
-o out/target/product/fadi6761_l05/obj/ETC/treble_sepolicy_tests_26.0_intermediates/26.0_compat -f /dev/null"
Failed to resolve typeattributeset statement at system/sepolicy/private/compat/26.0/26.0.cil:764
Failed to compile cildb: -2
[ 1% 11/693] build out/target/product/fadi6761_l05/obj/ETC/treble_sepolicy_tests_27.0_intermediates/27.0_compat
FAILED: out/target/product/fadi6761_l05/obj/ETC/treble_sepolicy_tests_27.0_intermediates/27.0_compat
/bin/bash -c "out/host/linux-x86/bin/secilc -m -M true -G -N -c 30 out/target/product/fadi6761_l05/obj/ETC/plat_sepolicy.cil_intermediates/plat_sepolicy.cil system/sepolicy/private/compat/27.0/27.0.cil system/sepolicy/prebuilts/api/27.0/nonplat_sepolicy.cil -o out/target/product/fadi6761_l05/obj/ETC/treble_sepolicy_tests_27.0_intermediates/27.0_compat -f /dev/null"
Failed to resolve typeattributeset statement at system/sepolicy/private/compat/27.0/27.0.cil:1486
Failed to compile cildb: -2
[ 1% 12/693] build tinysys-scp-configheader
解決方法 解決方法：將nonplat_sepolicy.cil配置完畢
- \Android P_9.0\system\sepolicy\prebuilts\api\26.0\nonplat_sepolicy.cil
(typeattribute fadi_wakeupwatcher_service_26_0)
(roletype object_r fadi_wakeupwatcher_service_26_0)
(typeattribute fadi_applock_service_26_0)
(roletype object_r fadi_applock_service_26_0)
(typeattribute fadi_longshot_service_26_0)
(roletype object_r fadi_longshot_service_26_0)
- Android P_9.0\system\sepolicy\prebuilts\api\27.0\nonplat_sepolicy.cil
(typeattribute fadi_wakeupwatcher_service_27_0)
(roletype object_r fadi_wakeupwatcher_service_27_0)
(typeattribute fadi_applock_service_27_0)
(roletype object_r fadi_applock_service_27_0)
(typeattribute fadi_longshot_service_27_0)
(roletype object_r fadi_longshot_service_27_0)
繼續make -j24 2>&1 |tee build.log編譯
3.5 編譯OK，刷機驗證日誌
服務中日誌正常列印了
09-21 04:17:00.560: D/fadiDisplayHelp(2157): UI show packageName = com.google.android.packageinstaller, className = com.android.packageinstaller.permission.ui.GrantPermissionsActivity
09-21 04:17:59.365: D/fadiDisplayHelp(2157): UI show packageName = com.android.launcher3, className = com.android.launcher3.Launcher
09-21 04:16:08.027: D/fadiKillAppManager(2157): updateRestrictList new = WakeUpInfo [packageName=com.android.bankabc, bootReceviers=com.feinno.teatalk.receiver.FastBootReceiver;com.xiaomi.push.service.receivers.NetworkStatusReceiver;com.feinno.teatalk.receiver.NetWorkChangeReceiver;com.huawei.android.pushagent.PushBootReceiver;com.feinno.teatalk.receiver.PushReceiver;com.huawei.android.pushagent.PushEventReceiver;com.feinno.teatalk.receiver.MiPushReceiver;com.xiaomi.push.service.receivers.PingReceiver;, pushServices=com.baidu.location.f;com.xiaomi.push.service.XMPushService;com.xiaomi.mipush.sdk.PushMessageHandler;com.xiaomi.mipush.sdk.MessageHandleService;, deny=0]
4. 本次SE-Linux的配置清單
[email protected]:~/9.1/system/sepolicy$ git status
# Not currently on any branch.
# Changes not staged for commit:
# (use "git add <file>..." to update what will be committed)
# (use "git checkout -- <file>..." to discard changes in working directory)
#
# modified: prebuilts/api/26.0/nonplat_sepolicy.cil
# modified: prebuilts/api/27.0/nonplat_sepolicy.cil
# modified: prebuilts/api/28.0/private/compat/26.0/26.0.cil
# modified: prebuilts/api/28.0/private/compat/27.0/27.0.cil
# modified: prebuilts/api/28.0/private/service_contexts
# modified: prebuilts/api/28.0/public/service.te
# modified: private/compat/26.0/26.0.cil
# modified: private/compat/27.0/27.0.cil
# modified: private/service_contexts
# modified: public/service.te
具體新增如下如下
- prebuilts/api/26.0/nonplat_sepolicy.cil
(typeattribute fadi_wakeupwatcher_service_26_0)
(roletype object_r fadi_wakeupwatcher_service_26_0)
(typeattribute fadi_applock_service_26_0)
(roletype object_r fadi_applock_service_26_0)
(typeattribute fadi_longshot_service_26_0)
(roletype object_r fadi_longshot_service_26_0)
- prebuilts/api/27.0/nonplat_sepolicy.cil
(typeattribute fadi_wakeupwatcher_service_27_0)
(roletype object_r fadi_wakeupwatcher_service_27_0)
(typeattribute fadi_applock_service_27_0)
(roletype object_r fadi_applock_service_27_0)
(typeattribute fadi_longshot_service_27_0)
(roletype object_r fadi_longshot_service_27_0)
- prebuilts/api/28.0/private/compat/26.0/26.0.cil
(typeattributeset fadi_wakeupwatcher_service_26_0 (fadi_wakeupwatcher_service))
(typeattributeset fadi_applock_service_26_0 (fadi_applock_service))
(typeattributeset fadi_longshot_service_26_0 (fadi_longshot_service))
- prebuilts/api/28.0/private/compat/27.0/27.0.cil
(typeattributeset fadi_wakeupwatcher_service_27_0 (fadi_wakeupwatcher_service))
(typeattributeset fadi_applock_service_27_0 (fadi_applock_service))
(typeattributeset fadi_longshot_service_27_0 (fadi_longshot_service))
- prebuilts/api/28.0/private/service_contexts
# fadi SE-Linux
fadi_wakeupwatcher u:object_r:fadi_wakeupwatcher_service:s0
fadi_applock u:object_r:fadi_applock_service:s0
fadi_longshot u:object_r:fadi_longshot_service:s0
- prebuilts/api/28.0/public/service.te
# fadi SE-Linux
type fadi_wakeupwatcher_service, system_api_service, system_server_service, service_manager_type;
type fadi_applock_service, system_api_service, system_server_service, service_manager_type;
type fadi_longshot_service, system_api_service, system_server_service, service_manager_type;
- private/compat/26.0/26.0.cil
(typeattributeset fadi_wakeupwatcher_service_26_0 (fadi_wakeupwatcher_service))
(typeattributeset fadi_applock_service_26_0 (fadi_applock_service))
(typeattributeset fadi_longshot_service_26_0 (fadi_longshot_service))
- private/compat/27.0/27.0.cil
(typeattributeset fadi_wakeupwatcher_service_27_0 (fadi_wakeupwatcher_service))
(typeattributeset fadi_applock_service_27_0 (fadi_applock_service))
(typeattributeset fadi_longshot_service_27_0 (fadi_longshot_service))
- private/service_contexts（核心）
# fadi SE-Linux
fadi_wakeupwatcher u:object_r:fadi_wakeupwatcher_service:s0
fadi_applock u:object_r:fadi_applock_service:s0
fadi_longshot u:object_r:fadi_longshot_service:s0
- public/service.te（核心）
# fadi SE-Linux
type fadi_wakeupwatcher_service, system_api_service, system_server_service, service_manager_type;
type fadi_applock_service, system_api_service, system_server_service, service_manager_type;
type fadi_longshot_service, system_api_service, system_server_service, service_manager_type;