Android selinux策略文件的编译与加载

int SetupSelinux(char** argv) { ··· // Set up SELinux, loading the SELinux policy. SelinuxSetupKernelLogging(); SelinuxInitialize(); ··· return 1; } 

void SelinuxInitialize() { ··· LOG(INFO) << "Loading SELinux policy"; if (!LoadPolicy()) { LOG(FATAL) << "Unable to load SELinux policy"; } ··· } 

bool LoadPolicy() { return IsSplitPolicyDevice() ? LoadSplitPolicy() : LoadMonolithicPolicy(); } constexpr const char plat_policy_cil_file[] = "/system/etc/selinux/plat_sepolicy.cil"; bool IsSplitPolicyDevice() { return access(plat_policy_cil_file, R_OK) != -1; } bool LoadMonolithicPolicy() { LOG(VERBOSE) << "Loading SELinux policy from monolithic file"; if (selinux_android_load_policy() <0) { PLOG(ERROR) << "Failed to load monolithic SELinux policy"; return false; } return true; } 

static const char *const sepolicy_file = "/sepolicy"; int selinux_android_load_policy() { int fd = -1; fd = open(sepolicy_file, O_RDONLY | O_NOFOLLOW | O_CLOEXEC); if (fd <0) { selinux_log(SELINUX_ERROR, "SELinux:  Could not open %s:  %s\n", sepolicy_file, strerror(errno)); return -1; } int ret = selinux_android_load_policy_from_fd(fd, sepolicy_file); close(fd); return ret; } 

bool LoadSplitPolicy() { // IMPLEMENTATION NOTE: Split policy consists of three CIL files: // * platform -- policy needed due to logic contained in the system image, // * non-platform -- policy needed due to logic contained in the vendor image, // * mapping -- mapping policy which helps preserve forward-compatibility of non-platform policy //   with newer versions of platform policy. // // secilc is invoked to compile the above three policy files into a single monolithic policy // file. This file is then loaded into the kernel. // See if we need to load userdebug_plat_sepolicy.cil instead of plat_sepolicy.cil. const char* force_debuggable_env = getenv("INIT_FORCE_DEBUGGABLE"); // 可使用adb shell命令 echo $INIT_FORCE_DEBUGGABLE 查看此环境变量的值 // 此变量为空，所以 use_userdebug_policy == false bool use_userdebug_policy = ((force_debuggable_env && "true"s == force_debuggable_env) && AvbHandle::IsDeviceUnlocked() && access(kDebugRamdiskSEPolicy, F_OK) == 0); if (use_userdebug_policy) { LOG(WARNING) << "Using userdebug system sepolicy"; } // Load precompiled policy from vendor image, if a matching policy is found there. The policy // must match the platform policy on the system image. std::string precompiled_sepolicy_file; // use_userdebug_policy requires compiling sepolicy with userdebug_plat_sepolicy.cil. // Thus it cannot use the precompiled policy from vendor image. // 核心代码 !use_userdebug_policy == true ，进入 FindPrecompiledSplitPolicy 函数 if (!use_userdebug_policy && FindPrecompiledSplitPolicy(&precompiled_sepolicy_file)) { unique_fd fd(open(precompiled_sepolicy_file.c_str(), O_RDONLY | O_CLOEXEC | O_BINARY)); if (fd != -1) { if (selinux_android_load_policy_from_fd(fd, precompiled_sepolicy_file.c_str()) <0) { LOG(ERROR) << "Failed to load SELinux policy from " << precompiled_sepolicy_file; return false; } return true; } } // No suitable precompiled policy could be loaded LOG(INFO) << "Compiling SELinux policy"; // We store the output of the compilation on /dev because this is the most convenient tmpfs // storage mount available this early in the boot sequence. char compiled_sepolicy[] = "/dev/sepolicy.XXXXXX"; unique_fd compiled_sepolicy_fd(mkostemp(compiled_sepolicy, O_CLOEXEC));//创建临时文件 if (compiled_sepolicy_fd <0) { PLOG(ERROR) << "Failed to create temporary file " << compiled_sepolicy; return false; } ··· unlink(compiled_sepolicy);// 临时文件如果不再被使用后，文件会被自动删除 LOG(INFO) << "Loading compiled SELinux policy"; // 编译完成，加载新的selinux文件 if (selinux_android_load_policy_from_fd(compiled_sepolicy_fd, compiled_sepolicy) <0) { LOG(ERROR) << "Failed to load SELinux policy from " << compiled_sepolicy; return false; } return true; } 

bool FindPrecompiledSplitPolicy(std::string* file) { file->clear(); // If there is an odm partition, precompiled_sepolicy will be in // odm/etc/selinux. Otherwise it will be in vendor/etc/selinux. static constexpr const char vendor_precompiled_sepolicy[] = "/vendor/etc/selinux/precompiled_sepolicy"; static constexpr const char odm_precompiled_sepolicy[] = "/odm/etc/selinux/precompiled_sepolicy"; if (access(odm_precompiled_sepolicy, R_OK) == 0) { *file = odm_precompiled_sepolicy; } else if (access(vendor_precompiled_sepolicy, R_OK) == 0) { *file = vendor_precompiled_sepolicy; } else { PLOG(INFO) << "No precompiled sepolicy"; return false; } std::string actual_plat_id; if (!ReadFirstLine("/system/etc/selinux/plat_sepolicy_and_mapping.sha256", &actual_plat_id)) { PLOG(INFO) << "Failed to read " "/system/etc/selinux/plat_sepolicy_and_mapping.sha256"; return false; } std::string actual_product_id; if (!ReadFirstLine("/product/etc/selinux/product_sepolicy_and_mapping.sha256", &actual_product_id)) { PLOG(INFO) << "Failed to read " "/product/etc/selinux/product_sepolicy_and_mapping.sha256"; return false; } std::string precompiled_plat_id; std::string precompiled_plat_sha256 = *file + ".plat_sepolicy_and_mapping.sha256"; if (!ReadFirstLine(precompiled_plat_sha256.c_str(), &precompiled_plat_id)) { PLOG(INFO) << "Failed to read " << precompiled_plat_sha256; file->clear(); return false; } std::string precompiled_product_id; std::string precompiled_product_sha256 = *file + ".product_sepolicy_and_mapping.sha256"; if (!ReadFirstLine(precompiled_product_sha256.c_str(), &precompiled_product_id)) { PLOG(INFO) << "Failed to read " << precompiled_product_sha256; file->clear(); return false; } // 核心代码 if (actual_plat_id.empty() || actual_plat_id != precompiled_plat_id || actual_product_id.empty() || actual_product_id != precompiled_product_id) { file->clear(); return false; } return true; } 

# restorecon 命令需要跟参数，无法执行单个命令 mobius:/ # restorecon system/bin/toybox -v SELinux:  Skipping /product/etc/selinux/product_file_contexts:  empty file SELinux: Loaded file_contexts SELinux:  Relabeling /system/bin/toybox from u:object_r:toolbox_exec:s0 to u:object_r:shell_exec:s0. 

mobius:/ # ls system/bin/toybox -lZ -rwxrwxrwx 1 root shell u:object_r:shell_exec:s0 432976 2009-01-01 08:00 system/bin/toybox 

# android chcon  <安全上下文> 文件 chcon -R  <安全上下文> 目录 # 示例 klein:/ # chcon -v u:object_r:junkserverd_d_file:s0  /data/junk-server/junk.txt chcon '/data/junk-server/junk.txt' to u:object_r:junkserverd_d_file:s0 # chcon -R -v u:object_r:system_data_file:s0 ./0 # linux: chcon -t <安全上下文> 文件 chcon -R -t <安全上下文> 目录