Android avc: denied 深入沟兑02（dac_read_search）

都是弯弯绕

已于 2024-09-09 13:05:16 修改

阅读量2.2k

点赞数 2

CC 4.0 BY-SA版权

分类专栏： selinux 文章标签： android

于 2021-04-09 19:37:40 首次发布

本文链接：https://blog.csdn.net/baidu_40808339/article/details/115557824

dac_read_search与规避neverallow

The dac_override denial issue means that the offending process is trying to access a file with the wrong user/group permissions.The correct solution almost never grants dac_override policy,

becasue if this process is not in "dac_override_allowed" white list which is defined in "system/sepolicy/private/domain.te", this will lead neverallow building issue. We can change the permissions

of the corresponding file or process. The solution is that we set the domain and file, keep them the same user/group permissions.

One example.

I subsystem_ramdump: Attemping to create /sdcard/ramdump

E subsystem_ramdump: Unable to create /sdcard/ramdump

E subsystem_ramdump: Failed to initialize ramdump

I auditd : type=1400 audit(0.0:154): avc: denied { dac_read_search } for comm="subsystem_ramdu" capability=2 scontext=u:r:subsystem_ramdump