SeLinux权限增加，编译报错SELinux违反Neverallow 和 Differ问题，Logcat 和 Kernel log中avc: denied问题的解决

weixin_45494251

已于 2024-03-14 11:41:00 修改

阅读量2.2k

点赞数 8

CC 4.0 BY-SA版权

文章标签： android linux

于 2024-03-14 11:32:14 首次发布

本文链接：https://blog.csdn.net/weixin_45494251/article/details/136702862

博客围绕Android Qcom平台展开，介绍了权限修改方法，如根据avc: denied提示在相应.te文件添加权限公式。还提及项目增加权限时编译出现Neverallow和Differ问题的解决办法，以及优化开机时间、解决开机时avc: denied问题的权限修复方案。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

一，

avc: denied { read } for name=“present” dev=“sysfs” ino=42693 scontext=u:r:hal_health_default:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
denied {xxx}: 表示缺少什么权限
scontext:表示谁缺少权限
tcontext:表示对那些文件缺少权限：
tclass：表示什么文件类型缺少权限
修改公式如下：
通常需要在${scontext}.te添加 allow scontext tcontext:tclass denied
带入内容：修改hal_health_default.te
allow hal_health_default sysfs:fie { read };
allow hal_health_default sysfs:fie { open};

二，

本项目Qcom平台因项目需要增加权限：

在system_app.te增加权限：allow system_app vendor_file:file r_file_perms;

在device/qcom/sepolicy/...目录下增加权限：allow system_app adsprpcd_file:dir r_dir_perms;

编译sepolicy，出现Neverallow问题：

在system_app.te 增加：allow system_app vendor_file:file r_file_perms;

编译出现Neverallow问题，则要在domain.te文件中修改：

full_treble_only(`
# Do not allow system components access to /vendor files except for the
# ones whitelisted here.
neverallow {
coredomain
+ -appdomain
# TODO(b/37168747): clean up fwk access to /vendor
-crash_dump
-init # starts vendor executables
-kernel # loads /vendor/firmware
userdebug_or_eng(`-perfprofd')
userdebug_or_eng(`-heapprofd')
-shell
-system_executes_vendor_violators
-ueventd # reads /vendor/ueventd.rc
-cust_diag
-deviceinfod
} {
vendor_file_type
-same_process_hal_file
-vendor_app_file
-vendor_configs_file
-vendor_framework_file
-vendor_idc_file
-vendor_keychars_file
-vendor_keylayout_file
-vendor_overlay_file
-vendor_public_lib_file
-vendor_task_profiles_file
-vndk_sp_file
}:file *;
')

编译出现类似如下Differ问题：

build out/target/product/qcs605/obj/etc/sepolicy_freeze_test_intermediates/sepolicy_freeze_test
FAILED: out/target/product/qcs605/obj/etc/sepolicy_freeze_test_intermediates/sepolicy_freeze_test
/bin/bash -c "(diff -rq system/sepolicy/prebuilts/api/29.0/public system/sepolicy/public ) && (diff -rq system/sepolicy/prebuilts/api/29.0/private system/sepolicy/private ) && (touch out/target/product/qcs605/obj/etc/sepolicy_freeze_test_intermediates/sepolicy_freeze_test )"
Files system/sepolicy/prebuilts/api/29.0/public/app.te and system/sepolicy/public/app.te differ

意思是

system/sepolicy/prebuilts/api/29.0/private和system/sepolicy/private下面的文件
system/sepolicy/prebuilts/api/29.0/public和system/sepolicy/public下面的文件，必须保持一致

另外qcom平台还要注意，有些权限需要在device/qcom/sepolicy/... 目录下修改te文件

三，

本项目Qcom平台，优化开机时间加快，可疑解决开机时的avc: denied：

avc: denied { getattr } for comm="init" name="/" dev="mmcblk0p24" ino=1 scontext=u:r:init:s0 tcontext=u:object_r:firmware_file:s0 tclass=filesystem permissive=0
avc: denied { getattr } for comm="init" name="/" dev="mmcblk0p24" ino=1 scontext=u:r:init:s0 tcontext=u:object_r:firmware_file:s0 tclass=filesystem permissive=0
avc: denied { getattr } for comm="init" name="/" dev="mmcblk0p42" ino=1 scontext=u:r:init:s0 tcontext=u:object_r:bt_firmware_file:s0 tclass=filesystem permissive=0
avc: denied { getattr } for comm="init" name="/" dev="mmcblk0p42" ino=1 scontext=u:r:init:s0 tcontext=u:object_r:bt_firmware_file:s0 tclass=filesystem permissive=0
avc: denied { create } for comm="init" name="ipa" scontext=u:r:vendor_init:s0 tcontext=u:object_r:ipa_dev:s0 tclass=file permissive=0
avc: denied { create } for comm="init" name="ipa" scontext=u:r:vendor_init:s0 tcontext=u:object_r:ipa_dev:s0 tclass=file permissive=0
avc: denied { write } for comm="init" name="read_ahead_kb" dev="sysfs" ino=61946 scontext=u:r:init:s0 tcontext=u:object_r:sysfs_mmc_host:s0 tclass=file permissive=0
avc: denied { write } for comm="init" name="read_ahead_kb" dev="sysfs" ino=61946 scontext=u:r:init:s0 tcontext=u:object_r:sysfs_mmc_host:s0 tclass=file permissive=0
avc: denied { read } for comm="android.hardwar" name="u:object_r:sensors_prop:s0" dev="tmpfs" ino=19850 scontext=u:r:hal_sensors_default:s0 tcontext=u:object_r:sensors_prop:s0 tclass=file permissive=0 duplicate messages suppressed
avc: denied { read } for comm="system_server" name="hctosys" dev="sysfs" ino=49065 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=0
avc: denied { read } for comm="system_server" name="hctosys" dev="sysfs" ino=49065 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=0
avc: denied { read } for comm="system_server" name="u:object_r:vendor_default_prop:s0" dev="tmpfs" ino=19881 scontext=u:r:system_server:s0 tcontext=u:object_r:vendor_default_prop:s0 tclass=file permissive=0
avc: denied { read } for comm="system_server" name="u:object_r:vendor_default_prop:s0" dev="tmpfs" ino=19881 scontext=u:r:system_server:s0 tcontext=u:object_r:vendor_default_prop:s0 tclass=file permissive=0
avc: denied { read execute } for comm="webview_zygote" path="/system/bin/app_process64" dev="dm-0" ino=494 scontext=u:r:webview_zygote:s0 tcontext=u:object_r:zygote_exec:s0 tclass=file permissive=0
avc: denied { read execute } for comm="webview_zygote" path="/system/bin/app_process64" dev="dm-0" ino=494 scontext=u:r:webview_zygote:s0 tcontext=u:object_r:zygote_exec:s0 tclass=file permissive=0
avc: denied { read } for comm="ndroid.systemui" name="u:object_r:vendor_display_notch_prop:s0" dev="tmpfs" ino=19882 scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:vendor_display_notch_prop:s0 tclass=file permissive=0 app=com.android.systemui
avc: denied { read } for comm="ndroid.systemui" name="u:object_r:vendor_display_notch_prop:s0" dev="tmpfs" ino=19882 scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:vendor_display_notch_prop:s0 tclass=file permissive=0 app=com.android.systemui duplicate messages suppressed
avc: denied { read } for comm="sensors@2.0-ser" name="u:object_r:sensors_prop:s0" dev="tmpfs" ino=19850 scontext=u:r:hal_sensors_default:s0 tcontext=u:object_r:sensors_prop:s0 tclass=file permissive=0
avc: denied { search } for comm="perf@2.1-servic" name="proc" dev="sysfs" ino=43800 scontext=u:r:hal_perf_default:s0 tcontext=u:object_r:sysfs_kgsl_proc:s0 tclass=dir permissive=0
avc: denied { read } for comm="WLCServiceHandl" name="u:object_r:vendor_default_prop:s0" dev="tmpfs" ino=19881 scontext=u:r:system_app:s0 tcontext=u:object_r:vendor_default_prop:s0 tclass=file permissive=0
avc: denied { read } for comm="WLCServiceHandl" name="u:object_r:vendor_default_prop:s0" dev="tmpfs" ino=19881 scontext=u:r:system_app:s0 tcontext=u:object_r:vendor_default_prop:s0 tclass=file permissive=0 duplicate messages suppressed
avc: denied { syslog_read } for comm="dmesg" scontext=u:r:shell:s0 tcontext=u:r:kernel:s0 tclass=system permissive=0
avc: denied { syslog_read } for comm="dmesg" scontext=u:r:shell:s0 tcontext=u:r:kernel:s0 tclass=system permissive=0
avc: denied { read } for comm="WLCServiceHandl" name="u:object_r:vendor_default_prop:s0" dev="tmpfs" ino=19881 scontext=u:r:system_app:s0 tcontext=u:object_r:vendor_default_prop:s0 tclass=file permissive=0
avc: denied { read } for comm="WLCServiceHandl" name="u:object_r:vendor_default_prop:s0" dev="tmpfs" ino=19881 scontext=u:r:system_app:s0 tcontext=u:object_r:vendor_default_prop:s0 tclass=file permissive=0 duplicate messages suppressed
avc: denied { syslog_read } for comm="dmesg" scontext=u:r:shell:s0 tcontext=u:r:kernel:s0 tclass=system permissive=0
avc: denied { syslog_read } for comm="dmesg" scontext=u:r:shell:s0 tcontext=u:r:kernel:s0 tclass=system permissive=0
avc: denied { read } for comm="WLCServiceHandl" name="u:object_r:vendor_default_prop:s0" dev="tmpfs" ino=19881 scontext=u:r:system_app:s0 tcontext=u:object_r:vendor_default_prop:s0 tclass=file permissive=0

修复，增加权限：

allow init firmware_file:filesystem { getattr };
allow init bt_firmware_file:filesystem { getattr };
allow init sysfs_mmc_host:file { write };
allow vendor_init ipa_dev:file { create };
allow system_server sysfs:file { read };
allow system_server vendor_default_prop:file { read };
allow system_app vendor_default_prop:file { read };
allow platform_app vendor_display_notch_prop:file { read };
allow webview_zygote zygote_exec:file { read execute };
allow shell kernel:system { syslog_read };
在device/qcom/sepolicy/....增加：
allow hal_sensors_default sensors_prop:file { read };
allow hal_perf_default sysfs_kgsl_proc:dir { search };