android - 需要一些关于 Android SELinux 构建错误的指南
问题描述
我目前正在尝试在 RockPi 4 上使用 Quectel EC25 LTE 编译 Android 9。但目前我被困在 SELinux 实现上。EC25 RIL 指南告诉我修改/添加以下文件到 src 树。
- ($Android_src)/system/core/rootdir/ueventd.rc
#quectel port
/dev/ttyUSB* 0660 radio radio
/dev/cdc-wdm* 0660 radio radio
/dev/qcqmi* 0660 radio radio
/dev/cdc-acm* 0660 radio radio
- ($Android_src)/external/sepolicy/file_contexts
/dev/ttyUSB[0-9]* u:object_r:tty_device:s0
/dev/ttyACM[0-9]* u:object_r:tty_device:s0
/system/bin/rild u:object_r:rild_exec:s0
/system/socket/rild u:object_r:rild_socket:s0
/system/socket/rild-debug u:object_r:rild_debug_socket:s0
/system/bin/pppd u:object_r:pppd_exec:s0
/dev/ppp u:object_r:ppp_device:s0
- ($Android_src)/external/sepolicy/rild.te
allow rild default_prop:property_service set;
allow rild device:chr_file { read write ioctl open getattr };
allow rild kernel:system module_request;
allow rild net_radio_prop:property_service set;
allow rild ppp_device:chr_file { read write ioctl open };
allow rild ppp_exec:file { read execute open execute_no_trans };
allow rild radio_prop:property_service set;
allow rild self:capability { net_admin setuid };
allow rild shell_exec:file { read execute open execute_no_trans };
allow rild sysfs_wake_lock:file { open read write };
allow rild system_file:file execute_no_trans;
allow rild system_prop:property_service set;
运行 make 后出现以下错误:
FAILED: out/target/product/rk3399/obj/ETC/sepolicy.recovery_intermediates/sepolicy
/bin/bash -c "(ASAN_OPTIONS=detect_leaks=0 out/host/linux-x86/bin/checkpolicy -M -c 30 -o out/target/product/rk3399/obj/ETC/sepolicy.recovery_intermediates/sepolicy.tmp out/target/product/rk3399/obj/ETC/sepolicy.recovery_intermediates/sepolicy.recovery.conf ) && (out/host/linux-x86/bin/sepolicy-analyze out/target/product/rk3399/obj/ETC/sepolicy.recovery_intermediates/sepolicy.tmp permissive > out/target/product/rk3399/obj/ETC/sepolicy.recovery_intermediates/sepolicy.permissivedomains ) && (if [ \"userdebug\" = \"user\" -a -s out/target/product/rk3399/obj/ETC/sepolicy.recovery_intermediates/sepolicy.permissivedomains ]; then echo \"==========\" 1>&2; echo \"ERROR: permissive domains not allowed in user builds\" 1>&2; echo \"List of invalid domains:\" 1>&2; cat out/target/product/rk3399/obj/ETC/sepolicy.recovery_intermediates/sepolicy.permissivedomains 1>&2; exit 1; fi ) && (mv out/target/product/rk3399/obj/ETC/sepolicy.recovery_intermediates/sepolicy.tmp out/target/product/rk3399/obj/ETC/sepolicy.recovery_intermediates/sepolicy )"
libsepol.report_failure: neverallow on line 532 of system/sepolicy/public/domain.te (or line 10484 of policy.conf) violated by allow rild default_prop:property_service { set };
libsepol.report_failure: neverallow on line 418 of system/sepolicy/public/domain.te (or line 10370 of policy.conf) violated by allow rild device:chr_file { read write open };
libsepol.check_assertions: 2 neverallow failures occurred
Error while expanding policy
out/host/linux-x86/bin/checkpolicy: loading policy configuration from out/target/product/rk3399/obj/ETC/sepolicy.recovery_intermediates/sepolicy.recovery.conf
[ 4% 449/10291] build out/target/product/rk3399/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows
FAILED: out/target/product/rk3399/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows
/bin/bash -c "(rm -f out/target/product/rk3399/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows ) && (ASAN_OPTIONS=detect_leaks=0 out/host/linux-x86/bin/checkpolicy -M -c 30 -o out/target/product/rk3399/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows out/target/product/rk3399/obj/ETC/sepolicy_neverallows_intermediates/policy.conf )"
libsepol.report_failure: neverallow on line 532 of system/sepolicy/public/domain.te (or line 10425 of policy.conf) violated by allow rild default_prop:property_service { set };
libsepol.report_failure: neverallow on line 418 of system/sepolicy/public/domain.te (or line 10311 of policy.conf) violated by allow rild device:chr_file { read write open };
libsepol.check_assertions: 2 neverallow failures occurred
Error while expanding policy
out/host/linux-x86/bin/checkpolicy: loading policy configuration from out/target/product/rk3399/obj/ETC/sepolicy_neverallows_intermediates/policy.conf
[ 4% 450/10291] //bionic/libc:libc_bionic_ndk clang++ bionic/bionic_systrace.cpp [arm]
ninja: build stopped: subcommand failed.
10:24:06 ninja failed with: exit status 1
我不熟悉 Android/SELinux,但我用谷歌搜索了这个错误,发现“neverallow”指令没有任何运气就被设置了。
帮助将不胜感激,
rgds
解决方案
您的允许规则对于 Android 来说太笼统了。
neverallow 规则有很好的文档记录。查看system/sepolicy/public/domain.te:532
并system/sepolicy/public/domain.te:418
从您的错误消息中:
# Require that domains explicitly label unknown properties, and do not allow
# anyone but init to modify unknown properties.
neverallow { domain -init -vendor_init } default_prop:property_service set;
# Don't allow raw read/write/open access to generic devices.
# Rather force a relabel to a more specific type.
neverallow domain device:chr_file { open read write };
您需要找出rild
必须设置的属性,然后添加更具体的允许规则。检查现有property_contexts
文件是否已将类型分配给属性rild
需求或自己创建。rild
对于想要访问的设备也需要这样做。
注意:有一些宏system/sepolicy/public/te_macros
可以使您rild.te
更具可读性。示例:替换allow rild default_prop:property_service set
为set_prop(rild, default_prop)
.
推荐阅读
- javascript - 首次单击关闭按钮后未出现警报消息
- python - Python 'not' 运算符
- reactjs - 在jsx元素中动态更改className
- ruby-on-rails - ActiveRecord 如何将 where 和 join 的两个条件结合起来
- sql-server - SQL Server 2017 Standard 是否支持 SSAS 中的并行处理?
- arduino - 将 WiFi 凭据保存到 ESP8266 上的 EEPROM
- reactjs - 如何使用打字稿中的反应钩子设置graphql数据?
- android - 具有多个实时数据对象的活动
- c# - HttpClient 无法解析“UTF-8”内容类型
- gtk - 有没有办法在 gtk+、pygobject 中输入数字?