Android SELinux

Google参考链接：https://source.android.com/docs/core/architecture/aidl/aidl-hals#sepolicy

A. 通信框架SE文件修改 public /attributes  vendor/hal_foo.te

B. server端SE文件修改 vendor/service.te  vendor/service_contexts(实例安全属性申明)

vendor/hal_foo_default.te（新建，配置server端进程的权限） vendor/file_contexts

C.client端SE文件修改

private/system_server.te

system侧进程安全策略配置放在private目录下

vendor侧进程安全策略配置放在vendor目录下

所以，为一个服务添加完整的SELinux权限的过程是这样的：

    public/attributes:
    //1.属性定义 define hal_foo, hal_foo_client, hal_foo_server
    hal_attribute(foo)
 
 
    public/service.te
    //2.hal服务类型定义，逗号后表示继承 define hal_foo_service
    type hal_foo_service, hal_service_type, protected_service, service_manager_type
 
 
    public/hal_foo.te:
    //3.sepolicy定义 allow binder connection from client to server
    binder_call(hal_foo_client, hal_foo_server)
    binder_call(hal_foo_server, hal_foo_client) //服务回调到客户端要配
 
    //4.hal类型和服务关联
    // allow client to find the service, allow server to register the service
    hal_attribute_service(hal_foo, hal_foo_service)
 
    //5.允许hal服务通过binder连接service_manager 
    // allow binder communication from server to service_manager
    binder_use(hal_foo_server)
    //or以下?
    binder_call(hal_foo_server, servicemanager)
    binder_call(hal_foo_client, servicemanager)
 
 
 
    private/service_contexts:
    //6.将服务实例名和服务类型绑定 bind an AIDL service name to the selinux type
    android.hardware.foo.IFooXxxx/default u:object_r:hal_foo_service:s0
 
 
    private/<some_domain>.te:
    // let this domain use the hal service
    binder_use(some_domain)
    hal_client_domain(some_domain, hal_foo)
 
    vendor/<some_hal_server_domain>.te
    // let this domain serve the hal service
    hal_server_domain(some_hal_server_domain, hal_foo)

hal_attribute_service宏包括以下操作：

allow hal_foo_server hal_foo_service:service_manager {add find}

allow hal_foo_client hal_foo_service:service_manager {find}