构建 AOSP 自定义 rom

Question

我正在尝试建立强制执行，但我有 7 次违规。我该如何解决？

libsepol.report_failure: neverallow on line 5 of device/motorola/sanders/sepolicy/vendor/ims.te (or line 75926 of
 policy.conf) violated by allow hal_camera_default hal_camera_hwservice:hwservice_manager { add };
libsepol.report_failure: neverallow on line 3 of device/motorola/sanders/sepolicy/vendor/hal_nfc_default.te (or l
ine 75741 of policy.conf) violated by allow hal_secure_element_default hal_secure_element_hwservice:hwservice_man
ager { add };
libsepol.report_failure: neverallow on line 3 of device/motorola/sanders/sepolicy/vendor/hal_nfc_default.te (or l
ine 75741 of policy.conf) violated by allow rild hal_secure_element_hwservice:hwservice_manager { add };
libsepol.report_failure: neverallow on line 5 of system/sepolicy/public/hal_secure_element.te (or line 15685 of p
olicy.conf) violated by allow hal_nfc_default hal_secure_element_hwservice:hwservice_manager { add };
libsepol.report_failure: neverallow on line 5 of system/sepolicy/public/hal_camera.te (or line 14186 of policy.co
nf) violated by allow init hal_camera_hwservice:hwservice_manager { add };
libsepol.report_failure: neverallow on line 521 of system/sepolicy/public/domain.te (or line 10809 of policy.conf
) violated by allow hal_fingerprint_default default_android_hwservice:hwservice_manager { add };
libsepol.report_failure: neverallow on line 519 of system/sepolicy/public/domain.te (or line 10807 of policy.conf
) violated by allow qseeproxy default_android_service:service_manager { add };
libsepol.check_assertions: 7 neverallow failures occurred

Answer 1

您正在处理 neverallow 违规行为：您有一条规则说“永远不允许类型 x 在其他类型/类 action 上执行 y:c”，然后是另一条规则说“这个子类型允许x 在y:c 上执行action。 SE Linux 编译器将拒绝这些相互矛盾的规则。这可以通过修改neverallow 规则来解决您想要允许的特定子类型的例外情况。

更准确地说，如果您有以下形式的规则：

1. neverallow x y:c action;
2. type z, x;（意思是z是x的特例）
3. allow z y:c action;

将第一条规则修改为neverallow {x -z} y:class action;，为子类型z做一个例外。

例子：

1. Link: neverallow { domain ... -installd} staging_data_file:dir *; 表示不应允许domain 类型的对象访问staging_data_file 类型和dir 类型的对象。但是，它对类型 installd 有一个例外。

2. Link: type installd, domain; 将installd 定义为domain 的特例。

3. Link:allow installd staging_data_file:dir { open ... }; 允许installd 对staging_data_file 类型和dir 类的对象执行open 操作。