8.0 的目录做了一些修改
qocm
1. 目录分类
1.1
android/system/sepolicy
android/device/qcom/sepolicy/common
如果需要加一些配置或添加自定义的,可以分为2个目录添加
android/system/sepolicy --- myTest.te(定义)
android/device/qcom/sepolicy/common --- myTest.te(allow ,neverallow 规则)
myTest.te
type test_service, domain, mlstrustedsubject;
type test_service_exec, exec_type, file_type;
# Make transition from init to backup service domain
init_daemon_domain(test_service)
unix_socket_connect(test_service, property, init)
1.2 public 和private 2个新目录,定义公开类型和私有类型
android/system/sepolicy/public
android/system/sepolicy/private
(1) add ignore
sepolicy/private/compat/26.0/26.0.ignore.cil
typeattributeset new_objects
{
xxxxxx
test_service
test_service_exec
xxxxx
}
typeattributeset priv_objects
(2)其他.te 文件, 在system 目录下添加了后
prebuilts/api/26.0/private/service_contexts
prebuilts/api/26.0/private/system_server.te
2. init.rc 的一些配置
2.1 服务的配置,
//add service
service backupAppData /system/bin/sh /vendor/bin/backupXXX.sh
seclabel u:r:test_service:s0
disabled
oneshot
service recoverAppData /system/bin/sh /vendor/bin/recoverXXX.sh
seclabel u:r:test_service:s0(:c512,c768)
disabled
2.2 节点的配置
mkdir xxx/xxx/xx
//更改属组
chown system system xxx/xxx/xxx/
//针对需要写节点,而写不进入的问题
chmod 646 /sys/class/leds/led:torch_1/brightness
chmod 646 /sys/class/leds/led:torch_0/brightness
chmod 646 /sys/class/leds/led:switch_0/brightness
3.需全部编译的话 system/sepolicy/ 下mma
编译出来的结果 out/system/etc/selinux
out/vendor/etc/selinux
push 验证即可, 不用像之前的版本 make bootimage