{"id":21,"date":"2024-06-17T00:28:39","date_gmt":"2024-06-16T16:28:39","guid":{"rendered":"https:\/\/www.swreader.com\/?p=21"},"modified":"2024-06-17T12:56:15","modified_gmt":"2024-06-17T04:56:15","slug":"android-sepolicy-%e8%a7%84%e5%88%99%e6%96%87%e4%bb%b6%e7%bc%96%e8%af%91%e8%bf%87%e7%a8%8b%e5%88%86%e6%9e%90","status":"publish","type":"post","link":"https:\/\/www.swreader.com\/index.php\/2024\/06\/17\/android-sepolicy-%e8%a7%84%e5%88%99%e6%96%87%e4%bb%b6%e7%bc%96%e8%af%91%e8%bf%87%e7%a8%8b%e5%88%86%e6%9e%90\/","title":{"rendered":"Android Selinux policy build\u5206\u6790"},"content":{"rendered":"

Sepolicy\u7684\u6700\u7ec8\u7f16\u8bd1\u751f\u6210<\/h2>\n

\u7f16\u8bd1\u751f\u6210\u4e2d\u95f4\u6587\u4ef6\u76ee\u5f55\uff1a<\/p>\n

out\\soong.intermediates\\system\\sepolicy<\/p>\n

\u5728\u6b64\u76ee\u5f55\u4e0b\u53ef\u4ee5\u770b\u5230\u6240\u6709\u7684\u7f16\u8bd1\u4e2d\u95f4\u6587\u4ef6\u548c\u7b56\u7565\u7b49\u7ea7\uff1a<\/p>\n

28.0.board.compat.cil      file_contexts_overlayfs_files            pub_policy_for_vendor.cil\n28.0.board.compat.map      hwservice_contexts_files                 pub_policy_for_vendor.conf\n29.0.board.compat.cil      keystore2_key_contexts_files             reqd_policy_mask.cil\n29.0.board.compat.map      odm_sepolicy.conf                        reqd_policy_mask.conf\n30.0.board.compat.cil      plat_bug_map                             reqd_policy_mask_for_vendor.cil\n30.0.board.compat.map      plat_mapping_file                        reqd_policy_mask_for_vendor.conf\n31.0.board.compat.cil      plat_mapping_file_for_vendor             seapp_contexts_files\n31.0.board.compat.map      plat_policy_for_vendor.cil               se_build_files\n32.0.board.compat.cil      plat_policy_for_vendor.conf              selinux_policy_version\n32.0.board.compat.map      plat_pub_policy.cil                      sepolicy_freeze_test\napex                       plat_pub_policy.conf                     sepolicy_neverallows\napex_sepolicy-33.cil       plat_pub_versioned.cil                   sepolicy_neverallows.checkpolicy.conf\napex_sepolicy-33.conf      plat_sepolicy_and_mapping.sha256         sepolicy_neverallows.sepolicy_analyze.conf\nbase_plat_pub_policy.conf  plat_sepolicy_and_mapping.sha256_gen     sepolicy_neverallows_vendor\nbase_plat_sepolicy         plat_sepolicy.cil                        sepolicy_neverallows_vendor.checkpolicy.conf\nbase_plat_sepolicy.cil     plat_sepolicy.conf                       sepolicy_neverallows_vendor.sepolicy_analyze.conf\nbase_plat_sepolicy.conf    plat_sepolicy_vers.txt                   sepolicy_technical_debt\nbug_map_files              product_sepolicy_and_mapping.sha256_gen  sepolicy_test\ncompat                     product_sepolicy.conf                    service_contexts_files\ncontexts                   property_contexts_files                  tests\nfile_contexts_asan_files   pub_policy.cil                           tools\nfile_contexts_files        pub_policy.conf<\/code><\/pre>\n
\u7f16\u8bd1\u8fc7\u7a0b\u5206\u6790<\/h2>\n
cli\u662f\u6700\u7ec8\u4f7f\u7528\u7684\u6587\u4ef6\uff0c\u4f9d\u8d56\u5173\u7cfb\u5982\u4e0b\uff1a<\/p>\n
cli -> conf\u6587\u4ef6 -> se_build_files<\/p>\n
Cli \u6587\u4ef6<\/h3>\n
\u7f16\u8bd1\u7684\u6700\u7ec8\u76ee\u6807\u662fcli\u6587\u4ef6<\/p>\n
conf\u6587\u4ef6<\/h3>\n
Cli\u6587\u4ef6\u4f9d\u8d56conf\u6587\u4ef6<\/p>\n
plat_policy_for_vendor.conf<\/h4>\n
meta_lic<\/p>\n
package_name:  ""\nmodule_types:  "se_policy_conf"\nmodule_classes:  "UNKNOWN"\nprojects:  "system\/sepolicy"\nlicense_kinds:  "SPDX-license-identifier-Apache-2.0"\nlicense_kinds:  "legacy_unencumbered"\nlicense_conditions:  "notice"\nlicense_conditions:  "unencumbered"\nlicense_texts:  "system\/sepolicy\/NOTICE"\nis_container:  false\nbuilt:  "out\/soong\/.intermediates\/system\/sepolicy\/plat_policy_for_vendor.conf\/android_common\/plat_policy_for_vendor.conf"\ndeps:  {\n  file:  "out\/soong\/.intermediates\/system\/sepolicy\/se_build_files\/meta_lic"\n}\ndeps:  {\n  file:  "out\/soong\/.intermediates\/system\/sepolicy\/se_build_files\/meta_lic"\n}\ndeps:  {\n  file:  "out\/soong\/.intermediates\/system\/sepolicy\/se_build_files\/meta_lic"\n}\ndeps:  {\n  file:  "out\/soong\/.intermediates\/system\/sepolicy\/se_build_files\/meta_lic"\n}\ndeps:  {\n  file:  "out\/soong\/.intermediates\/system\/sepolicy\/se_build_files\/meta_lic"\n}\ndeps:  {\n  file:  "out\/soong\/.intermediates\/system\/sepolicy\/se_build_files\/meta_lic"\n}<\/code><\/pre>\n
meta_lic.rsp<\/p>\n
-mt se_policy_conf -r system\/sepolicy -mc UNKNOWN -k SPDX-license-identifier-Apache-2.0 -k legacy_unencumbered -c notice -c unencumbered -n system\/sepolicy\/NOTICE -d out\/soong\/.intermediates\/system\/sepolicy\/se_build_files\/meta_lic -d out\/soong\/.intermediates\/system\/sepolicy\/se_build_files\/meta_lic -d out\/soong\/.intermediates\/system\/sepolicy\/se_build_files\/meta_lic -d out\/soong\/.intermediates\/system\/sepolicy\/se_build_files\/meta_lic -d out\/soong\/.intermediates\/system\/sepolicy\/se_build_files\/meta_lic -d out\/soong\/.intermediates\/system\/sepolicy\/se_build_files\/meta_lic   -t out\/soong\/.intermediates\/system\/sepolicy\/plat_policy_for_vendor.conf\/android_common\/plat_policy_for_vendor.conf <\/code><\/pre>\n
se_build_files<\/h3>\n
out\\soong.intermediates\\system\\sepolicy\\se_build_files\\meta_lic.rsp<\/p>\n
meta_lic<\/p>\n
package_name:  ""\nmodule_types:  ""\nmodule_classes:  "UNKNOWN"\nprojects:  "system\/sepolicy"\nlicense_kinds:  "SPDX-license-identifier-Apache-2.0"\nlicense_kinds:  "legacy_unencumbered"\nlicense_conditions:  "notice"\nlicense_conditions:  "unencumbered"\nlicense_texts:  "system\/sepolicy\/NOTICE"\nis_container:  false\nbuilt:  "\/\/system\/sepolicy:se_build_files"<\/code><\/pre>\n
meta_lic.rsp<\/p>\n
-mt se_build_files \n-r system\/sepolicy \n-mc UNKNOWN \n-k SPDX-license-identifier-Apache-2.0 \n-k legacy_unencumbered \n-c notice \n-c unencumbered \n-n system\/sepolicy\/NOTICE    \n-t \/\/system\/sepolicy:se_build_files <\/code><\/pre>\n
se_build_files {\n    name: "se_build_files",\n    srcs: [\n        "security_classes",\n        "initial_sids",\n        "access_vectors",\n        "global_macros",\n        "neverallow_macros",\n        "mls_macros",\n        "mls_decl",\n        "mls",\n        "policy_capabilities",\n        "te_macros",\n        "attributes",\n        "ioctl_defines",\n        "ioctl_macros",\n        "*.te",\n        "roles_decl",\n        "roles",\n        "users",\n        "initial_sid_contexts",\n        "fs_use",\n        "genfs_contexts",\n        "port_contexts",\n    ],\n}<\/code><\/pre>\n
Sepolicy\u7f16\u8bd1\u8fc7\u7a0b\u6587\u6863\u5206\u6790<\/h2>\n
system\\sepolicy\\Android.mk<\/p>\n
# sepolicy is now divided into multiple portions:\n# public - policy exported on which non-platform policy developers may write\n#   additional policy.  types and attributes are versioned and included in\n#   delivered non-platform policy, which is to be combined with platform policy.\n# private - platform-only policy required for platform functionality but which\n#  is not exported to vendor policy developers and as such may not be assumed\n#  to exist.\n# vendor - vendor-only policy required for vendor functionality. This policy can\n#  reference the public policy but cannot reference the private policy. This\n#  policy is for components which are produced from the core\/non-vendor tree and\n#  placed into a vendor partition.\n# mapping - This contains policy statements which map the attributes\n#  exposed in the public policy of previous versions to the concrete types used\n#  in this policy to ensure that policy targeting attributes from public\n#  policy from an older platform version continues to work.\n\n# build process for device:\n# 1) convert policies to CIL:\n#    - private + public platform policy to CIL\n#    - mapping file to CIL (should already be in CIL form)\n#    - non-platform public policy to CIL\n#    - non-platform public + private policy to CIL\n# 2) attributize policy\n#    - run script which takes non-platform public and non-platform combined\n#      private + public policy and produces attributized and versioned\n#      non-platform policy\n# 3) combine policy files\n#    - combine mapping, platform and non-platform policy.\n#    - compile output binary policy file<\/code><\/pre>\n
Sepolicy\u6e90\u6587\u4ef6Makefile\u53d8\u91cf\u6c47\u603b<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
selinux\u53d8\u91cf<\/th>\n\u542b\u4e49<\/th>\n\u5206\u533a<\/th>\n<\/tr>\n<\/thead>\n
BOARD_PLAT_PRIVATE_SEPOLICY_DIR<\/td>\n\u5df2\u5e9f\u5f03\uff0c\u4f7f\u7528SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS\u66ff\u6362<\/td>\nvendor<\/td>\n<\/tr>\n
BOARD_PLAT_PUBLIC_SEPOLICY_DIR<\/td>\n\u5df2\u5e9f\u5f03\uff0c\u4f7f\u7528SYSTEM_EXT_PUBLIC_SEPOLICY_DIRS\u66ff\u6362<\/td>\nvendor<\/td>\n<\/tr>\n
SYSTEM_EXT_PUBLIC_SEPOLICY_DIRS<\/td>\n\u5b89\u88c5\u5230system_ext\u7684\u53ef\u4ee5\u88abvendor\u4f7f\u7528\u7684\u6807\u7b7e<\/td>\nsystem_ext<\/td>\n<\/tr>\n
SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS<\/td>\n\u5b89\u88c5\u5230system_ext\u7684\u4e0d<\/strong>\u53ef\u4ee5\u88abvendor\u4f7f\u7528\u7684\u6807\u7b7e<\/td>\nsystem_ext<\/td>\n<\/tr>\n
PRODUCT_PUBLIC_SEPOLICY_DIRS<\/td>\n\u5b89\u88c5\u5230product\u4e2d\u7684\u53ef\u4ee5\u88abvendor\u4f7f\u7528\u7684\u6807\u7b7e<\/td>\nproduct<\/td>\n<\/tr>\n
PRODUCT_PRIVATE_SEPOLICY_DIRS<\/td>\n\u5b89\u88c5\u5230product\u4e2d\u7684\u4e0d<\/strong>\u53ef\u4ee5\u88abvendor\u4f7f\u7528\u7684\u6807\u7b7e<\/td>\nproduct<\/td>\n<\/tr>\n
BOARD_SEPOLICY_DIRS<\/td>\n\u5df2\u88ab\u5e9f\u5f03\uff0c\u4f7f\u7528BOARD_VENDOR_SEPOLICY_DIRS\u66ff\u4ee3\uff0c\u4f9bvendor\/odm\u4f7f\u7528<\/td>\nvendor<\/td>\n<\/tr>\n
BOARD_VENDOR_SEPOLICY_DIRS<\/td>\nvendor\u4f7f\u7528\u7684selinux\u89c4\u5219\uff0csystem\u4e0d\u53ef\u4f7f\u7528<\/td>\nvendor<\/td>\n<\/tr>\n
BOARD_ODM_SEPOLICY_DIRS<\/td>\nodm\u4f7f\u7528\u7684selinux\u89c4\u5219\uff0csystem\u4e0d\u53ef\u4f7f\u7528<\/td>\nvendor<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n