设置 shell 脚本 Android SELinux 策略以在系统引导时启动它已完成

Question

I am facing troubles for creating the SELinux policies for a sh script (init.myservice.sh) with the following content:

#!/system/bin/sh
/system/bin/am force-stop 'com.myapp.apptest'
/system/bin/tinymix 'Headphone Volume' 35;tinymix 'Capture Input' ADC;tinymix 'DMIC Mux' DMIC2;
/system/bin/am start -n ' com.myapp.apptest/ com.myapp.apptest.MainActivity' -a android.intent.action.MAIN -c android.intent.category.LAUNCHER
/system/bin/my_board_service &

As you can see, this script does the following things:

• Stops (and starts) a APK application
• Sets few mic and audio settings with tinymix
• Starts a binary (my_board_service) which is a C++ compiled program which interacts with the custom board peripherals (GPIOs, I2C, etc...)

I've added into my "init.rc" file the following lines:

on property:sys.boot_completed=1
    start init-myservice

service init-myservice /system/bin/sh /system/bin/init.myservice.sh
    class main
    user root
    group root system
    disabled
    oneshot

I can see the script in the built system under the path "/system/bin" and the binary with the correct permissions (755) and if I launch it manually it works well. But I'm unable to launch it at system boot because (without any policies set) I get this error on the shell:

Command 'start init-myservice' action=sys.boot_completed=1 (/vendor/etc/init/hw/init.freescale.rc:334) took 5ms and failed: Could not start service: File /system/bin/init.myservice.sh(labeled "u:object_r:system_file:s0") has incorrect label or no domain transition from u:r:init:s0 to another SELinux domain defined. Have you configured your service correctly? https://source.android.com/security/selinux/device-policy#label_new_services_and_address_denials

So I'm trying to generate service policies without any luck. I've tried the following: The content of my.te file is the following:

# foo service
type foo, domain;
type foo_exec, exec_type, file_type;
init_daemon_domain(foo)

I've added the following line in the "file_contexts" file under this location: "android_build/device/variscite/imx8m/dart_mx8mm/sepolicy/"

/system/bin/init\.myscript\.sh      u:object_r:foo_exec:s0

When I build my AOSP project I get few errors like this one:

FAILED: out/target/product/dart_mx8mm/obj/ETC/treble_sepolicy_tests_28.0_intermediates/treble_sepolicy_tests_28.0 /bin/bash -c "(out/host/linux-x86/bin/treble_sepolicy_tests -l
out/host/linux-x86/lib64/libsepolwrap.so -f out/target/product/dart_mx8mm/obj/ETC/plat_file_contexts_intermediates/plat_file_contexts -f out/target/product/dart_mx8mm/obj/ETC/vendor_file_contexts_intermediates/vendor_file_contexts -b out/target/product/dart_mx8mm/obj/ETC/built_plat_sepolicy_intermediates/built_plat_sepolicy -m out/target/product/dart_mx8mm/obj/ETC/treble_sepolicy_tests_28.0_intermediates/28.0_mapping.combined.cil -o out/target/product/dart_mx8mm/obj/ETC/treble_sepolicy_tests_28.0_intermediates/built_28.0_plat_sepolicy -p out/target/product/dart_mx8mm/obj/ETC/sepolicy_intermediates/sepolicy -u out/target/product/dart_mx8mm/obj/ETC/built_plat_sepolicy_intermediates/base_plat_pub_policy.cil --fake-treble ) && (touch out/target/product/dart_mx8mm/obj/ETC/treble_sepolicy_tests_28.0_intermediates/treble_sepolicy_tests_28.0 )" The following domain(s) must be associated with the "coredomain" attribute because they are executed off of /system: foo

Answer 1

I recently was able to get what you are describing to work, but there were some differences in our approaches. All of my changes were in "/vendor" on the target. I'm not sure where your init.rc changes were going, but you described your script as being installed in "/system".

Otherwise most of what you are describing is familiar including having issues compiling the SELinux policy. In the end the policy that worked for me looked something like this:

# foo service
type foo, domain;
type foo_exec, exec_type, vendor_file_type, file_type;

init_daemon_domain(foo)

# followed by all the particulars of my service.

If you are set on installing your service in "system" instead of "vendor", the wording of the error message seems to be telling you to associate your domain with the "coredomain". I think that means your policy should include the following line somewhere before "init_daemon_domain":

typeattribute foo coredomain;

You should also be aware that I've seen it said that there is a SELinux policy that prohibits mixing "vendor" with "system". I'm not sure, but I think it means that if you modified an init.rc in the /vendor file system to run your script, you are limited to using "stuff" found in the /vendor file system. Your example above shows your script using /system/bin/sh, so if you modified an init.rc in the /vendor file system to start that script, I think that would be a violation.