neverallow on line 1161 of system/sepolicy/public/domain.te (or line 11544 of policy.conf) violated by allow iap2communication system_data_file:file { write create };
// hwservice.te，定义hal_bluetoothext_hwservice域 type hal_bluetoothext_hwservice, hwservice_manager_type;
4.2 hal_neverallows.te类型
报错信息：
1
libsepol.report_failure: neverallow on line 27 of system/sepolicy/public/hal_neverallows.te (or line 15113 of policy.conf) violated by allow hal_audio_default hal_audio_default:tcp_socket { read create connect };
Multiple same specifications for vendor.ts.audioext::IAudioExtService. Multiple same specifications for vendor.ts.broadcastradio::IBroadcastRadio. Multiple same specifications for vendor.ts.vehiclediag::IVehicleDiag. Multiple same specifications for vendor.ts.light::ILight. Multiple same specifications for vendor.ts.gnssext::IGnssExt. Multiple same specifications for vendor.ts.mex::IMex. Multiple same specifications for vendor.ts.mextransfer::IMexTransfer. Multiple same specifications for vendor.ts.persistenceadmin::IPersistenceAdmin. Multiple same specifications for vendor.ts.perscommonservice::IPersCommonService. Multiple same specifications for vendor.ts.systemlog::ISystemLog. Multiple same specifications for vendor.ts.timesync::ITimeSync. Multiple same specifications for vendor.ts.hardware.wifi.hostapd::IHostapd. Multiple same specifications for vendor.ts.iap::IIap. Multiple same specifications for vendor.ts.iap::IIapCallback. Multiple same specifications for vendor.ts.someip::ISomeIp. Multiple same specifications for vendor.ts.someip::ISomeIpCallback. Multiple same specifications for vendor.ts.someip::ISomeIpClient. Multiple same specifications for vendor.ts.someip::ISomeIpServer. Multiple same specifications for vendor.ts.tbox::ITbox. Multiple same specifications for vendor.ts.tbox::ITboxCallback. Multiple same specifications for vendor.ts.tbox::ITboxWifi. Multiple same specifications for vendor.ts.tbox::ITboxWifiCallback. Multiple same specifications for vendor.ts.tbox::ITboxGnss. Multiple same specifications for vendor.ts.tbox::ITboxGnssCallback.
1 2 3 4 5
out/target/product/msmnile_gvmq/obj/ETC/plat_file_contexts_intermediates/plat_file_contexts.tmp: Multiple same specifications for /system/bin/CarPlayCommService. out/target/product/msmnile_gvmq/obj/ETC/plat_file_contexts_intermediates/plat_file_contexts.tmp: Multiple same specifications for /system/bin/CarPlayCommService. out/target/product/msmnile_gvmq/obj/ETC/plat_file_contexts_intermediates/plat_file_contexts.tmp: Multiple same specifications for /system/bin/IAP2CommService. out/target/product/msmnile_gvmq/obj/ETC/plat_file_contexts_intermediates/plat_file_contexts.tmp: Multiple same specifications for /system/bin/IAP2CommService. out/target/product/msmnile_gvmq/obj/ETC/plat_file_contexts_intermediates/plat_file_contexts.tmp: Multiple same specifications for /data/carplay(/.*)?.
libsepol.report_failure: neverallow on line 458 of system/sepolicy/public/app.te (or line 8475 of policy.conf) violated by allow system_app system_data_file:file { write create }; libsepol.report_failure: neverallow on line 458 of system/sepolicy/public/app.te (or line 8475 of policy.conf) violated by allow system_app system_data_file:dir { write create };
libsepol.report_failure: neverallow on line 9 of device/gxatek/common/legacy/sepolicy/vendor/Location/np_rules/gnss_ext.te (or line 45156 of policy.conf) violated by allow hal_gnss_default np_location_gnss_hwservice:hwservice_manager { add };
neverallow on line 716 of system/sepolicy/public/domain.te (or line 10796 of policy.conf) violated by allow system_app firewalldaemon:unix_stream_socket { connectto };
neverallow on line 866 of system/sepolicy/public/domain.te (or line 11152 of policy.conf) violated by allow np_iot_security_srv data_certs_file:dir { search };
报错原因
1 2 3 4 5 6 7 8 9 10 11 12 13 14
full_treble_only(` # vendor domains may only access dirsin /data/vendor, never core_data_file_types neverallow { domain -appdomain # TODO(b/34980020) remove exemption for appdomain -coredomain -data_between_core_and_vendor_violators -vendor_init } { core_data_file_type -system_data_file # default label for files on /data. Covered below... -vendor_data_file -zoneinfo_data_file }:dir *;
# typeattribute np_iot_security_srv data_between_core_and_vendor_violators; # 以上代码作用等同于 #type np_iot_security_srv, domain, data_between_core_and_vendor_violators; type np_iot_security_srv, domain, data_between_core_and_vendor_violators; type np_iot_security_srv_exec, vendor_file_type, exec_type, file_type;
4.15 对system_data_file的write和create权限
报错信息:
1 2
libsepol.report_failure: neverallow on line 1161 of system/sepolicy/public/domain.te (or line 11569 of policy.conf) violated by allow audioserver system_data_file:file { write create }; libsepol.check_assertions: 1 neverallow failures occurred
报错原因：
1 2 3 4 5 6 7 8 9
neverallow { domain -system_server -system_app -init -installd # for relabelfrom and unlink, check for this in explicit neverallow -vold_prepare_subdirs # For unlink with_asan(`-asan_extract') } system_data_file:file no_w_file_perms;
解决办法：
1
11-08 02:38:28.259 4304 4304 I Binder:4304_3: type=1400 audit(0.0:415): avc: denied { read write open } for path="/data/core/!system!bin!audioserver.4304.Binder:4304_3" dev="vdb" ino=1442455 scontext=u:r:audioserver:s0 tcontext=u:object_r:system_data_file:s0 tclass=file permissive=1
libsepol.report_failure: neverallow on line 1290 of system/sepolicy/public/domain.te (or line 11091 of policy.conf) violated by allow system_app np_miniprogram_app:file { execute execute_no_trans };
报错原因
1 2 3 4 5 6 7 8 9 10 11 12 13 14
# Blacklist app domains not allowed to execute from /data neverallow { bluetooth isolated_app nfc radio shared_relro system_app } { data_file_type -dalvikcache_data_file -system_data_file # shared libs in apks -apk_data_file }:file no_x_file_perms;
微信
支付宝
