需求

自定義了個SystemProperties的屬性，需要在system應(yīng)用中修改它，介紹MTK及展銳的設(shè)置方法，可擴(kuò)展到其他平臺．
比如代碼中要這么設(shè)置

SystemProperties.set("property_name", "value");

默認(rèn)會引發(fā)selinux無權(quán)限的報錯．

實(shí)現(xiàn)

修改方法是在對應(yīng)的.te中添加對應(yīng)的屬性，注意不同的平臺屬性及修改目錄可能不一樣，比如展銳的與MTK的就不一樣．
如果不確定，可以讓APP跑起來，根據(jù)logcat中selinux的報錯信息來做修改．
第一步是在system_app.te中修改添加default_prop:property_service set
第二步是在兩處domain.te中修改添加例外．

MTK

權(quán)限是default_prop:property_service set
因?yàn)锳ndroid版本是8，所以domain.te選的是api/26.0目錄下的．

diff --git a/device/mediatek/sepolicy/bsp/non_plat/system_app.te b/device/mediatek/sepolicy/bsp/non_plat/system_app.te
index ca5fca1392..eb99644918 100755
--- a/device/mediatek/sepolicy/bsp/non_plat/system_app.te
+++ b/device/mediatek/sepolicy/bsp/non_plat/system_app.te
@@ -149,5 +149,5 @@ allow system_app protect_s_data_file:dir { getattr search read open add_name rem
-
+allow system_app default_prop:property_service { set };
 allow system_app ota_package_file:file ｛append｝;
diff --git a/system/sepolicy/prebuilts/api/26.0/public/domain.te b/system/sepolicy/prebuilts/api/26.0/public/domain.te
index d2b370a21b..8cb180314c 100644
--- a/system/sepolicy/prebuilts/api/26.0/public/domain.te
+++ b/system/sepolicy/prebuilts/api/26.0/public/domain.te
@@ -441,7 +441,7 @@ neverallow * hidl_base_hwservice:hwservice_manager find;
 
 # Require that domains explicitly label unknown properties, and do not allow
 # anyone but init to modify unknown properties.
-neverallow { domain -init } default_prop:property_service set;
+neverallow { domain -init -system_app -service_manager_type } default_prop:property_service set;
 neverallow { domain -init } mmc_prop:property_service set;
 
 # Do not allow reading device's serial number from system properties except form
diff --git a/system/sepolicy/public/domain.te b/system/sepolicy/public/domain.te
index 714a6b3af8..dbee8685e4 100644
--- a/system/sepolicy/public/domain.te
+++ b/system/sepolicy/public/domain.te
@@ -444,7 +444,7 @@ neverallow * hidl_base_hwservice:hwservice_manager find;
 
 # Require that domains explicitly label unknown properties, and do not allow
 # anyone but init to modify unknown properties.
-neverallow { domain -init } default_prop:property_service set;
+neverallow { domain -init -system_app -service_manager_type } default_prop:property_service set;

展銳

要改system_app.te添加權(quán)限vendor_default_prop:property_service
然后在domain.te及property.te的nerverallow中把system_app添加例外．
Android 11 對應(yīng)api/30.0
patch如下

// csdn帥得不敢出門
diff --git a/device/sprd/mpool/module/app/msepolicy/vendor/system_app.te b/device/sprd/mpool/module/app/msepolicy/vendor/system_app.te
index aeff2a14a4..3845e041d8 100755
--- a/device/sprd/mpool/module/app/msepolicy/vendor/system_app.te
+++ b/device/sprd/mpool/module/app/msepolicy/vendor/system_app.te
@@ -93,5 +93,5 @@ allow system_app radio_noril_prop:file { read open getattr };
 allow system_app prod_file:dir { remove_name };
 allow system_app sysfs:file { getattr open read };
 allow system_app sysfs:dir { search };
-
+allow system_app vendor_default_prop:property_service { set };

diff --git a/system/sepolicy/prebuilts/api/30.0/public/domain.te b/system/sepolicy/prebuilts/api/30.0/public/domain.te
index 1d3f8a071d..a0a2f694aa 100644
--- a/system/sepolicy/prebuilts/api/30.0/public/domain.te
+++ b/system/sepolicy/prebuilts/api/30.0/public/domain.te
@@ -530,7 +530,7 @@ compatible_property_only(`
     neverallow { domain -init } exported_secure_prop:property_service set;
     neverallow { domain -init } exported2_default_prop:property_service set;
     neverallow { domain -init -vendor_init } exported3_default_prop:property_service set;
-    neverallow { domain -init -vendor_init } vendor_default_prop:property_service set;
+    neverallow { domain -init -vendor_init -system_app } vendor_default_prop:property_service set;
     neverallow { domain -init -vendor_init } storage_config_prop:property_service set;
 ')
 
diff --git a/system/sepolicy/prebuilts/api/30.0/public/property.te b/system/sepolicy/prebuilts/api/30.0/public/property.te
index 43b09db8d1..c944270a9e 100644
--- a/system/sepolicy/prebuilts/api/30.0/public/property.te
+++ b/system/sepolicy/prebuilts/api/30.0/public/property.te
@@ -568,6 +568,7 @@ compatible_property_only(`
     coredomain
     -init
     -system_writes_vendor_properties_violators
+    -system_app
   } {
     property_type
     -system_property_type
diff --git a/system/sepolicy/public/domain.te b/system/sepolicy/public/domain.te
index 1d3f8a071d..a0a2f694aa 100644
--- a/system/sepolicy/public/domain.te
+++ b/system/sepolicy/public/domain.te
@@ -530,7 +530,7 @@ compatible_property_only(`
     neverallow { domain -init } exported_secure_prop:property_service set;
     neverallow { domain -init } exported2_default_prop:property_service set;
     neverallow { domain -init -vendor_init } exported3_default_prop:property_service set;
-    neverallow { domain -init -vendor_init } vendor_default_prop:property_service set;
+    neverallow { domain -init -vendor_init -system_app } vendor_default_prop:property_service set;
     neverallow { domain -init -vendor_init } storage_config_prop:property_service set;
 ')
 
diff --git a/system/sepolicy/public/property.te b/system/sepolicy/public/property.te
index 43b09db8d1..c944270a9e 100644
--- a/system/sepolicy/public/property.te
+++ b/system/sepolicy/public/property.te
@@ -568,6 +568,7 @@ compatible_property_only(`
     coredomain
     -init
     -system_writes_vendor_properties_violators
+    -system_app
   } {
     property_type

作者：帥得不敢出門　csdn原創(chuàng)謝絕轉(zhuǎn)載文章來源地址http://www.zghlxwxcb.cn/news/detail-666246.html

到了這里，關(guān)于MTK Android設(shè)置setprop的selinux權(quán)限的文章就介紹完了。如果您還想了解更多內(nèi)容，請在右上角搜索TOY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！