Új hozzászólás Aktív témák

• #21806 bagyusz őstag

  Új Válasz 2015-01-14 12:18:21 #21806

  Új hozzászólás

  Összes hozzászólása itt Válaszok az összes hozzászólására itt Válaszok erre a hozzászólásra

  Privát üzenet küldése

  

  bagyusz

  őstag

  Sziasztok

  Hogy lehet, selinux configot írni debug alapján?

  Android doksiban valamelyest le van írva, meg van is egy példa rá, de egyszerűen nem tudom értelmezni.

  Tehát van nekem egy alap selinux configom amit módosítani kellene az adott telóra.

  Le fordítottam a droidot ami ugyan be bootol, de folyamatosan "dobálja" a selinux jogosultsági hibákat.

  / # dmesg | grep denied
  <5>[ 4.775919] type=1401 audit(37194506.490:3): op=security_bounded_transition result=denied oldcontext=u:r:kernel:s0 newcontext=u:r:init:s0
  <5>[ 17.442026] type=1400 audit(37194519.143:6): avc: denied { read write } for pid=333 comm="ueventd" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:ueventd:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <5>[ 21.620235] type=1400 audit(37194523.317:7): avc: denied { read write } for pid=367 comm="ta_qmi_service" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:ta_qmi_service:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <5>[ 22.080207] type=1400 audit(37194523.778:8): avc: denied { read write } for pid=373 comm="mac-update" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:mac_update:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <5>[ 22.443399] type=1400 audit(37194524.148:9): avc: denied { read write } for pid=393 comm="mpdecision" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:mpdecision:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <5>[ 22.448771] type=1400 audit(37194524.148:10): avc: denied { setattr } for pid=393 comm="mpdecision" name="mpctl" dev="tmpfs" ino=5019 scontext=u:r:mpdecision:s0 tcontext=u:object_r:socket_device:s0 tclass=sock_file
  <5>[ 22.448985] type=1400 audit(37194524.148:11): avc: denied { setattr } for pid=393 comm="mpdecision" name="mpctl" dev="tmpfs" ino=5019 scontext=u:r:mpdecision:s0 tcontext=u:object_r:socket_device:s0 tclass=sock_file
  <5>[ 22.459362] type=1400 audit(37194524.158:12): avc: denied { read write } for pid=395 comm="sysinit" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:sysinit:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <5>[ 22.466015] type=1400 audit(37194524.168:13): avc: denied { write } for pid=397 comm="mpdecision" name="system" dev="mmcblk0p15" ino=317617 scontext=u:r:mpdecision:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir
  <5>[ 22.544849] type=1400 audit(37194524.248:14): avc: denied { read } for pid=407 comm="mount" name="mmcblk0p13" dev="tmpfs" ino=7148 scontext=u:r:init_shell:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file
  <5>[ 22.545063] type=1400 audit(37194524.248:15): avc: denied { remount } for pid=407 comm="mount" scontext=u:r:init_shell:s0 tcontext=u:object_r:labeledfs:s0 tclass=filesystem
  <5>[ 22.850358] type=1400 audit(37194524.549:16): avc: denied { remount } for pid=436 comm="mount" scontext=u:r:init_shell:s0 tcontext=u:object_r:labeledfs:s0 tclass=filesystem
  <4>[ 23.153456] type=1400 audit(37194524.819:27): avc: denied { read write } for pid=455 comm="sh" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:shell:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <4>[ 23.153914] type=1400 audit(37194524.829:28): avc: denied { read write } for pid=465 comm="mac-update" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:mac_update:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <4>[ 23.154188] type=1400 audit(37194524.849:29): avc: denied { read write } for pid=479 comm="adbd" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:adbd:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <4>[ 23.181413] type=1400 audit(37194524.879:30): avc: denied { read write } for pid=459 comm="rild" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:rild:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <4>[ 23.186174] type=1400 audit(37194524.879:31): avc: denied { read write } for pid=474 comm="sdcard" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:sdcardd:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <4>[ 23.186601] type=1400 audit(37194524.889:32): avc: denied { read write } for pid=467 comm="updatemiscta" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:updatemiscta:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <4>[ 23.217182] type=1400 audit(37194524.919:33): avc: denied { read write } for pid=461 comm="mediaserver" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:mediaserver:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <4>[ 23.220326] type=1400 audit(37194524.919:34): avc: denied { read write } for pid=473 comm="qseecomd" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:tee:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <4>[ 23.223805] type=1400 audit(37194524.919:35): avc: denied { read write } for pid=476 comm="time_daemon" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:time_daemon:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <4>[ 23.238821] type=1400 audit(37194524.939:36): avc: denied { write } for pid=467 comm="updatemiscta" name="property_service" dev="tmpfs" ino=4994 scontext=u:r:updatemiscta:s0 tcontext=u:object_r:property_socket:s0 tclass=sock_file
  <4>[ 23.255486] type=1400 audit(37194524.959:37): avc: denied { read write } for pid=458 comm="debuggerd" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:debuggerd:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <4>[ 23.256218] type=1400 audit(37194524.959:38): avc: denied { read write } for pid=460 comm="drmserver" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:drmserver:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <4>[ 23.259728] type=1400 audit(37194524.959:39): avc: denied { read write } for pid=475 comm="irsc_util" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:irsc_util:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <4>[ 23.261895] type=1400 audit(37194524.959:40): avc: denied { read write } for pid=457 comm="netd" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:netd:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <4>[ 23.264947] type=1400 audit(37194524.969:41): avc: denied { read write } for pid=468 comm="netmgrd" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:netmgrd:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <4>[ 23.267358] type=1400 audit(37194524.969:42): avc: denied { read write } for pid=466 comm="qmuxd" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:qmuxd:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <4>[ 23.308133] type=1400 audit(37194525.009:43): avc: denied { read write } for pid=456 comm="auditd" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:logd:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <4>[ 23.322752] type=1400 audit(37194525.019:44): avc: denied { read write } for pid=472 comm="gsiff_daemon" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:location:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <4>[ 23.323210] type=1400 audit(37194525.019:45): avc: denied { read write } for pid=470 comm="illumination_se" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:illumination:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <4>[ 23.323699] type=1400 audit(37194525.029:46): avc: denied { read write } for pid=462 comm="installd" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:installd:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <4>[ 23.324584] type=1400 audit(37194525.029:47): avc: denied { read write } for pid=463 comm="keystore" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:keystore:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket
  <4>[ 23.370151] type=1400 audit(37194525.069:48): avc: denied { read write } for pid=471 comm="app_process" path="socket:[4773]" dev="sockfs" ino=4773 scontext=u:r:zygote:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket

  Tehát ez alapján hogy lehetne megszerkeszteni a selinux configot?

  Tudom, egyszerű lenne kikapcsolni, de sajnos elég szorosan fűződik az 5.0 droidhoz.

Új hozzászólás Aktív témák