平台:
RK3288 + android 5.11
修改selinux模式为enforcing (默认为 permissive)
主要修改parameter:
FIRMWARE_VER:5.1.1 MACHINE_MODEL:rk3288 ... #private 6GB, System 512MB, Data 3GB, origin 512MB CMDLINE:console=ttyFIQ0 androidboot.selinux=enforcing androidboot.hardware=rk30board androidboot.console=ttyFIQ0 init=/init initrd=0x62000000,0x00800000 mtdparts=rk29xxnand:0x00002000@0x00002000(uboot),0x00002000@0x00004000(misc),0x00008000@0x00006000(resource),0x00008000@0x0000e000(kernel),0x00010000@0x00016000(boot),0x00010000@0x00026000(recovery),0x0001a000@0x00036000(backup),0x00040000@0x00050000(cache),0x00002000@0x00090000(kpanic),0x00400000@0x00092000(system),0x00008000@0x00492000(metadata),0x00C00000@0x0049A000(private),0x0012C000@0x0109A000(origin),0x00600000@0x011C6000(userdata),0x00020000@0x017C6000(radical_update),-@0x017E6000(user)
重点在:androidboot.selinux=enforcing
在系统启动后, 可以通过getenforce 查看是否设置成功
#adb shell getenforce Enforcing
问题1:
自定义服务无法正常启动, 导致android 不停重启, LOG 如下:
01-02 02:17:00.313 I/ActivityManagerService( 3003): Start proc 3581:com.android.settings/1000 for broadcast com.android.settings/.HdmiReceiver 01-02 02:17:00.322 D/SystemControlerService( 3003): ALog onServiceConnected 01-02 02:17:00.322 E/SELinux ( 171): avc: denied { add } for service=systemctrl_service scontext=u:r:system_server:s0 tcontext=u:object_r:default_android_service:s0 tclass=service_manager 01-02 02:17:00.323 E/ServiceManager( 171): add_service('systemctrl_service',60) uid=1000 - PERMISSION DENIED 01-02 02:17:00.323 D/SystemControlerService( 3538): ALog android.net.wifi.WIFI_STATE_CHANGED 01-02 02:17:00.323 D/AndroidRuntime( 3003): Shutting down VM 01-02 02:17:00.323 E/AndroidRuntime( 3003): *** FATAL EXCEPTION IN SYSTEM PROCESS: main 01-02 02:17:00.323 E/AndroidRuntime( 3003): java.lang.SecurityException 01-02 02:17:00.323 E/AndroidRuntime( 3003): at android.os.BinderProxy.transactNative(Native Method) 01-02 02:17:00.323 E/AndroidRuntime( 3003): at android.os.BinderProxy.transact(Binder.java:496) 01-02 02:17:00.323 E/AndroidRuntime( 3003): at android.os.ServiceManagerProxy.addService(ServiceManagerNative.java:150) 01-02 02:17:00.323 E/AndroidRuntime( 3003): at android.os.ServiceManager.addService(ServiceManager.java:89) 01-02 02:17:00.323 E/AndroidRuntime( 3003): at com.android.server.SystemService.publishBinderService(SystemService.java:172) 01-02 02:17:00.323 E/AndroidRuntime( 3003): at com.android.server.SystemService.publishBinderService(SystemService.java:164) 01-02 02:17:00.323 E/AndroidRuntime( 3003): at com.android.server.os.SystemControlerService.access$000(SystemControlerService.java:51) 01-02 02:17:00.323 E/AndroidRuntime( 3003): at com.android.server.os.SystemControlerService$1.onServiceConnected(SystemControlerService.java:80) 01-02 02:17:00.323 E/AndroidRuntime( 3003): at android.app.LoadedApk$ServiceDispatcher.doConnected(LoadedApk.java:1208) 01-02 02:17:00.323 E/AndroidRuntime( 3003): at android.app.LoadedApk$ServiceDispatcher$RunConnection.run(LoadedApk.java:1225) 01-02 02:17:00.323 E/AndroidRuntime( 3003): at android.os.Handler.handleCallback(Handler.java:739) 01-02 02:17:00.323 E/AndroidRuntime( 3003): at android.os.Handler.dispatchMessage(Handler.java:95) 01-02 02:17:00.323 E/AndroidRuntime( 3003): at android.os.Looper.loop(Looper.java:135) 01-02 02:17:00.323 E/AndroidRuntime( 3003): at com.android.server.SystemServer.run(SystemServer.java:274) 01-02 02:17:00.323 E/AndroidRuntime( 3003): at com.android.server.SystemServer.main(SystemServer.java:175) 01-02 02:17:00.323 E/AndroidRuntime( 3003): at java.lang.reflect.Method.invoke(Native Method) 01-02 02:17:00.323 E/AndroidRuntime( 3003): at java.lang.reflect.Method.invoke(Method.java:372) 01-02 02:17:00.323 E/AndroidRuntime( 3003): at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:963) 01-02 02:17:00.323 E/AndroidRuntime( 3003): at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:758) 01-02 02:17:00.328 E/ActivityManagerService( 3003): warning: could NOT find SYSTEMCTRL_SERVICE service 01-02 02:17:00.521 W/art ( 3003): Long monitor contention event with owner method=boolean com.android.server.am.ActivityManagerService.unbindService(android.app.IServiceConnection) from ActivityManagerService.java:15763 waiters=0 for 192ms 01-02 02:17:00.522 E/AndroidRuntime( 3003): Error reporting crash 01-02 02:17:00.522 E/AndroidRuntime( 3003): java.lang.NullPointerException: Attempt to read from field 'android.content.pm.ApplicationInfo com.android.server.am.ProcessRecord.info' on a null object reference 01-02 02:17:00.522 E/AndroidRuntime( 3003): at com.android.server.am.ActivityManagerService.handleApplicationCrashInner(ActivityManagerService.java:11969) 01-02 02:17:00.522 E/AndroidRuntime( 3003): at com.android.server.am.ActivityManagerService.handleApplicationCrash(ActivityManagerService.java:11945) 01-02 02:17:00.522 E/AndroidRuntime( 3003): at com.android.internal.os.RuntimeInit$UncaughtHandler.uncaughtException(RuntimeInit.java:89) 01-02 02:17:00.522 E/AndroidRuntime( 3003): at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:693) 01-02 02:17:00.522 E/AndroidRuntime( 3003): at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:690) 01-02 02:17:00.522 I/Process ( 3003): Sending signal. PID: 3003 SIG: 9 01-02 02:17:00.587 I/ServiceManager( 171): service 'display' died 01-02 02:17:00.588 W/AudioFlinger( 2778): power manager service died !!! 01-02 02:17:00.590 E/WifiManager( 3108): Channel connection lost 01-02 02:17:00.591 D/SurfaceFlinger( 174): Set power mode=2, type=0 flinger=0xb7b91550 01-02 02:17:00.591 D/SurfaceFlinger( 174): Screen type=0 is already mode=2 01-02 02:17:00.599 I/ServiceManager( 171): service 'hardware' died 01-02 02:17:00.600 E/BufferQueueProducer( 174): [StatusBar] queueBuffer: BufferQueue has been abandoned 01-02 02:17:00.600 E/Surface ( 3108): queueBuffer: error queuing buffer to SurfaceTexture, -19 01-02 02:17:00.600 F/OpenGLRenderer( 3108): Encountered EGL error 12299 EGL_BAD_NATIVE_WINDOW during rendering 01-02 02:17:00.601 F/libc ( 3108): Fatal signal 6 (SIGABRT), code -6 in tid 3526 (RenderThread) 01-02 02:17:00.603 I/ServiceManager( 171): service 'webviewupdate' died 01-02 02:17:00.604 I/ServiceManager( 171): service 'consumer_ir' died 01-02 02:17:00.604 I/ServiceManager( 171): service 'user' died 01-02 02:17:00.604 I/ServiceManager( 171): service 'sensorservice' died 01-02 02:17:00.604 I/ServiceManager( 171): service 'batterystats' died 01-02 02:17:00.604 I/ServiceManager( 171): service 'appops' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'power' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'device_policy' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'input' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'input_method' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'clipboard' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'account' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'entropy' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'vibrator' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'cpuinfo' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'procstats' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'mount' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'telephony.registry' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'devicestoragemonitor' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'content' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'gfxinfo' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'package' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'statusbar' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'meminfo' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'dbinfo' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'permission' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'activity' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'servicediscovery' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'netstats' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'wifip2p' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'usagestats' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'textservices' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'scheduling_policy' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'battery' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'alarm' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'lock_settings' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'accessibility' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'window' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'bluetooth_manager' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'network_score' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'netpolicy' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'network_management' died 01-02 02:17:00.605 I/ServiceManager( 171): service 'search' died 01-02 02:17:00.606 I/ServiceManager( 171): service 'country_detector' died 01-02 02:17:00.606 I/ServiceManager( 171): service 'wifiscanner' died 01-02 02:17:00.606 I/ServiceManager( 171): service 'wifi' died 01-02 02:17:00.606 I/ServiceManager( 171): service 'ethernet' died 01-02 02:17:00.606 I/ServiceManager( 171): service 'location' died 01-02 02:17:00.606 I/ServiceManager( 171): service 'rttmanager' died 01-02 02:17:00.606 I/ServiceManager( 171): service 'connectivity' died 01-02 02:17:00.606 I/ServiceManager( 171): service 'updatelock' died 01-02 02:17:00.606 I/ServiceManager( 171): service 'notification' died 01-02 02:17:00.606 I/ServiceManager( 171): service 'dreams' died 01-02 02:17:00.606 I/ServiceManager( 171): service 'wallpaper' died 01-02 02:17:00.606 I/ServiceManager( 171): service 'dropbox' died 01-02 02:17:00.606 I/ServiceManager( 171): service 'DockObserver' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'media_session' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'audio' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'usb' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'assetatlas' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'uimode' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'jobscheduler' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'samplingprofiler' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'voiceinteraction' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'appwidget' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'commontime_management' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'backup' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'serial' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'diskstats' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'media_router' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'display_device_management' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'media_projection' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'fingerprint' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'trust' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'restrictions' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'print' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'imms' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'launcherapps' died 01-02 02:17:00.608 I/ServiceManager( 171): service 'telecom' died 01-02 02:17:00.702 E/DEBUG ( 189): Failed to find a valid tombstone, default to using tombstone 0. 01-02 02:17:00.702 E/DEBUG ( 189): failed to open tombstone file '/data/tombstones/tombstone_00': No such file or directory 01-02 02:17:00.702 I/DEBUG ( 189): Skipping tombstone write, nothing to do. 01-02 02:17:00.726 I/BootAnimation( 3601): boot_animation_process start, built at '18:49:46', on 'Sep 21 2017'. 再如: 01-02 02:25:23.372 I/SystemServiceManager( 495): Starting com.android.server.pppoe.PppoeService 01-02 02:25:23.373 I/PppoeServiceImpl( 495): Creating PppoeServiceImpl 01-02 02:25:23.375 I/PppoeService( 495): Registering service pppoe 01-02 02:25:23.376 E/SELinux ( 171): avc: denied { add } for service=pppoe scontext=u:r:system_server:s0 tcontext=u:object_r:default_android_service:s0 tclass=service_manager 01-02 02:25:23.376 E/ServiceManager( 171): add_service('pppoe',38) uid=1000 - PERMISSION DENIED 01-02 02:25:23.376 W/SystemServer( 495): *********************************************** 01-02 02:25:23.377 F/SystemServer( 495): BOOT FAILURE start PppoeService error 01-02 02:25:23.377 F/SystemServer( 495): java.lang.RuntimeException: Failed to start service com.android.server.pppoe.PppoeService: onStart threw an exception 01-02 02:25:23.377 F/SystemServer( 495): at com.android.server.SystemServiceManager.startService(SystemServiceManager.java:111) 01-02 02:25:23.377 F/SystemServer( 495): at com.android.server.SystemServiceManager.startService(SystemServiceManager.java:65) 01-02 02:25:23.377 F/SystemServer( 495): at com.android.server.SystemServer.startOtherServices(SystemServer.java:709) 01-02 02:25:23.377 F/SystemServer( 495): at com.android.server.SystemServer.run(SystemServer.java:261) 01-02 02:25:23.377 F/SystemServer( 495): at com.android.server.SystemServer.main(SystemServer.java:175) 01-02 02:25:23.377 F/SystemServer( 495): at java.lang.reflect.Method.invoke(Native Method) 01-02 02:25:23.377 F/SystemServer( 495): at java.lang.reflect.Method.invoke(Method.java:372) 01-02 02:25:23.377 F/SystemServer( 495): at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:963) 01-02 02:25:23.377 F/SystemServer( 495): at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:758) 01-02 02:25:23.377 F/SystemServer( 495): Caused by: java.lang.SecurityException 01-02 02:25:23.377 F/SystemServer( 495): at android.os.BinderProxy.transactNative(Native Method) 01-02 02:25:23.377 F/SystemServer( 495): at android.os.BinderProxy.transact(Binder.java:496) 01-02 02:25:23.377 F/SystemServer( 495): at android.os.ServiceManagerProxy.addService(ServiceManagerNative.java:150) 01-02 02:25:23.377 F/SystemServer( 495): at android.os.ServiceManager.addService(ServiceManager.java:89) 01-02 02:25:23.377 F/SystemServer( 495): at com.android.server.SystemService.publishBinderService(SystemService.java:172) 01-02 02:25:23.377 F/SystemServer( 495): at com.android.server.SystemService.publishBinderService(SystemService.java:164) 01-02 02:25:23.377 F/SystemServer( 495): at com.android.server.pppoe.PppoeService.onStart(PppoeService.java:40) 01-02 02:25:23.377 F/SystemServer( 495): at com.android.server.SystemServiceManager.startService(SystemServiceManager.java:109) 01-02 02:25:23.377 F/SystemServer( 495): ... 8 more 01-02 02:25:23.377 I/SystemServer( 495): Connectivity Service 01-02 02:25:23.380 D/ConnectivityService( 495): ConnectivityService starting up
关键看LOG:
01-02 02:17:00.322 E/SELinux ( 171): avc: denied { add } for service=systemctrl_service scontext=u:r:system_server:s0 tcontext=u:object_r:default_android_service:s0 tclass=service_manager 01-02 02:17:00.323 E/ServiceManager( 171): add_service('systemctrl_service',60) uid=1000 - PERMISSION DENIED 01-02 02:25:23.376 E/SELinux ( 171): avc: denied { add } for service=pppoe scontext=u:r:system_server:s0 tcontext=u:object_r:default_android_service:s0 tclass=service_manager 01-02 02:25:23.376 E/ServiceManager( 171): add_service('pppoe',38) uid=1000 - PERMISSION DENIED
————解决————–
$ git diff device/rockchip/common/sepolicy/service_contexts diff --git a/device/rockchip/common/sepolicy/service_contexts b/device/rockchip/common/sepolicy/service_contexts old mode 100644 new mode 100755 index 216f6b8..5cc9fd3 --- a/device/rockchip/common/sepolicy/service_contexts +++ b/device/rockchip/common/sepolicy/service_contexts @@ -2,3 +2,5 @@ fmradioservice u:object_r:radio_service:s0 oemtelephony u:object_r:radio_service:s0 msm.registry u:object_r:system_app_service:s0 +systemctrl u:object_r:system_server_service:s0 +pppoe u:object_r:system_server_service:s0
PS:
SELinux的相关的源码有两处:
|–device/rockchip/common/sepolicy/
|–external/sepolicy/
编译及生效:
mmm external/sepolicy/ && ./mkimage.sh
再通过工具烧录 boot.img 和 recovery.img(可选)
问题二:
文件访问权限无权限, 如读取文件夹, 查看文件信息, 无法创建文件, 无法写入等等.
自定义private 分区, 目录为/private
通常, 错误的LOG为:
#type=1400 audit(0.0:64): avc: denied { search } for name="/" dev="sda1" ino=1 scontext=u:r:system_server:s0 tcontext=u:object_r:vfat:s0 tclass=dir permissive=0
表明: system_server 无法访问 vfat 的 dir, 操作 search.
修改方法为, 在TE中加入:
+allow system_server vfat:dir {search};
#type=1400 audit(0.0:8): avc: denied { execute } for path="/data/data/com.xxx/cache/slice-slice_9-classes.dex" dev="mmcblk0p14" ino=115000 scontext=u:r:system_app:s0 tcontext=u:object_r:system_app_data_file:s0 tclass=file permissive=0 +allow system_app system_app_data_file:file{ execute };
其它的问题修改类似.
为system_app赋与读写权限:
diff --git a/device/rockchip/common/sepolicy/file.te b/device/rockchip/common/sepolicy/file.te old mode 100644 new mode 100755 index 371e1dc..1cd6326 --- a/device/rockchip/common/sepolicy/file.te +++ b/device/rockchip/common/sepolicy/file.te @@ -26,10 +26,11 @@ type rpc_send_socket, file_type; type rpc_reg_socket, file_type; type metadata_file, file_type; +type private_file, file_type; diff --git a/device/rockchip/common/sepolicy/file_contexts b/device/rockchip/common/sepolicy/file_contexts old mode 100644 new mode 100755 index fc55766..118ed6b --- a/device/rockchip/common/sepolicy/file_contexts +++ b/device/rockchip/common/sepolicy/file_contexts @@ -11,6 +11,9 @@ # Bluetooth /dev/ttyBT(.*) u:object_r:tty_device:s0 # logcat /system/bin/logcat u:object_r:logcat_exec:s0 @@ -127,6 +130,7 @@ /system/bin/akmd u:object_r:akmd_exec:s0 /metadata(/.*)? u:object_r:metadata_file:s0 +/private(/.*)? u:object_r:private_file:s0 +++ b/device/rockchip/common/sepolicy/system_app.te @@ -18,6 +18,39 @@ allow system_app cache_file:file create_file_perms; allow system_app thermal_file:file rw_file_perms; allow system_app pekallfmrserver:binder { call transfer }; allow system_app default_prop:property_service { set }; +#private +allow system_app private_file:dir rw_dir_perms; +allow system_app private_file:file execute; +allow system_app private_file:file rw_file_perms; +allow system_app private_file:dir { append create open write getattr setattr rename execute}; +allow system_app private_file:file { append unlink create open write getattr setattr rename execute}; +allow system_app toolbox_exec:file { read open getattr execute execute_no_trans}; +allow system_app su_exec:file { read open getattr execute execute_no_trans}; +
如USB, 串口访问:
为ttyACM 定义
|–device/rockchip/common/sepolicy/file_contexts
# ACM /dev/ttyACM[0-9]* u:object_r:tty_device:s0
|–device/rockchip/common/sepolicy/system_app.te
+allow system_app usb_device:dir rw_dir_perms; +allow system_app tty_device:dir rw_dir_perms; +allow system_app usb_device:chr_file {lock open read write ioctl}; +allow system_app tty_device:chr_file {lock open read write ioctl};
问题3:
当加入某些权限与原本定义产生冲突时编译失败:
mmm external/sepolicy/
libsepol.report_failure: neverallow on line 342 of external/sepolicy/app.te (or line 4327 of policy.conf) violated by allow system_app sysfs:file { write }; libsepol.check_assertions: 1 neverallow failures occurred libsepol.report_failure: neverallow on line 342 of external/sepolicy/app.te (or line 4327 of policy.conf) violated by allow system_app sysfs:file { write }; Error while expanding policy make: *** [out/target/product/rk3288/obj/ETC/sepolicy_intermediates/sepolicy] 错误 1 make: *** 正在等待未完成的任务.... libsepol.check_assertions: 1 neverallow failures occurred Error while expanding policy
关键看这一句:
neverallow on line 342 of external/sepolicy/app.te (or line 4327 of policy.conf)
直接去看下policy.conf文件里面写着什么:
|–out/target/product/rk3288/obj/ETC/sepolicy_intermediates/policy.conf
# Write to various pseudo file systems. neverallow { appdomain -bluetooth -nfc } sysfs:{ dir { { chr_file blk_file } { file lnk_file sock_file fifo_file } } } write;
原因是我尝试在system_app.te中加入 system app对设备节点文件的读写操作:
allow system_app sysfs:file { read write getattr open }; //这里的定义会与|--external/sepolicy/app.te中的定义冲突: # Write to various pseudo file systems. neverallow { appdomain -bluetooth -nfc } sysfs:dir_file_class_set write;
解决:
|–external/sepolicy/app.te
# Write to various pseudo file systems. neverallow { appdomain -bluetooth -nfc } sysfs:dir_file_class_set write; //改为: # Write to various pseudo file systems. neverallow { appdomain -bluetooth -nfc -system_app} sysfs:dir_file_class_set write;
有用的几个命令:
1.getenforce setenforce
查看和设置模式
2. ls -Z 文件
查看文件的selinux权限
3. ps -Z
查看进程selinux 权限
相关资料:
http://blog.csdn.net/innost/article/details/19299937/ (受益颇多)
https://www.2cto.com/kf/201504/390742.html (了解)
