Android6.0 在SElinux下如何获得对一个内核节点的访问权限

Android 6.0下，因为采取了SEAndroid/SElinux的安全机制，即使拥有root权限，或者对某内核节点设置为777的权限，仍然无法在JNI层访问。本文涉及到的用户自定义的内核节点为/dev/freg_device
问题Log如下：

06-16 00:27:09.313 224 224 I SystemServer: Freg Service
06-16 00:27:09.313 224 224 I FregServiceJNI: Initializing HAL stub freg…
06-16 00:27:09.323 224 224 I FregServiceJNI: Device freg found.
06-16 00:27:09.332 224 224 E FregHALStub: Failed to open device file /dev/freg – Permission denied.
06-16 00:27:09.332 224 224 E FregServiceJNI: Failed to open device freg.
06-16 00:27:09.332 224 224 E FregService: Failed to initialize freg service.

06-16 00:27:09.337 63 63 E SELinux : avc: denied { add } for service=freg scontext=u:r:system_server:s0 tcontext=u:object_r:default_android_service:s0 tclass=service_manager
06-16 00:27:09.338 63 63 E ServiceManager: add_service(‘freg’,4f) uid=1000 - PERMISSION DENIED
06-16 00:27:09.346 224 224 E SystemServer: Failure starting Freg Service
06-16 00:27:09.346 224 224 E SystemServer: java.lang.SecurityException
06-16 00:27:09.346 224 224 E SystemServer: at android.os.BinderProxy.transactNative(Native Method)
06-16 00:27:09.346 224 224 E SystemServer: at android.os.BinderProxy.transact(Binder.java:503)
06-16 00:27:09.346 224 224 E SystemServer: at android.os.ServiceManagerProxy.addService(ServiceManagerNative.java:150)
06-16 00:27:09.346 224 224 E SystemServer: at android.os.ServiceManager.addService(ServiceManager.java:72)
06-16 00:27:09.346 224 224 E SystemServer: at com.android.server.SystemServer.startOtherServices(SystemServer.java:893)
06-16 00:27:09.346 224 224 E SystemServer: at com.android.server.SystemServer.run(SystemServer.java:270)
06-16 00:27:09.346 224 224 E SystemServer: at com.android.server.SystemServer.main(SystemServer.java:168)
06-16 00:27:09.346 224 224 E SystemServer: at java.lang.reflect.Method.invoke(Native Method)
06-16 00:27:09.346 224 224 E SystemServer: at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:726)
06-16 00:27:09.346 224 224 E SystemServer: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:616)

06-16 22:51:08.032 233 750 E FregService: Freg service is not initialized.
06-16 22:51:08.070 586 586 W Binder_4: type=1400 audit(0.0:44): avc: denied { ioctl } for path=“socket:[7266]” dev=“sockfs” ino=7266 ioctlcmd=7704 scontext=u:r:system_server:s0 tcontext=u:r:system_server:s0 tclass=unix_stream_socket permissive=0
06-16 22:51:08.090 586 586 W Binder_4: type=1400 audit(0.0:45): avc: denied { ioctl } for path=“socket:[7266]” dev=“sockfs” ino=7266 ioctlcmd=7704 scontext=u:r:system_server:s0 tcontext=u:r:system_server:s0 tclass=unix_stream_socket permissive=0

经测试验证可用的解决方法，记录下来供大家参考：

进入/android-6.0.1_r72/external/sepolicy/

在device.te文件中添加

type freg_device, dev_type;

在domain.te文件中添加

allow domain freg_device:chr_file rw_file_perms;

在file_contexts文件中添加

/dev/freg           u:object_r:freg_device:s0

在service.te中文件中添加

type freg_service, system_api_service, system_server_service, service_manager_type;

在service_contexts文件中添加

freg                                      u:object_r:freg_service:s0

在system_server.te文件中添加

allow system_server freg_device:chr_file rw_file_perms;

在untrusted_app.te文件中添加

allow untrusted_app freg_service:service_manager find;

在system_app.te文件中添加

allow system_app freg_service:service_manager find;