Android Selinux详解[五]--新增hal服务标签相关

在工作过程中，SElinux常用的有以下几个文件可用于新增标签

可用于加标签的文件名	含义	对应的声明文件名(一般会声明的地方，根本上放哪里都可以)
file_contexts	给 文件/目录/节点 新增标签	file.te
genfs_contexts	给节点新增标签，与上一个不同的是，不用执行restorecon操作	file.te
hwservice_contexts	给hal服务新增标签	hwservice.te
property_contexts	给属性新增标签	property.te
seapp_contexts	给APP新增标签	untrusted_app.te app.te...等等
service_contexts	给系统服务新增标签	service.te

hwservice在源码中可以看看，主要有如下几种声明类型

hwservice.te - OpenGrok cross reference for /system/sepolicy/public/hwservice.te

type default_android_hwservice, hwservice_manager_type, protected_hwservice;
type fwk_camera_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
type fwk_bufferhub_hwservice, hwservice_manager_type, coredomain_hwservice;
type hal_codec2_hwservice, hwservice_manager_type;
type hal_graphics_mapper_hwservice, hwservice_manager_type, same_process_hwservice;

在sepolicy/public/service.te中还有一个neverallow，此neverallow意思为不允许domain对非hwservice_manager_type的hal service进行add find权限

neverallow domain ~hwservice_manager_type:hwservice_manager { add find };

 hwservice用到的几种type解释如下：

type声明类型	解释
hwservice_manager_type	所有hal服务都需要加此声明
same_process_hwservice	All HwBinder services guaranteed to be passthrough. These services always run in the process of their clients, and thus operate with the same access as their clients.
coredomain_hwservice	All HwBinder services guaranteed to be offered only by core domain components
protected_hwservice	All HwBinder services that untrusted apps can't directly access