Android10 动态修改开机动画（二）设置分区权限

Selinux配置策略

配置init.common.rc文件

device\sprd\sharkle\common\rootdir\root\init.common.rc

+	restorecon_recursive /mnt/anim
+	chmod 0777 /mnt/anim
+	chown root system /mnt/anim

restorecon_recursive /mnt/anim  ：如果anim变成u:object_r:unlabeled:s0 ，重新去加载分区的sepolicy

配置file.te文件

system/sepolicy/public/file.te

+type mnt_new_file, file_type;

system/sepolicy/prebuilts/api/29.0/public/file.te

+type mnt_new_file, file_type;

配置file_contexts文件

system/sepolicy/private/file_contexts

+/mnt/anim(/.*)?             u:object_r:mnt_new_file:s0
+/anim(/.*)?           u:object_r:mnt_new_file:s0

system/sepolicy/prebuilts/api/29.0/private/file_contexts

+/mnt/anim(/.*)?             u:object_r:mnt_new_file:s0
+/anim(/.*)?           u:object_r:mnt_new_file:s0

忽略安全策略，配置ignore.cil后缀文件

• /aosp/system/sepolicy/private/compat/26.0/26.0.ignore.cil
• /aosp/system/sepolicy/private/compat/27.0/27.0.ignore.cil
• /aosp/system/sepolicy/private/compat/28.0/28.0.ignore.cil
• /aosp/system/sepolicy/prebuilts/api/29.0/private/compat/26.0/26.0.ignore.cil
• /aosp/system/sepolicy/prebuilts/api/29.0/private/compat/27.0/27.0.ignore.cil
• /aosp/system/sepolicy/prebuilts/api/29.0/private/compat/28.0/28.0.ignore.cil

需要添加的内容与位置：

     mediaprovider_tmpfs
     metadata_file
     mnt_product_file
+    mnt_new_file
     mnt_vendor_file
     netd_stable_secret_prop
     network_stack

配置init.te文件

system/sepolicy/prebuilts/api/29.0/public/init.te

+allow init mnt_new_file:dir { mounton getattr };

system/sepolicy/public/init.te

+allow init mnt_new_file:dir { mounton getattr };

配置vendor_init.te文件

system/sepolicy/public/vendor_init.te

diff --git a/system/sepolicy/public/vendor_init.te b/system/sepolicy/public/vendor_init.te
old mode 100644
new mode 100755
index 375673c..47a1ef3
--- a/system/sepolicy/public/vendor_init.te
+++ b/system/sepolicy/public/vendor_init.te
@@ -50,6 +50,7 @@ allow vendor_init {
   -exec_type
   -system_file_type
   -mnt_product_file
+  -mnt_new_file
   -password_slot_metadata_file
   -unlabeled
   -vendor_file_type
@@ -106,6 +107,7 @@ allow vendor_init {
   -core_data_file_type
   -exec_type
   -mnt_product_file
+  -mnt_new_file
   -password_slot_metadata_file
   -system_file_type
   -vendor_file_type
@@ -114,6 +116,9 @@ allow vendor_init {
   -apex_metadata_file
 }:dir_file_class_set relabelto;
 
+allow vendor_init mnt_new_file:dir { setattr getattr relabelto read open map search };
+allow vendor_init mnt_new_file:file { relabelto read open };
+
 allow vendor_init dev_type:dir create_dir_perms;
 allow vendor_init dev_type:lnk_file create;

system/sepolicy/prebuilts/api/29.0/public/vendor_init.te

diff --git a/system/sepolicy/prebuilts/api/29.0/public/vendor_init.te b/system/sepolicy/prebuilts/api/29.0/public/vendor_init.te
old mode 100644
new mode 100755
index 375673c..47a1ef3
--- a/system/sepolicy/prebuilts/api/29.0/public/vendor_init.te
+++ b/system/sepolicy/prebuilts/api/29.0/public/vendor_init.te
@@ -50,6 +50,7 @@ allow vendor_init {
   -exec_type
   -system_file_type
   -mnt_product_file
+  -mnt_new_file
   -password_slot_metadata_file
   -unlabeled
   -vendor_file_type
@@ -106,6 +107,7 @@ allow vendor_init {
   -core_data_file_type
   -exec_type
   -mnt_product_file
+  -mnt_new_file
   -password_slot_metadata_file
   -system_file_type
   -vendor_file_type
@@ -114,6 +116,9 @@ allow vendor_init {
   -apex_metadata_file
 }:dir_file_class_set relabelto;
 
+allow vendor_init mnt_new_file:dir { setattr getattr relabelto read open map search };
+allow vendor_init mnt_new_file:file { relabelto read open };
+
 allow vendor_init dev_type:dir create_dir_perms;
 allow vendor_init dev_type:lnk_file create;

配置bootanim.te文件

system/sepolicy/public/bootanim.te

+allow bootanim tmpfs:dir { open read };
+allow bootanim mnt_new_file:dir { open read search };
+allow bootanim mnt_new_file:file { open read map };

system/sepolicy/prebuilts/api/29.0/public/bootanim.te

+allow bootanim tmpfs:dir { open read };
+allow bootanim mnt_new_file:dir { open read search };
+allow bootanim mnt_new_file:file { open read map };

配置system_server.te文件

system/sepolicy/prebuilts/api/29.0/private/system_server.te

+allow system_server tmpfs:dir { open read write add_name };
+allow system_server mnt_new_file:dir { open read search write add_name remove_name };
+allow system_server mnt_new_file:file { open read map write create getattr setattr };

system/sepolicy/private/system_server.te

+allow system_server tmpfs:dir { open read write add_name };
+allow system_server mnt_new_file:dir { open read search write add_name remove_name };
+allow system_server mnt_new_file:file { open read map write create getattr setattr };

编译后烧录，BootAnimation.cpp可以读取mnt/anim目录了，system_server允许对mnt/anim目录读写