android audit2allow工具使用步骤

dmesg里面经常会看到很多的avc denied的打印，如果有很多这种打印，那可以借助于android提供的audit2allow工具帮我们转换成allow语句。

使用步骤如下：
一、将dmesg中的相关avc denied的打印语句，复制到一个txt文件中，我这里取名为tee-supplicant.txt(因为我正在操作的进程是tee-supplicant)

avc: denied { read append } for comm="tee-supplicant" name="kmsg_debug" dev="tmpfs" ino=8780 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:kmsg_debug_device:s0 tclass=chr_file permissive=1
avc: denied { read append } for comm="tee-supplicant" name="kmsg_debug" dev="tmpfs" ino=8780 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:kmsg_debug_device:s0 tclass=chr_file permissive=1
avc: denied { open } for comm="tee-supplicant" path="/dev/kmsg_debug" dev="tmpfs" ino=8780 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:kmsg_debug_device:s0 tclass=chr_file permissive=1
avc: denied { open } for comm="tee-supplicant" path="/dev/kmsg_debug" dev="tmpfs" ino=8780 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:kmsg_debug_device:s0 tclass=chr_file permissive=1
avc: denied { syslog_read } for comm="tee-supplicant" scontext=u:r:tee-supplicant:s0 tcontext=u:r:kernel:s0 tclass=system permissive=1
avc: denied { syslog_read } for comm="tee-supplicant" scontext=u:r:tee-supplicant:s0 tcontext=u:r:kernel:s0 tclass=system permissive=1
avc: denied { getattr } for comm="tee-supplicant" path="/dev/kmsg_debug" dev="tmpfs" ino=8780 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:kmsg_debug_device:s0 tclass=chr_file permissive=1
avc: denied { getattr } for comm="tee-supplicant" path="/dev/kmsg_debug" dev="tmpfs" ino=8780 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:kmsg_debug_device:s0 tclass=chr_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/kmsg_debug" dev="tmpfs" ino=8780 ioctlcmd=0x5401 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:kmsg_debug_device:s0 tclass=chr_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/kmsg_debug" dev="tmpfs" ino=8780 ioctlcmd=0x5401 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:kmsg_debug_device:s0 tclass=chr_file permissive=1
avc: denied { open } for comm="tee-supplicant" path="/sys/devices/platform/0.soc/34458000.sdhci/mmc_host/mmc1/mmc1:0001/cid" dev="sysfs" ino=44384 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
avc: denied { open } for comm="tee-supplicant" path="/sys/devices/platform/0.soc/34458000.sdhci/mmc_host/mmc1/mmc1:0001/cid" dev="sysfs" ino=44384 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
avc: denied { search } for comm="tee-supplicant" name="block" dev="tmpfs" ino=21511 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=dir permissive=1
avc: denied { search } for comm="tee-supplicant" name="block" dev="tmpfs" ino=21511 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=dir permissive=1
avc: denied { read } for comm="tee-supplicant" name="mmcblk1" dev="tmpfs" ino=24601 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { read } for comm="tee-supplicant" name="mmcblk1" dev="tmpfs" ino=24601 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { open } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { open } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 ioctlcmd=0xb300 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 ioctlcmd=0xb300 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { sys_rawio } for comm="tee-supplicant" capability=17 scontext=u:r:tee-supplicant:s0 tcontext=u:r:tee-supplicant:s0 tclass=capability permissive=1
avc: denied { sys_rawio } for comm="tee-supplicant" capability=17 scontext=u:r:tee-supplicant:s0 tcontext=u:r:tee-supplicant:s0 tclass=capability permissive=1
avc: denied { sys_rawio } for comm="tee-supplicant" capability=17 scontext=u:r:tee-supplicant:s0 tcontext=u:r:tee-supplicant:s0 tclass=capability permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 ioctlcmd=0xb300 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 ioctlcmd=0xb300 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { read write } for comm="tee-supplicant" name="mmcblk1rpmb" dev="tmpfs" ino=21735 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
avc: denied { read write } for comm="tee-supplicant" name="mmcblk1rpmb" dev="tmpfs" ino=21735 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
avc: denied { open } for comm="tee-supplicant" path="/dev/mmcblk1rpmb" dev="tmpfs" ino=21735 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
avc: denied { open } for comm="tee-supplicant" path="/dev/mmcblk1rpmb" dev="tmpfs" ino=21735 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/mmcblk1rpmb" dev="tmpfs" ino=21735 ioctlcmd=0xb301 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/mmcblk1rpmb" dev="tmpfs" ino=21735 ioctlcmd=0xb301 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
avc: denied { search } for comm="tee-supplicant" name="block" dev="tmpfs" ino=21511 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=dir permissive=1
avc: denied { search } for comm="tee-supplicant" name="block" dev="tmpfs" ino=21511 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=dir permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 ioctlcmd=0xb300 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 ioctlcmd=0xb300 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 ioctlcmd=0xb300 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 ioctlcmd=0xb300 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 ioctlcmd=0xb300 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 ioctlcmd=0xb300 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 ioctlcmd=0xb300 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 ioctlcmd=0xb300 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 ioctlcmd=0xb300 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 ioctlcmd=0xb300 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { open } for comm="tee-supplicant" path="/sys/devices/platform/0.soc/34458000.sdhci/mmc_host/mmc1/mmc1:0001/cid" dev="sysfs" ino=44384 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
avc: denied { open } for comm="tee-supplicant" path="/sys/devices/platform/0.soc/34458000.sdhci/mmc_host/mmc1/mmc1:0001/cid" dev="sysfs" ino=44384 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
avc: denied { search } for comm="tee-supplicant" name="block" dev="tmpfs" ino=21511 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=dir permissive=1
avc: denied { search } for comm="tee-supplicant" name="block" dev="tmpfs" ino=21511 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=dir permissive=1
avc: denied { read } for comm="tee-supplicant" name="mmcblk1" dev="tmpfs" ino=24601 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { read } for comm="tee-supplicant" name="mmcblk1" dev="tmpfs" ino=24601 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
cant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 ioctlcmd=0xb300 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 ioctlcmd=0xb300 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { sys_rawio } for comm="tee-supplicant" capability=17 scontext=u:r:tee-supplicant:s0 tcontext=u:r:tee-supplicant:s0 tclass=capability permissive=1
avc: denied { sys_rawio } for comm="tee-supplicant" capability=17 scontext=u:r:tee-supplicant:s0 tcontext=u:r:tee-supplicant:s0 tclass=capability permissive=1
avc: denied { sys_rawio } for comm="tee-supplicant" capability=17 scontext=u:r:tee-supplicant:s0 tcontext=u:r:tee-supplicant:s0 tclass=capability permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/mmcblk1rpmb" dev="tmpfs" ino=21735 ioctlcmd=0xb301 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/mmcblk1rpmb" dev="tmpfs" ino=21735 ioctlcmd=0xb301 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/mmcblk1rpmb" dev="tmpfs" ino=21735 ioctlcmd=0xb301 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/mmcblk1rpmb" dev="tmpfs" ino=21735 ioctlcmd=0xb301 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
avc: denied { open } for comm="tee-supplicant" path="/sys/devices/platform/0.soc/34458000.sdhci/mmc_host/mmc1/mmc1:0001/cid" dev="sysfs" ino=44384 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
avc: denied { open } for comm="tee-supplicant" path="/sys/devices/platform/0.soc/34458000.sdhci/mmc_host/mmc1/mmc1:0001/cid" dev="sysfs" ino=44384 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
avc: denied { search } for comm="tee-supplicant" name="block" dev="tmpfs" ino=21511 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=dir permissive=1
avc: denied { search } for comm="tee-supplicant" name="block" dev="tmpfs" ino=21511 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=dir permissive=1
tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { open } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { open } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 ioctlcmd=0xb300 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 ioctlcmd=0xb300 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { sys_rawio } for comm="tee-supplicant" capability=17 scontext=u:r:tee-supplicant:s0 tcontext=u:r:tee-supplicant:s0 tclass=capability permissive=1
avc: denied { sys_rawio } for comm="tee-supplicant" capability=17 scontext=u:r:tee-supplicant:s0 tcontext=u:r:tee-supplicant:s0 tclass=capability permissive=1
avc: denied { sys_rawio } for comm="tee-supplicant" capability=17 scontext=u:r:tee-supplicant:s0 tcontext=u:r:tee-supplicant:s0 tclass=capability permissive=1
avc: denied { open } for comm="tee-supplicant" path="/sys/devices/platform/0.soc/34458000.sdhci/mmc_host/mmc1/mmc1:0001/cid" dev="sysfs" ino=44384 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
avc: denied { open } for comm="tee-supplicant" path="/sys/devices/platform/0.soc/34458000.sdhci/mmc_host/mmc1/mmc1:0001/cid" dev="sysfs" ino=44384 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
context=u:object_r:block_device:s0 tclass=dir permissive=1
avc: denied { read } for comm="tee-supplicant" name="mmcblk1" dev="tmpfs" ino=24601 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { read } for comm="tee-supplicant" name="mmcblk1" dev="tmpfs" ino=24601 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { open } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { open } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 ioctlcmd=0xb300 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/block/mmcblk1" dev="tmpfs" ino=24601 ioctlcmd=0xb300 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=1
avc: denied { sys_rawio } for comm="tee-supplicant" capability=17 scontext=u:r:tee-supplicant:s0 tcontext=u:r:tee-supplicant:s0 tclass=capability permissive=1
avc: denied { sys_rawio } for comm="tee-supplicant" capability=17 scontext=u:r:tee-supplicant:s0 tcontext=u:r:tee-supplicant:s0 tclass=capability permissive=1
avc: denied { sys_rawio } for comm="tee-supplicant" capability=17 scontext=u:r:tee-supplicant:s0 tcontext=u:r:tee-supplicant:s0 tclass=capability permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/mmcblk1rpmb" dev="tmpfs" ino=21735 ioctlcmd=0xb301 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
avc: denied { ioctl } for comm="tee-supplicant" path="/dev/mmcblk1rpmb" dev="tmpfs" ino=21735 ioctlcmd=0xb301 scontext=u:r:tee-supplicant:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86

二、把这个tee-supplicant.txt文件，放到android源码的路径android/external/selinux/prebuilts/bin目录下

android/external/selinux/prebuilts/bin$ ls
audit2allow  audit2why  avc.te  sediff  sediff.py  seinfo  seinfo.py  sesearch  sesearch.py  tee-supplicant.txt
1
2
3

三、执行如下命令

./audit2allow -i tee-supplicant.txt > avc.te
1

四、查看avc.te
默认打开发现是空的，有下面这么一句打印，提示需要执行source lunch

ANDROID_HOST_OUT not set. Have you run lunch?
1

执行一下source build/envsetup.sh lunch xxx后，再执行audit2allow 命令就可以了，自动生成的内容如下：

#============= tee-supplicant ==============
allow tee-supplicant block_device:blk_file { ioctl open read };
allow tee-supplicant block_device:dir search;
allow tee-supplicant device:chr_file { ioctl open read write };
allow tee-supplicant kernel:system syslog_read;
allow tee-supplicant kmsg_debug_device:chr_file { append getattr ioctl open read };
allow tee-supplicant self:capability sys_rawio;
allow tee-supplicant sysfs:file open;

1
2
3
4
5
6
7
8
9

为方便与大家及时交流，弄了一个微信公众号，微信请搜索“楼中望月”， 欢迎大家留言沟通~