class_reset main +service suproce /system/bin/suproce.sh + class main + user root + group root + oneshot + seclabel u:object_r:suproce_exec:s0 + + on property:sys.boot_completed=1 + start suproce bootchart stop
system/extras/su/suproce.sh
1 2 3 4 5 6 7 8
#!/system/bin/sh
mount -o rw,remount /system chmod 06755 su su --daemon
#hidl process merging /(system\/vendor|vendor)/bin/hw/merged_hal_service u:object_r:merged_hal_service_exec:s0 + +#suproce +/system/bin/suproce.sh u:object_r:suproce_exec:s0
此处写法有变动，suproce.te 中要加 system_file_type，不然编译时报错
1 2 3
out/target/product/k62v1_64_bsp/obj/ETC/sepolicy_tests_intermediates/sepolicy_tests )" The following types on /system/ must be associated with the "system_file_type" attribute: suproce_exec checkpolicy: error(s) encountered while parsing configuration
libsepol.report_assertion_extended_permissions: neverallowxperm on line 335 of system/sepolicy/public/domain.te (or line 11735 of policy.conf) violated by allow aee_aed suproce_exec:file { ioctl }; libsepol.report_assertion_extended_permissions: neverallowxperm on line 335 of system/sepolicy/public/domain.te (or line 11735 of policy.conf) violated by allow crash_dump suproce_exec:file { ioctl }; libsepol.check_assertions: 2 neverallow failures occurred Error while expanding policy
libsepol.report_assertion_extended_permissions: neverallowxperm on line 335 of system/sepolicy/public/domain.te (or line 11642 of policy.conf) violated by allow aee_aed suproce_exec:file { ioctl }; libsepol.report_assertion_extended_permissions: neverallowxperm on line 335 of system/sepolicy/public/domain.te (or line 11642 of policy.conf) violated by allow crash_dump suproce_exec:file { ioctl }; libsepol.check_assertions: 2 neverallow failures occurred Error while expanding policy
# All ioctls on file-like objects (except chr_file and blk_file) and # sockets must be restricted to a whitelist. # neverallowxperm * *:{ dir notdevfile_class_set socket_class_set blk_file } ioctl { 0 };
@@ -166,7 +168,9 @@ staticconststructfs_path_configandroid_files[] = { // the following two files are INTENTIONALLY set-uid, but they // are NOT included on user builds. { 06755, AID_ROOT, AID_ROOT, 0, "system/xbin/procmem" }, - { 04750, AID_ROOT, AID_SHELL, 0, "system/xbin/su" }, + { 06755, AID_ROOT, AID_SHELL, 0, "system/bin/su" },
// the following files have enhanced capabilities and ARE included // in user builds.
@@ -133,9 +133,10 @@ intorange_state_warning(void) video_clean_screen(); video_set_cursor(video_get_rows() / 2, 0); - video_printf(title_msg); - video_printf("Your device has been unlocked and can't be trusted\n"); - video_printf("Your device will boot in 5 seconds\n"); + //20191206 annotaion + // video_printf(title_msg); + // video_printf("Your device has been unlocked and can't be trusted\n"); + // video_printf("Your device will boot in 5 seconds\n"); mtk_wdt_restart(); mdelay(5000); mtk_wdt_restart();
C:>adb disable-verity Successfully disabled verity Now reboot your device for settings to take effect
C:>adb reboot
C:>adb root
C:>adb remount /system/bin/remount exited with status 2 remount failed
=userdebug==========
C:>adb root
C:>adb remount E Skipping /system E Skipping /vendor E Skipping /product W No partitions to remount /system/bin/remount exited with status 7 remount failed
C:>adb disable-verity Device is locked. Please unlock the device first
+++ b/alps/frameworks/base/services/usb/java/com/android/server/usb/UsbDeviceManager.java @@ -995,6 +995,10 @@ public class UsbDeviceManager implements ActivityTaskManagerInternal.ScreenObser } protected void finishBoot() { + android.service.oemlock.OemLockManager mOemLockManager + = (android.service.oemlock.OemLockManager) mContext.getSystemService(Context.OEM_LOCK_SERVICE); + mOemLockManager.setOemUnlockAllowedByUser(true); + if (mBootCompleted && mCurrentUsbFunctionsReceived && mSystemReady) { if (mPendingBootBroadcast) { updateUsbStateBroadcastIfNeeded(getAppliedFunctions(mCurrentFunctions));
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
C:>adb root
C:>adb remount W DM_DEV_STATUS failed for scratch: No such device or address E [liblp]No device named scratch [liblp]Partition scratch will resize from 0 bytes to 1315950592 bytes [liblp]Updated logical partition table at slot 0 on device /dev/block/by-name/super [libfs_mgr]Created logical partition scratch on device /dev/block/dm-3 [libfs_mgr]superblock s_max_mnt_count:65535,/dev/block/dm-3 [libfs_mgr]__mount(source=/dev/block/dm-3,target=/mnt/scratch,type=ext4)=0: Success Using overlayfs for /system Using overlayfs for /vendor Using overlayfs for /product [libfs_mgr]__mount(source=overlay,target=/system,type=overlay,upperdir=/mnt/scratch/overlay/system/upper)=0 [libfs_mgr]__mount(source=overlay,target=/vendor,type=overlay,upperdir=/mnt/scratch/overlay/vendor/upper)=0 [libfs_mgr]__mount(source=overlay,target=/product,type=overlay,upperdir=/mnt/scratch/overlay/product/upper)=0 remount succeeded
