[Android Q&A, Help & Troubleshooting] Pachacouti:
And I found this somewhere so will leave it here for those who want true root on the ulefone device, I'm too sore with slow paralysis to keep working at this...

Android Q system_app writes persist.sys by default. The system property SEliux permission

When debugging Settings.apk by myself.

It was discovered that as a platform system signature application, there was no permission to sign a custom persist.st_nfc_debug system property.

It can be modified to the name beginning with persist.sys.

Although in the end, I said:

persist.st_nfc_debug u:eek:bject_r:system_prop:s0

Get it done.

why is that?

This step by step tracks SeLinux permission protection in Android.

The same is because the system authorizes persist.sys. by default and classifies it into system_prop.

alps/system/sepolicy/private/property_contexts

persist.log.tag u:eek:bject_r:log_tag_prop:s0

persist.mmc. u:eek:bject_r:mmc_prop:s0

persist.netd.stable_secret u:eek:bject_r:netd_stable_secret_prop:s0

persist.sys. u:eek:bject_r:system_prop:s0

persist.sys.safemode u:eek:bject_r:safemode_prop:s0

persist.sys.fflag.override.settings_dynamic_system u:eek:bject_r:dynamic_system_prop:s0

So where is system_prop defined?

It belongs to property_type and core_property_type.

alps/system/sepolicy/public/property.te

79 type shell_prop, property_type, core_property_type;

80 type system_boot_reason_prop, property_type;

81 type system_prop, property_type, core_property_type;

82 type system_radio_prop, property_type, core_property_type;

83 type system_trace_prop, property_type;

84 type test_boot_reason_prop, property_type;

Authorization, the last line below, set_prop(system_app, system_prop).

alps/system/sepolicy/private/system_app.te

7 typeattribute system_app coredomain;

8

9 app_domain(system_app)

10 net_domain(system_app)

11 binder_service(system_app)

12

13 # android.ui and system.ui

14 allow system_app rootfs:dir getattr;

15

16 # Read and write /data/data subdirectory.

17 allow system_app system_app_data_file:dir create_dir_perms;

18 allow system_app system_app_data_file:{ file lnk_file } create_file_perms;

33 # Write to properties

34 set_prop(system_app, bluetooth_a2dp_offload_prop)

35 set_prop(system_app, bluetooth_audio_hal_prop)

36 set_prop(system_app, bluetooth_prop)

37 set_prop(system_app, debug_prop)

38 set_prop(system_app, system_prop)

So where is this set_prop sacred?

alps/system/sepolicy/public/te_macros

305 #####################################

306 # set_prop(sourcedomain, targetproperty)

307 # Allows source domain to set the

308 # targetproperty.

309 #

310 define(`set_prop', `

311 unix_socket_connect($1, property, init)

312 allow $1 $2:property_service set;

313 get_prop($1, $2)

314 ')

315

316 #####################################

317 # get_prop(sourcedomain, targetproperty)

318 # Allows source domain to read the

319 # targetproperty.

320 #

321 define(`get_prop', `

322 allow $1 $2:file { getattr open read map };

323 ')

It is a general method of declaration.

So according to this meaning, you can piece together the following permission statement:

allow system_app system_prop:property_service set;

Use the real phone to enter the mobile phone directory to find and verify is the king:

5032E:/system/etc/selinux # grep -rni "allow system_app system_prop".

./Plat_sepolicy.cil:19108:(allow system_app system_prop (property_service (set)))

./plat_sepolicy.cil:19109:(allow system_app system_prop ( file (read getattr map open)))

5032E:/system/etc/selinux #

summary:

Just because the Android compilation system has assigned relevant permissions by default, it can be used directly, and custom ones require additional authorization.

Additional tips:

Before adding the compilation in the alps project, the .te file will be compiled and imported into the cil file.

Android Q currently has cil files:

./vendor/etc/selinux/vendor_sepolicy.cil

./vendor/etc/selinux/plat_pub_versioned.cil

./system/etc/selinux/mapping/27.0.cil

./system/etc/selinux/mapping/29.0.cil

./system/etc/selinux/mapping/26.0.cil

./system/etc/selinux/mapping/28.0.cil

./system/etc/selinux/plat_sepolicy.cil

The property_contexts file will be imported into the plat_property_contexts file.

./system/etc/selinux/plat_property_contexts:61:persist.sys. u:eek:bject_r:system_prop:s0

./system/etc/selinux/plat_property_contexts:62:persist.sys.safemode u:eek:bject_r:safemode_prop:s0

./system/etc/selinux/plat_property_contexts:63:persist.sys.theme u:eek:bject_r:theme_prop:s0

./system/etc/selinux/plat_property_contexts:64:persist.sys.fflag.override.settings_dynamic_system u:eek:bject_r:dynamic_system_prop:s0

./system/etc/selinux/plat_property_contexts:66:persist.sys.audit_safemode u:eek:bject_r:safemode_prop:s0

./system/etc/selinux/plat_property_contexts:81:persist.sys.boot.reason u:eek:bject_r:last_boot_reason_prop:s0

./system/etc/selinux/plat_property_contexts:346:persist.sys.dalvik.vm.lib.2 u:eek:bject_r:exported2_system_prop:s0 exact string

./system/etc/selinux/plat_property_contexts:347:persist.sys.media.avsync u:eek:bject_r:exported2_system_prop:s0 exact bool

And all the files ending with _contexts in Android Q are:

./vendor/etc/selinux/vndservice_contexts

./vendor/etc/selinux/vendor_file_contexts

./vendor/etc/selinux/vendor_hwservice_contexts

./vendor/etc/selinux/vendor_property_contexts

./vendor/etc/selinux/vendor_seapp_contexts

./system/etc/selinux/plat_file_contexts

./system/etc/selinux/plat_service_contexts

./system/etc/selinux/plat_hwservice_contexts

./system/etc/selinux/plat_seapp_contexts

./system/etc/selinux/plat_property_contexts

./sys/fs/selinux/initial_contexts

The service corresponding to the NFC module is in ./vendor/etc/selinux/vendor_file_contexts:

5032E:/ # cat ./vendor/etc/selinux/vendor_file_contexts | grep nfc

/(vendor|system/vendor)/bin/hw/android\.hardware\.nfc@1\.1-service u:eek:bject_r:hal_nfc_default_exec:s0

/(vendor|system/vendor)/bin/hw/android\.hardware\.nfc@1\.2-service u:eek:bject_r:hal_nfc_default_exec:s0

/(vendor|system/vendor)/bin/hw/android\.hardware\.nfc@1\.0-service u:eek:bject_r:hal_nfc_default_exec:s0

/(system\/vendor|vendor)/bin/hw/android\.hardware\.nfc@1\.1-service-st u:eek:bject_r:hal_nfc_default_exec:s0

/data/nfc_socket(/.*)? u:eek:bject_r:nfc_socket:s0

/data/vendor/nfc_socket(/.*)? u:eek:bject_r:vendor_nfc_socket:s0

/dev/st21nfc u:eek:bject_r:st21nfc_device:s0

5032E:/ #