How to stop to access /system/../ directory from user application in android

0
votes

I am working AOSP M version.

I have created a test directory in the system partition. like below, /system/test/

Only system applications can read the data from /system/test/ directory, presently the User applications also reading data from /system/test directory.

How can we stop reading data from user applications, only system applications read the data from /system/test/ directry.

I have done below steps :

Step1 : Created test_file in below location

android/vendor/xyz/prebuilts/bin/

Step2 : android/vendor/xyz/prebuilts/bin/Android.mk

include $(CLEAR_VARS)

LOCAL_MODULE := test_file

LOCAL_SRC_FILES := $(LOCAL_MODULE)

LOCAL_MODULE_CLASS := test

LOCAL_MODULE_PATH := $(TARGET_OUT)/test

include $(BUILD_PREBUILT)

When I have compiled the AOSP code , test_file generated in out directory android/out/target/product/abc/system/test_file

Step3 : Registered in file in file_contexts /android/vendor/xyz/abc/sepolicy/file_contexts

/system/test/test_file u:object_r:abc_test_file:s0

Step4 : Added below line in the path of android/vendor/abc/xyz/sepolicy/file.te

type abc_test_file, file_type;

Coipled the source code and flashed image into device ,

Executed below command in android device shell,

abc@123#ls /system/test/test_test -lZ
-rw-r--r-- root root u:object_r:abc_test_file:s0 test_file

Could you please suggest me , where I have done wrong.

1
androidandroid-sourceselinux

1 Answers

1
votes

You can change the DAC for /system/test. Look at example from google: device/google/sunfish/config.fs

[system/vendor/bin/loc_launcher]
mode: 0755
user:  AID_GPS
group: AID_GPS
caps: SETUID SETGID

And there is an doc about how to custom DAC.