<span style="color:rgb(19,37,60); font-family:宋体,verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; line-height:19px; background-color:rgb(245,245,245)">SELinux在系统级增加了强制访问控制，每个VFS node均在Security Server的控制之中。IPC是系统的重要功能，未经授权的使用均会给系统带来安全隐患，所以本文重点对SEAndroid在IPC中安全功能进行分析，作为Android的主要通信工具socket和binder，在SEAndroid均增加了权限的控制，下面分别对两个进行简要的分析。<span style="color:rgb(19,37,60); font-family:宋体,verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; line-height:19px; background-color:rgb(245,245,245)">由于Android行业化应用越来愈多，对SE的研究越来越多了，例如trustdroid。</span><br style="color:rgb(19,37,60); font-family:宋体,verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; line-height:19px; background-color:rgb(245,245,245)"> <span style="color:rgb(19,37,60); font-family:宋体,verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; line-height:19px; background-color:rgb(245,245,245)">SE目前实现太复杂了，另外仅提供kernel的MAC，框架层的也需要啊。类似的机制已经有厂商实现了，如三星S4 Knox！ </span></span>
<br style="color:rgb(19,37,60); font-family:宋体,verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; line-height:19px; background-color:rgb(245,245,245)">
<span style="color:rgb(19,37,60); font-family:宋体,verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; line-height:19px; background-color:rgb(245,245,245)">一、 binder</span>
<br style="color:rgb(19,37,60); font-family:宋体,verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; line-height:19px; background-color:rgb(245,245,245)">
<span style="color:rgb(19,37,60); font-family:宋体,verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; line-height:19px; background-color:rgb(245,245,245)">为了增加binder的权限控制，首先在kernel的policy中增加一个class，并且增加了几个方法，</span>
<br style="color:rgb(19,37,60); font-family:宋体,verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; line-height:19px; background-color:rgb(245,245,245)">
<div style="color:rgb(19,37,60); font-family:宋体,verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; line-height:19px; background-color:rgb(245,245,245); margin:5px 20px 20px">
<div class="smallfont" style="line-height:normal; margin-bottom:2px">
代码:
</div>
<pre dir="ltr" style="margin-top:0px; margin-bottom:0px; background-color:rgb(222,223,223); padding:6px; border:1px inset; width:700px; overflow:auto">{ "binder", { "impersonate", "call", "set_context_mgr", "transfer", "receive"} },
</pre>
</div>
<span style="color:rgb(19,37,60); font-family:宋体,verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; line-height:19px; background-color:rgb(245,245,245)">Impersonate：该进程是否可以代表另一个进程使用binder</span>
<br style="color:rgb(19,37,60); font-family:宋体,verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; line-height:19px; background-color:rgb(245,245,245)">
<span style="color:rgb(19,37,60); font-family:宋体,verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; line-height:19px; background-color:rgb(245,245,245)">Call：该进程是否可以调用另一个进程</span>
<br style="color:rgb(19,37,60); font-family:宋体,verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; line-height:19px; background-color:rgb(245,245,245)">
<span style="color:rgb(19,37,60); font-family:宋体,verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; line-height:19px; background-color:rgb(245,245,245)">Set_context_mgr：是否可以将自己注册成Context Manager</span>
<br style="color:rgb(19,37,60); font-family:宋体,verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; line-height:19px; background-color:rgb(245,245,245)">
<span style="color:rgb(19,37,60); font-family:宋体,verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; line-height:19px; background-color:rgb(245,245,245)">Transfer：是否可以传递某类型的binder引用到其他进程</span>
<br style="color:rgb(19,37,60); font-family:宋体,verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; line-height:19px; background-color:rgb(245,245,245)">
<span style="color:rgb(19,37,60); font-family:宋体,verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; line-height:19px; background-color:rgb(245,245,245)">Receive：是否可以接收某类型binder引用</span>
<br style="color:rgb(19,37,60); font-family:宋体,verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; line-height:19px; background-color:rgb(245,245,245)">
<span style="color:rgb(19,37,60); font-family:宋体,verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; line-height:19px; background-color:rgb(245,245,245)">对binder调用规则的配置有些繁琐，所以在TE中使用宏进行配置binder_use、 |
|
转播
