Android 11 system_server 读写 Sdcard

平台

RK3566 + Android 11

由于Android 11之前的版本只需要按照常规配置后,system_server就可以正常读写sdcard

Android11之前的配置大同小异，链接如下：

【framework】framework中为systemserver添加权限_yingxian_Fei的博客-CSDN博客

Android 11 中, 在解决了组权限 及 SELINUX权限后, 发现仍然无法正常访问：

这里有两种方式可以达成要求：

1.第一种方式：暴力修改：（实际项目不可取）kernel/fs/namei.c 最终输出 EACCES的函数

//记录下调用流程, 内核中输出LOG:
//[   59.897756] do_sys_open.c /mnt/sdcard/test.png flag=131649 mode=438
//[   59.897805] namei.c path_openat /mnt/sdcard/test.png
//[   59.897807] namei.c link_path_walk /mnt/sdcard/test.png
//[   59.897819] namei.c do_inode_permission
//[   59.897829] namei.c acl_permission_check 1000, 0
//[   59.897839] namei.c generic_permission ret=0
//[   59.897848] namei.c inode_permission2 retval=0
//[   59.897860] namei.c may_lookup err=0
/*
 * This does the basic permission checking
 */
static int acl_permission_check(struct inode *inode, int mask)
{
	unsigned int mode = inode->i_mode;

	if (likely(uid_eq(current_fsuid(), inode->i_uid)))
		mode >>= 6;
	else {
		if (IS_POSIXACL(inode) && (mode & S_IRWXG)) {
			int error = check_acl(inode, mask);
			if (error != -EAGAIN)
				return error;
		}

		if (in_group_p(inode->i_gid))
			mode >>= 3;
	}

	/*
	 * If the DACs are ok we don't need any capability check.
	 */
	if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0)
		return 0;
-  //return -EACCES;
+  return 0;  
} 

2.第二种方式：修改frameworks/base/core/java/com/android/internal/os/ZygoteInit.java

   /**
     * Prepare the arguments and forks for the system server process.
     *
     * @return A {@code Runnable} that provides an entrypoint into system_server code in the child
     * process; {@code null} in the parent.
     */
    private static Runnable forkSystemServer(String abiList, String socketName,
            ZygoteServer zygoteServer) {
        long capabilities = posixCapabilitiesAsBits(
                OsConstants.CAP_IPC_LOCK,
                OsConstants.CAP_KILL,
                OsConstants.CAP_NET_ADMIN,
                OsConstants.CAP_NET_BIND_SERVICE,
                OsConstants.CAP_NET_BROADCAST,
                OsConstants.CAP_NET_RAW,
                OsConstants.CAP_SYS_MODULE,
                OsConstants.CAP_SYS_NICE,
                OsConstants.CAP_SYS_PTRACE,
                OsConstants.CAP_SYS_TIME,
                OsConstants.CAP_SYS_TTY_CONFIG,
                OsConstants.CAP_WAKE_ALARM,
                OsConstants.CAP_BLOCK_SUSPEND,
+               OsConstants.CAP_CHOWN,
+               OsConstants.CAP_DAC_OVERRIDE,
+               OsConstants.CAP_DAC_READ_SEARCH
        );

备注：对于在init.rc文件启动的hal层相关服务按如下配置即可