1. type=1400 audit(0.0:4257): 
  2. avc: denied { read write } for name="spidev2" 
  3. dev="tmpfs" 
  4. ino=1309 
  5. scontext=u:r:untrusted_app:s0:c105,c256,c512,c768 
  6. tcontext=u:object_r:spi_device2:s0 
  7. tclass=chr_file 
  8. permissive=1 
  9. app=em.digit.metahub

device/mediatek/sepolicy/basic/non_plat

1、修改 file_contexts

  1. /dev/spidev1(/.*)? u:object_r:spi_device1:s0
  2. /dev/spidev2(/.*)? u:object_r:spi_device2:s0
  3. /dev/spidev3(/.*)? u:object_r:spi_device3:s0

2、修改进程（system_app、platform_app、untrusted_app、factory等 .te 文件）

  1. allow system_app spi_device1:chr_file { read write ioctl open };
  2. allow system_app spi_device2:chr_file { read write ioctl open };
  3. allow system_app spi_device3:chr_file { read write ioctl open };

其中，第二部分需要替换为具体的进程名（即对应的文件名）

彻底关闭SELinux

  1. /// system/core/init/selinux.cpp
  3. bool IsEnforcing() {
  4.     return false;        // 新增，直接返回false，下方代码注释会编译报错
  5.     if (ALLOW_PERMISSIVE_SELINUX) {
  6.         return StatusFromCmdline() == SELINUX_ENFORCING;
  7.     }
  8.     return true;
  9. }
  1. ### vendor/mediatek/proprietary/bootable/bootloader/lk/platform/mt6761/rules.mk
  3. # choose one of following value -> 1: disabled/ 2: permissive /3: enforcing
  4. SELINUX_STATUS := 1        # 这里3改1