SELinux rules for i2c files in sysfs on Android

Question

I created a kernel driver as a loadable module for one of my I2C devices. The driver creates several sysfs files in the corresponding I2C folder (/sys/devices/i2c/i2c-0/0-0008/) , using the instance through the new_device file (/sys/devices/i2c/i2c-0/new_device) .

Lollipop forcibly uses SELinux, so I need to create rules for my applications that need access to the device sysfs file. These are mainly system applications (they fall into the platform_app definition in Android SELinux). The problem is that applications in any application domain are not allowed to write sysfs files:

 neverallow { appdomain -bluetooth -nfc } sysfs:dir_file_class_set write; 

Therefore, I decided to create a file context exclusively for my device:

 file_context: /sys/devices/i2c-0/0-0008(/.*)? u:object_r:sysfs_mydeviceic:s0 

The result is interesting: the default driver files and folders, such as name and uevent, etc., get the correct context, but not the files created by the sysfs part of the I2C driver:

 root@android :/sys/devices/i2c-0/0-0008 # ls -Z --w--w--w- root root u:object_r:sysfs:s0 data lrwxrwxrwx root root u:object_r:sysfs_mydeviceic:s0 driver -> ../../../bus/i2c/drivers/mydevice -rw-rw-rw- root root u:object_r:sysfs:s0 locked -r--r--r-- root root u:object_r:sysfs_mydeviceic:s0 modalias -r--r--r-- root root u:object_r:sysfs_mydeviceic:s0 name drwxr-xr-x root root u:object_r:sysfs_mydeviceic:s0 power -rw-rw-rw- root root u:object_r:sysfs:s0 protection -rw-rw-rw- root root u:object_r:sysfs:s0 state lrwxrwxrwx root root u:object_r:sysfs_mydeviceic:s0 subsystem -> ../../../bus/i2c -rw-r--r-- root root u:object_r:sysfs_mydeviceic:s0 uevent 

I am looking for help how to continue this problem: if I still want to convert the sysfs context to sysfs_mydeviceic for the rest of the files, then how to do it? Or is there another way to enable applications to write to sysfs files?

Answer 1

I ran into the same problem when porting some drivers to Android 5. It seems that not all sysfs files fit in the correct selinux context. This seems to only happen for dynamic devices, although new_device .

The solution for me was to call selinux to restore the file contexts using restorecon(8) . In the same script that you use to create an instance of your device, run the following command:

 restorecon -r /sys/devices/i2c-2/ 

The -r flag tells restorecon to work recursively. If you prefer, you can also list each file individually.

If you use init scripts for Android (e.g. /init.rc ), another command is available:

 restorecon_recursive /sys/devices/i2c-2/ 

Again, there is a restorecon command that restores only individual files. See the SEAndroid documentation for more details .