1、简介
根据业务需要，需要系统自定义UID，设置相应的权限。
2、修改系统，自定义UI
1）、添加UID：
在src/LINUX/android/frameworks/base/core/java/android/os/Process.java中自定义int类型的，静态常量：MCWILL_UID
@@ -144,6 +144,7 @@ public class Process {
public static final int PACKAGE_INFO_GID = 1032;
+ public static final int MCWILL_UID = 1038;
2）、将UID添加到Setting中去：
目录在：src/LINUX/android/frameworks/base/services/java/com/android/server/pm/PackageManagerService.java
@@ -1129,7 +1129,8 @@ public class PackageManagerService extends IPackageManager.Stub {
mSettings.addSharedUserLPw("android.uid.shell", SHELL_UID,
+ mSettings.addSharedUserLPw("android.uid.mcwill", Process.MCWILL_UID,
+ ApplicationInfo.FLAG_SYSTEM|ApplicationInfo.FLAG_PRIVILEGED);
String separateProcesses = SystemProperties.get("debug.separate_processes");
if (separateProcesses != null && separateProcesses.length() > 0) {
3）、配置UID：
在src/LINUX/android/system/core/include/private/android_filesystem_config.h中进行配置
@@ -76,7 +76,7 @@
#define AID_SDCARD_PICS 1033
#define AID_SDCARD_AV 1034
#define AID_SDCARD_ALL 1035
+#define AID_MCWILL 1038
#define AID_SHELL 2000
#define AID_CACHE 2001
#define AID_DIAG 2002
@@ -123,6 +123,7 @@ static const struct android_id_info android_ids[] = {
{ "radio", AID_RADIO, },
{ "bluetooth", AID_BLUETOOTH, },
+ { "mcwill", AID_MCWILL, },
{ "graphics", AID_GRAPHICS, },
{ "input", AID_INPUT, },
{ "audio", AID_AUDIO, },
4）、设置权限：
<1>、/src/LINUX/android/device/qcom/sepolicy/Android.mk
@@ -11,4 +11,7 @@ BOARD_SEPOLICY_UNIOn :=
file.te
netd.te
octopusd.te
+ mcwill_app.te
<2>、 添加src/LINUX/android/device/qcom/sepolicy/mcwill_app.te：
allow mcwill_app init:unix_stream_socket { connectto };
allow mcwill_app socket_device:sock_file {create read write};
allow mcwill_app ratd:unix_stream_socket { connectto read write setopt };
allow system_app ratd:unix_stream_socket { connectto read write setopt };
#allow mcwill_app self:capability { net_admin };
allow mcwill_app system_data_file:dir {write add_name remove_name open search create};
allow mcwill_app system_data_file:file create_file_perms;
allow mcwill_app zygote:unix_stream_socket { getattr getopt };
#allow mcwill_app activity_service:service_manager { find };
#allow mcwill_app display_service:service_manager { find };
#allow mcwill_app network_management_service:service_manager { find };
allow mcwill_app system_data_file:dir { setattr };
allow mcwill_app mcwill_app:udp_socket {create ioctl getattr getopt};
allow mcwill_app device:sock_file {write};
#allow mcwill_app connectivity_service:service_manager { find };
#allow mcwill_app accessibility_service:service_manager { find };
#allow mcwill_app input_method_service:service_manager { find };
#allow mcwill_app surfaceflinger_service:service_manager { find };
#allow mcwill_app graphicsstats_service:service_manager { find };
#allow mcwill_app input_service:service_manager { find };
#allow mcwill_app notification_service:service_manager { find };
#allow mcwill_app textservices_service:service_manager { find };
#allow mcwill_app content_service:service_manager { find };
<3>、添加src/LINUX/android/external/sepolicy/mcwill_app.te：
type mcwill_app, domain;
app_domain(mcwill_app)
net_domain(mcwill_app)
<4>、src/LINUX/android/external/sepolicy/app.te修改内容：
@@ -125,7 +125,7 @@ allow appdomain self:rawip_socket create_socket_perms;
# Superuser capabilities.
# Only exception is sys_nice for binder, might not be necessary.
neverallow { appdomain -unconfineddomain } self:capability ~sys_nice;
-neverallow { appdomain -unconfineddomain } self:capability2 *;
+neverallow { appdomain -unconfineddomain -mcwill_app -ratd } self:capability2 *;
# Block device access.
neverallow { appdomain -unconfineddomain } dev_type:blk_file { read write };
@@ -169,4 +169,4 @@ neverallow { appdomain -unconfineddomain } system_file:dir_file_class_set write;
# specified in file_contexts. Define a different type for portions
# that should be writable by apps.
# Exception for system_app for Settings.
-neverallow { appdomain -unconfineddomain -system_app } system_data_file:dir_file_class_set write;
+neverallow { appdomain -unconfineddomain -system_app -mcwill_app} system_data_file:dir_file_class_set write;
<5>、src/LINUX/android/external/sepolicy/seapp_contexts修改内容：
@@ -44,3 +44,4 @@ user=_app seinfo=media domain=media_app type=platform_app_data_file
user=_app seinfo=release domain=release_app type=platform_app_data_file
user=_isolated domain=isolated_app
user=shell domain=shell type=shell_data_file
+user=mcwill seinfo=platform domain=mcwill_app