System Server Domain

本文面向已经读过 Init Domain、Binder调用源码地图 和 公共与私有策略 的读者。本文追踪 Android 17 system_server 的 SELinux 进入路径、权限 owner、服务启动消费者和失败边界，不把几十个 Java 服务的业务逻辑混成一张权限清单。

1. 域模型

1.1 类型声明

源码文件：system/sepolicy/public/system_server.te

type system_server, domain;
type system_server_tmpfs, file_type, mlstrustedobject;
type system_server_wrapfd, mlstrustedobject;

源码文件：system/sepolicy/private/system_server.te

typeattribute system_server coredomain;
typeattribute system_server mlstrustedsubject;
typeattribute system_server remote_provisioning_service_server;
typeattribute system_server scheduler_service_server;
typeattribute system_server sensor_service_server;
typeattribute system_server stats_service_server;
typeattribute system_server bpfdomain;

tmpfs_domain(system_server);
userfaultfd_use(system_server);

public 只声明 system_server 及其 tmpfs/wrapfd 类型；private 把它加入 coredomain、mlstrustedsubject 和服务属性，并展开 tmpfs/userfaultfd 权限。

1.2 startup域

源码文件：system/sepolicy/private/system_server_startup.te

type system_server_startup, domain, coredomain;
type system_server_startup_tmpfs, file_type;
tmpfs_domain(system_server_startup);

allow system_server_startup self:process execmem;
allow system_server_startup system_server_startup_tmpfs:file { execute read write open map };
allow system_server_startup apex_art_data_file:dir r_dir_perms;
allow system_server_startup apex_art_data_file:file { r_file_perms execute };
allow system_server_startup self:process setcurrent;
allow system_server_startup system_server:process dyntransition;
allow system_server_startup zygote:process sigchld;

startup 域是 fork 后、Java SystemServer 主体运行前的过渡 owner。它拥有 ART/JIT 和 boot image 读取权限，也拥有 setcurrent/dyntransition；最终 system_server 不应被视为 startup 权限的继承者。

2. 进入路径

2.1 zygote规则

源码文件：system/sepolicy/private/zygote.te

init_daemon_domain(zygote);
tmpfs_domain(zygote);
allow zygote self:process setcurrent;
allow zygote system_server_startup:process dyntransition;
allow zygote appdomain:process dyntransition;
allow zygote webview_zygote:process dyntransition;
allow zygote app_zygote:process dyntransition;

zygote 可以切到 startup、app、webview 和 app_zygote，但没有任意 dyntransition 权限。目标集合由 policy 明确列出。

2.2 Native切换

源码文件：frameworks/base/core/jni/com_android_internal_os_Zygote.cpp

const char* se_info_ptr = se_info.has_value() ? se_info.value().c_str() : nullptr;

if (selinux_android_setcontext(
        uid, is_system_server, se_info_ptr, nice_name_ptr) == -1) {
    fail_fn(CREATE_ERROR(
        "selinux_android_setcontext(%d, %d, \"%s\", \"%s\") failed",
        uid, is_system_server, se_info_ptr, nice_name_ptr));
}

if (is_system_server) {
    env->CallStaticVoidMethod(
            gZygoteClass, gCallPostForkSystemServerHooks, runtime_flags);

    // Final process label after the startup phase.
    static const char* kSystemServerLabel = "u:r:system_server:s0";
    if (selinux_android_setcon(kSystemServerLabel) != 0) {
        fail_fn(CREATE_ERROR("selinux_android_setcon(%s)", kSystemServerLabel));
    }
}

is_system_server 分支先执行 selector 相关的 setcontext，再调用 setcon 固定标签。任一失败通过 fail_fn 终止 child，Java 服务不会在错误 domain 中继续运行。

2.3 fork与早死检测

源码文件：frameworks/base/core/jni/com_android_internal_os_Zygote.cpp

pid_t pid = zygote::ForkCommon(env, true,
                               fds_to_close,
                               fds_to_ignore,
                               true);
if (pid == 0) {
    SpecializeCommon(env, uid, gid, gids, runtime_flags, rlimits,
                     permitted_capabilities, effective_capabilities,
                     0, MOUNT_EXTERNAL_DEFAULT, nullptr, nullptr, true,
                     false, nullptr, nullptr, false,
                     nullptr, nullptr, false, false, false);
} else if (pid > 0) {
    ALOGI("System server process %d has been created", pid);
    gSystemServerPid = pid;
    int status;
    if (waitpid(pid, &status, WNOHANG) == pid) {
        ALOGE("System server process %d has died. Restarting Zygote!", pid);
        RuntimeAbort(env, __LINE__,
                     "System server process has died. Restarting Zygote!");
    }
}

父 zygote 保存 pid 并立即 WNOHANG 检查 child。system_server 不传 app data isolation list，并使用单独的 capability 与 selector 路径。

3. 服务启动

3.1 run阶段

源码文件：frameworks/base/services/java/com/android/server/SystemServer.java

try {
    t.traceBegin("StartServices");
    if (SystemProperties.getBoolean("sys.system_server_inherit_rt", false)) {
        Binder.setGlobalInheritRt(true);
    }
    startBootstrapServices(t);
    startCoreServices(t);
    startOtherServices(t);
    startApexServices(t);
    updateWatchdogTimeout(t);
    CriticalEventLog.getInstance().logSystemServerStarted();
} catch (Throwable ex) {
    Slog.e("System", "Failure starting system services", ex);
    throw ex;
} finally {
    t.traceEnd();
}

四个 start 阶段共享 system_server domain，但有严格依赖顺序。任一阶段抛出 Throwable 都离开正常启动路径。

3.2 bootstrap与core

源码文件：frameworks/base/services/java/com/android/server/SystemServer.java

private void startBootstrapServices(@NonNull TimingsTraceAndSlog t) {
    t.traceBegin("startBootstrapServices");
    Watchdog watchdog = Watchdog.getInstance();
    watchdog.start();
    ServiceManager.addService(
            Context.PLATFORM_COMPAT_SERVICE,
            new PlatformCompat(mSystemContext));
    mSystemServiceManager.startService(FileIntegrityService.class);
    Installer installer = mSystemServiceManager.startService(Installer.class);
    t.traceEnd();
}

private void startCoreServices(@NonNull TimingsTraceAndSlog t) {
    t.traceBegin("startCoreServices");
    mSystemServiceManager.startService(SystemConfigService.class);
    mSystemServiceManager.startService(BatteryService.class);
    mSystemServiceManager.startService(UsageStatsService.class);
    mSystemServiceManager.startService(BinderCallsStatsService.LifeCycle.class);
    t.traceEnd();
}

bootstrap 的 owner 是 SystemServer/SystemServiceManager；Installer 早于依赖 app data 的服务，PlatformCompat 早于读取兼容状态的服务。core 服务继续通过同一个 owner 注册 LocalServices 或 Binder service。

3.3 服务启动时序

4. Binder与HAL

4.1 Binder宏

源码文件：system/sepolicy/private/system_server.te、system/sepolicy/private/te_macros

binder_use(system_server)
binder_service(system_server)
binder_call(system_server, appdomain)
binder_call(system_server, artd)
binder_call(system_server, installd)
binder_call(system_server, netd)
binder_call(system_server, statsd)
binder_call(system_server, vold)
binder_call(system_server, wificond)

源码文件：system/sepolicy/private/te_macros

define(\`binder_call', \`
  allow $1 $2:binder { call transfer };
  allow $2 $1:binder { call transfer };
  allow $1 $2:fd use;
  allow $2 $1:fd use;
')

binder_call 只生成 binder call/transfer 和 fd use；service_manager find/add、binder device ioctl 仍需独立规则。

4.2 ServiceManager

源码文件：system/sepolicy/private/system_server.te

binder_service(system_server)
add_service(system_server, system_server_service);

allow system_server artd_service:service_manager find;
allow system_server batteryproperties_service:service_manager find;
allow system_server installd_service:service_manager find;
allow system_server keystore_service:service_manager find;
allow system_server netd_service:service_manager find;
allow system_server surfaceflinger_service:service_manager find;
allow system_server vold_service:service_manager find;

system_server 注册自己的 system_server_service，并查找明确列出的服务 type。Binder call 与 service_manager find 是两套边。

4.3 HAL客户端

源码文件：system/sepolicy/private/system_server.te

hal_client_domain(system_server, hal_allocator)
hal_client_domain(system_server, hal_audio)
hal_client_domain(system_server, hal_bluetooth)
hal_client_domain(system_server, hal_graphics_allocator)
hal_client_domain(system_server, hal_keymint)
hal_client_domain(system_server, hal_power)
hal_client_domain(system_server, hal_sensors)
hal_client_domain(system_server, hal_thermal)
hal_client_domain(system_server, hal_wifi)
hal_client_domain(system_server, hal_wifi_supplicant)

hal_client_domain 通过 HAL attribute 建立 hwservice/hwbinder 访问关系；没有对应 attribute 的 HAL 仍可能在 find 或 call 阶段失败。

5. 资源与约束

5.1 进程和文件

源码文件：system/sepolicy/private/system_server.te

allow system_server zygote:fd use;
allow system_server zygote:process sigchld;
allow system_server system_server_startup:fd use;
allow system_server system_server_startup_tmpfs:file { read write map };
allow system_server appdomain:process { getpgid sigkill signal signull };
allow system_server appdomain:process { getsched setsched };
r_dir_file(system_server, domain);

这些规则分别服务于 startup 资源交接、进程杀死/调度和 ProcessCpuTracker 读取 proc。它们不意味着 system_server 可以再次 dyntransition 或执行所有 domain 文件。

5.2 网络与设备

源码文件：system/sepolicy/private/system_server.te

net_domain(system_server)
allowxperm system_server self:udp_socket ioctl priv_sock_ioctls;
allow system_server appdomain:tcp_socket ioctl;
allow system_server gpu_device:chr_file rw_file_perms;
allow system_server input_device:chr_file rw_file_perms;
allow system_server video_device:chr_file rw_file_perms;
allow system_server tun_device:chr_file rw_file_perms;

通用网络宏与 ioctl 白名单配合；GPU/input/video/tun 是具体设备 type，不能由“system_server 是核心域”推导出任意设备访问。

5.3 neverallow

源码文件：system/sepolicy/private/system_server.te

neverallow system_server {
    domain -clatd -crash_dump -perfetto -trace_redactor
}:process transition;
neverallow system_server *:process dyntransition;
neverallow system_server { sdcard_type fuse }:dir { open read write };
neverallow system_server { sdcard_type fuse }:file rw_file_perms;
neverallow system_server system_server_tmpfs:file execute;
neverallow system_server system_server:memfd_file execute;
neverallow system_server *:process ptrace;

system_server 只能在明确例外中 transition 到 clatd、crash_dump、perfetto、trace_redactor；它自身完全禁止 dyntransition。neverallow 在编译期约束宏展开后的最终规则。

6. 崩溃恢复

6.1 zygote检测

源码文件：frameworks/base/core/jni/com_android_internal_os_Zygote.cpp

if (waitpid(pid, &status, WNOHANG) == pid) {
    ALOGE("System server process %d has died. Restarting Zygote!", pid);
    RuntimeAbort(env, __LINE__,
                 "System server process has died. Restarting Zygote!");
}

这只覆盖 system_server child 在 fork 后立即死亡；长期运行的 crash 还会进入 init/zygote service 恢复、crash_dump 和日志链路。SELinux 只提供 crash_dump 等所需的最小例外。

6.2 启动异常

源码文件：frameworks/base/services/java/com/android/server/SystemServer.java

} catch (Throwable ex) {
    Slog.e("System", "******************************************");
    Slog.e("System", "************ Failure starting system services", ex);
    throw ex;
} finally {
    t.traceEnd();
}

服务启动失败会向上抛出 Throwable；SystemServer 不会把半初始化服务集合标记为 ready。Watchdog 和 CriticalEventLog 的“已启动”记录只有在完整阶段结束后才写入。

7. 测试与排障

7.1 静态策略查询

# Check the running labels of zygote and system_server.
adb shell 'ps -AZ | grep -E "zygote|system_server"'

# Locate dyntransition and neverallow boundaries.
rg -n 'system_server_startup|neverallow system_server .*process' \
  system/sepolicy/private

# Separate Binder class rules from service_manager rules.
sesearch -A -s system_server -c binder
sesearch -A -s system_server -c service_manager

# Inspect runtime denials for the system_server source domain.
adb shell 'dmesg | grep "avc: denied" | grep system_server'

输入是当前设备的进程 context、最终 policy 和 AVC 日志；断言不是“所有命令都成功”，而是能把失败归类为 domain 进入、Binder class、service_manager class 或具体 target type。它不能证明 Java service 的业务状态。

7.2 启动阶段证据

源码文件：frameworks/base/services/java/com/android/server/SystemServer.java

startBootstrapServices(t);
startCoreServices(t);
startOtherServices(t);
startApexServices(t);
updateWatchdogTimeout(t);
CriticalEventLog.getInstance().logSystemServerStarted();

输入是 boot 阶段的代码路径；关键观察点是各 start 方法和最终 started event 的顺序。它证明服务启动的控制流，不证明 policy allow 已满足；需要与 sesearch/AVC 结果结合。

7.3 练习

选择一个 system_server 调用的 HAL 或 daemon，记录 service_manager find、Binder call、fd use 和 HAL attribute 四条边。再删除其中一条规则，预测失败发生在名字查找、Binder 事务、fd 传递还是 HAL 服务访问；最后用 dmesg 的 scontext/tcontext/tclass/permission 验证预测。

8. 源码导航

1. frameworks/base/core/jni/com_android_internal_os_Zygote.cpp：forkSystemServer、SpecializeCommon、setcontext/setcon 和早死检测。
2. system/sepolicy/private/zygote.te、system_server_startup.te、system_server.te：三段域切换与权限约束。
3. frameworks/base/services/java/com/android/server/SystemServer.java：bootstrap/core/other/apex 服务启动。
4. system/sepolicy/private/te_macros：binder_call、binder_service、hal_client_domain。
5. system/core/init/service.cpp：zygote service 的 init owner、exec 和重启。
6. system/sepolicy/private/system_server.te：Binder、HAL、文件、网络和 neverallow 规则。