我正在尝试构建强制实施，但是有7次违规。我该如何解决？
libsepol.report_failure: neverallow on line 5 of device/motorola/sanders/sepolicy/vendor/ims.te (or line 75926 of
policy.conf) violated by allow hal_camera_default hal_camera_hwservice:hwservice_manager { add };
libsepol.report_failure: neverallow on line 3 of device/motorola/sanders/sepolicy/vendor/hal_nfc_default.te (or l
ine 75741 of policy.conf) violated by allow hal_secure_element_default hal_secure_element_hwservice:hwservice_man
ager { add };
libsepol.report_failure: neverallow on line 3 of device/motorola/sanders/sepolicy/vendor/hal_nfc_default.te (or l
ine 75741 of policy.conf) violated by allow rild hal_secure_element_hwservice:hwservice_manager { add };
libsepol.report_failure: neverallow on line 5 of system/sepolicy/public/hal_secure_element.te (or line 15685 of p
olicy.conf) violated by allow hal_nfc_default hal_secure_element_hwservice:hwservice_manager { add };
libsepol.report_failure: neverallow on line 5 of system/sepolicy/public/hal_camera.te (or line 14186 of policy.co
nf) violated by allow init hal_camera_hwservice:hwservice_manager { add };
libsepol.report_failure: neverallow on line 521 of system/sepolicy/public/domain.te (or line 10809 of policy.conf
) violated by allow hal_fingerprint_default default_android_hwservice:hwservice_manager { add };
libsepol.report_failure: neverallow on line 519 of system/sepolicy/public/domain.te (or line 10807 of policy.conf
) violated by allow qseeproxy default_android_service:service_manager { add };
libsepol.check_assertions: 7 neverallow failures occurred
最佳答案
您正在处理违反neverallow的问题：您有一条规则说：“切勿允许类型x在其他类型/类action上执行y:c”，然后有另一条规则说：“此x的子类型允许在action上执行y:c”。 SE Linux编译器将拒绝这些矛盾的规则。可以通过修改neverallow规则为要允许的特定子类型设置例外来解决。
更准确地说，如果您具有以下形式的规则：neverallow x y:c action;type z, x;（意味着z是x的特例）allow z y:c action;
将第一个规则修改为neverallow {x -z} y:class action;，以使子类型z例外。
例：
Link：neverallow { domain ... -installd} staging_data_file:dir *;表示不允许domain类型的对象访问staging_data_file类型和dir类的对象。但是，它是installd类型的例外。
Link：type installd, domain;将installd定义为domain的特例。
Link：allow installd staging_data_file:dir { open ... };允许installd对类型open和类staging_data_file的对象执行操作dir。