从selinux到SeAndroid,新手30分钟入门.pptVIP

求职应注意的礼仪 求职时最礼貌的修饰是淡妆 面试时最关键的神情是郑重 无论站还是坐，不能摇动和抖动 对话时目光不能游弋不定 要控制小动作 不要为掩饰紧张情绪而散淡 最优雅的礼仪修养是体现自然 以一种修养面对两种结果 必须首先学会面对的一种结果被拒绝 仍然感谢这次机会，因为被拒绝是面试后的两种结果之一。 被拒绝是招聘单位对我们综合考虑的结果，因为我们最关心的是自己什么地方与用人要求不一致，而不仅仅是面试中的表现。 不要欺骗自己，说“我本来就不想去”等等。 认真考虑是否有必要再做努力。 必须学会欣然面对的一种结果被接纳 以具体的形式感谢招聘单位的接纳，如邮件、短信 考虑怎样使自己的知识能力更适应工作需要 把走进工作岗位当作职业生涯的重要的第一步，认真思考如何为以后的发展开好头。 Thank you * * * SEAndroid Overview For beginner 1 From SeLinux Best and short summary /business/13/11/selinux-policy-guide Why Integrity (Type Enforcement) Confidentiality (Multi Level Security) Role Based Access Control What SELinux is a security enhancement to Linux which allows users and administrators more control over access control. DAC and MAC When SELinux kernel policy is presently compiled as part of the Android build and added to the ramdisk image so that it can be loaded by init very early in boot, before mounting the system partition. Once the data partition has been mounted, policy can be updated by placing policy files under a subdirectory of /data/security, creating a symbolic link named current under /data/security to that subdirectory, and setting the selinux.reload_policy property to 1 (setprop selinux.reload_policy 1). This will trigger a reload of policy by init. Where? Kernel: Security server, Object manager, Access Vector Cache User Space: Coreutils, Policy coreutils, Checkpolicy SELinux-policy: Configuration data , Rules that govern access Traditional UNIX DAC approach Owner controls access to object File owner/group Process with effective UID/GID File mode Almighty root user above the rules SELinux MAC approach Policy controls access to objects Labeled objects (files, sockets, …) Labeled processes (domains) Policy rules Concept of “almighty” unconfined processes is defined within policy DAC of UNIX VS MAC of SELinux File owner/group: UID/GID Process effective user/group: UID/GID File mode setuid() Setuid bit File context (FC): label Process domain: label Type Enforcement (TE) rules Domain tra