Policy Configuration of SELinux and SEAndroid

A Note for SELinux and SEAndroid policy configuration. SEAndroid Security-Enhanced Linux in Android SELinux for Android 8 - Treble mode SEAndroid安全機制中的文件安全上下文關聯分析 - file_context SEAndroid安全機制中的進程安全上下文關聯分析 - process Android 8 Treble mode: Kernel early mount PRODUCT_FULL_TREBLE, PRODUCT_FULL_TREBLE_OVERRIDE, BOARD_SEPOLICY_DIRS Android 4.3 ~ 6 TE macro define: external/sepolicy/te_macros Android 8 TE macro define: system/sepolicy/te_macros ##################################### # domain_trans(olddomain, type, newdomain) # Allow a transition from olddomain to newdomain # upon executing a file labeled with type. # This only allows the transition; it does not # cause it to occur automatically - use domain_auto_trans # if that is what you want. # define(`domain_trans', ` # Old domain may exec the file and transition to the new domain. allow $1 $2:file { getattr open read execute }; allow $1 $3:process transition; # New domain is entered by executing the file. allow $3 $2:file { entrypoint open read execute getattr }; # New domain can send SIGCHLD to its caller. ifelse($1, `init', `', `allow $3 $1:process sigchld;') # Enable AT_SECURE, i.e. libc secure mode. dontaudit $1 $3:process noatsecure; # XXX dontaudit candidate but requires further study. allow $1 $3:process { siginh rlimitinh }; ') ##################################### # domain_auto_trans(olddomain, type, newdomain) # Automatically transition from olddomain to newdomain # upon executing a file labeled with type. # define(`domain_auto_trans', ` # Allow the necessary permissions. domain_trans($1,$2,$3) # Make the transition occur by default. type_transition $1 $2:process $3; ') ##################################### # tmpfs_domain(domain) # Define and allow access to a unique type for # this domain when creating tmpfs / shmem / ashmem files. define(`tmpfs_domain', ` type $1_tmpfs, file_type; type_transition $1 tmpfs:file $1_tmpfs; allow $1 $1_tmpfs:file { read write getattr }; allow $1 tmpfs:dir { getattr search }; ') ##################################### # init_daemon_domain(domain) # Set up a transition from init to the daemon domain # upon executing its binary. define(`init_daemon_domain', ` domain_auto_trans(init, $1_exec, $1) tmpfs_domain($1) ') apol - SELinux policy analysis tool sudo apt install setools-gui SELinux Configuring the SELinux Policy ...

November 17, 2017 · 5 min · oopsmonk

ARM Mali Profiling Metrics

Some metrics for ARM Mali performance analysis in DS-5 Streamline or MGD. DS-5 Streamline Mali-470 (Utgard) GPU Bandwidth = (Words read, master + Words written, master) * Bus Width Overdraw = Fragments Passed Z/stencil count * Number of Cores / Resolution * FPS GPU Bandwidth = (38342943+38661456) * (128/8) = 1232070384 bytes/s = 1174.99 MB/s Overdraw = (79194586+79152584+79112550+79117609)/(1920x1080) = 152.67 Mali-T820 (Midgard) Job Slots JS0: fragment shading. JS1: vertex, geometry, compute, and tiling. JS2: vertex, geometry, and compute. Fragment Percentage = (JS0 Active / GPU frequency) * 100 Vertex percentage = (JS1 Active / Frequency) * 100 Load Store CPI = Full Pipeline issues / Load Store Instruction Words Completed GPU Bandwidth = (External read beats + External write beats) * Bus Width Overdraw = Fragment Threads Started * Number of Cores/ Resolution * FPS ...

November 1, 2017 · 2 min · oopsmonk

What's wrong with benchmarks?

ARM performance, Algorithms In fact, there is no universal benchmark tool. Week40 (10/06) 網路文章 Why do we learn algorithms? Why do we need so many sorting algorithms? Why do we need to learn different sorting algorithms when the STL sort function is already available to us in C++? 網路資源 The Algorithms 不同程式語言演算法的實現. every-programmer-should-know Data Structure Visualizations 演算法視覺化 Week41 (10/13) 網路文章 GPU Processing Budget Approach to Game Development GPU budget是估算處理1 pixel的cycle cost, 單位是cycles/frame/pixel 先估算fragment/vertex budget理論值再透過MGD分析當下的budget做比較, 如MGD算出來的budget較高, 表示GPU loading過重. ...

October 27, 2017 · 1 min · oopsmonk

Building Different Android Version Using schroot

I have a build environment with make4.1 and JDK8 for Android N/O, but JDK6 and make3.81 are required by Android KitKat. Here is a way to create a clean environment for Android KK. Create a new environment in current Ubuntu 16.04 install schroot and debootstrap sudo apt install schroot debootstrap if xenial no exist, update to latest version of debootstrap ls -l /usr/share/debootstrap/scripts/xenial Configure new environment edit /etc/schroot/schroot.conf [Build_KK] description=ubuntu16.04 Android_KK type=directory directory=/srv/chroot/Build_KK users=oopsmonk groups=oopsmonk root-groups=root profile=default Adding Mount points edit /etc/schroot/default/fstab ...

October 24, 2017 · 2 min · oopsmonk

Waterline?

Jigsaw Puzzle, Hidden layers, New SoC, Algorithm basics, HTC Week35 (09/01) 第一次完成520片的拼圖, 花了4個晚上的時間, 大約12小時吧?! 下次記得顏色鮮明的圖會比較愜意些. Week36 (09/08) 網路文章 Credit firm Equifax says 143m Americans’ social security numbers exposed in hack 在新聞公開前高層就己賣掉市值1.8m的股票!! 網路資源 Google Developer Documentation Style Guide Google公佈了內部文件撰寫的格式及注意事項. Neural Networks and Deep Learning - Week 3 Tuning hidden layer size iterations: 5000 learning_rate: 1.2 activation: sigmoid Accuracy for 1 hidden units: 67.5 % Accuracy for 2 hidden units: 67.25 % Accuracy for 3 hidden units: 90.75 % Accuracy for 4 hidden units: 90.5 % Accuracy for 5 hidden units: 91.25 % Accuracy for 20 hidden units: 90.0 % Accuracy for 50 hidden units: 90.25 % ...

September 29, 2017 · 3 min · oopsmonk

Faster R-CNN Use Caffe Framework

Install caffe framework and run Faster R-CNN demo on Ubuntu 16.04. Test environment CPU: Intel(R) Core(TM) i3-4130 CPU @ 3.40GHz 4-Cores GPU: ASUSTeK GeForce GTX 1060 with 6GB Memory HD: WDC WD5000AAKX OS: Ubuntu 16.04 Test Flow Install software requirement Video pre-processing: get jpeg images from source video Image Labeling Use Faster R-CNN to genrate trained model Run Faster R-CNN demo Requirement Hardware: Good graphic card with large memory (6GB memory is okay, but it has problem in VGG traing.) ...

August 31, 2017 · 12 min · oopsmonk

Going Deep

以前球隊在回防時, 教練總會說"快跑! 別回頭, 到定點再休息". 關於人生, 喘息點在哪兒? 我想就在滴水穿石之間! Deep Learning <–> keep learning Week31 (08/04) 網路文章 A Brief History of CNNs in Image Segmentation: From R-CNN to Mask R-CNN R-CNN: https://arxiv.org/abs/1311.2524 Visual Recognition就是從這裡爆發了… 透過Selective Search找到Region後丢給修改過的AlexNet學習, 最後再給Support Vector Machine (SVM) 這層CNN. 原本設計的R-CNN就只做這些: 用Selective Search找region 透過pre-trained AlexNet去算特徵後交給SVM看region裡的是什麼鬼東西 最後透過線性回歸(linear regression)畫出物件的座標 Fast R-CNN: https://arxiv.org/abs/1504.08083 Region proposals using Selective Search. RoI (Region of Interest) Pooling Combine All Models into One Network 將R-CNN的AlexNet, SVM, Regressor整合在一起變成單一個network Fast R-CNN instead used a single network to compute the extract image features (CNN), classify (SVM), and tighten bounding boxes (regressor). Faster R-CNN: https://arxiv.org/abs/1506.01497 用SS找region的方法太慢, 又重覆計算, 改由RPN後, 整個framework只要訓練一個CNN. Speeding Up Region Proposal: Selective Search is too slow. A single CNN is used to both carry out region proposals and classification. only one CNN needs to be trained Region Proposal Network(RPN) - How the Regions are Generated ...

August 25, 2017 · 2 min · oopsmonk