SEAndroid 027 - DAC과 MAC 체킹 순서.

DAC 먼저 체크하고 MAC 체킹을 한다.

코드를 보면

611             uidRestricted

    612                  = !(factoryTest.equals("1") || factoryTest.equals("2"));

    613

    614             if (uidRestricted

    615                     && args.uidSpecified && (args.uid < Process.SYSTEM_UID)) {

    616                 throw new ZygoteSecurityException(

    617                         "System UID may not launch process with UID < "

    618                                 + Process.SYSTEM_UID);

    619             }

    620         } else {

    621             // Everything else

    622             if (args.uidSpecified || args.gidSpecified

    623                 || args.gids != null) {

    624                 throw new ZygoteSecurityException(

    625                         "App UIDs may not specify uid's or gid's");

    626             }

    627         }

    628

    629         if (args.uidSpecified || args.gidSpecified || args.gids != null) {

    630             boolean allowed = SELinux.checkSELinuxAccess(peerSecurityContext,

    631                                                          peerSecurityContext,

    632                                                          "zygote",

    633                                                          "specifyids");

    634             if (!allowed) {

    635                 throw new ZygoteSecurityException(

    636                         "Peer may not specify uid's or gid's");

    637             }

    638         }