3

In a native call, I'm trying to open("/dev/video4", O_RDWR) but I get errno EACCES 13 "permission denied".

If I run the same code* in an executable, on the same Android host, as the same UID of the installed app I'm running above, it works fine. (* minor differences like main() instead of Java_com_test_testOpen())

I've tried chmod 666 /dev/video4 and still get EACCES, which is especially strange.

Why does the same code, on the same host, as the same user, give EACCESS when called via JNI, and success when called as standalone executable?

The test device is rooted and running Cyanogenmod 12.1 (API 22) and I'm targeting >= API 21 (5.0 Lollipop) on rooted devices. Thanks for your help.

jkoreska
  • 7,210
  • 2
  • 18
  • 21
  • It's SELinux - dmesg has entries like: `avc: denied { read write } for pid=2495 comm="est.v4l2test" name="video4" dev="tmpfs" ino=15110 scontext=u:r:untrusted_app:s0 tcontext=u:object_r:video_device:s0 tclass=chr_file`. I'll post an answer once I get it all sorted. For now, `echo 0 > /sys/fs/selinux/enforce` does the trick! – jkoreska May 30 '16 at 17:31

3 Answers3

1

Since you get an error when running your code from an Android Java application, I would guess that you are missing a permission. It's the camera that you are trying to access, if I am not mistaken, so if you add: 

 <uses-permission android:name="android.permission.CAMERA" />

to your AndroidManifest.xml, your application should run fine.

gmetal
  • 2,908
  • 2
  • 11
  • 16
  • Thank you but I have that! My understanding is that this permission adds your app UID to the camera GID but the chmod 666 overrides this anyway. Also, I discovered that this was removed in API 22+ for security reasons (can't currently find the commit or reference). – jkoreska May 27 '16 at 17:42
0

Since I'm building Cyanogenmod 12.1 (API 22) with other minor hacks I was able to get permissions for /dev/video* in my app by using the following hacks:

  1. For standard Linux permissions, android.permission.CAMERA no longer seems to allow access to /dev/video* even though they're owned by system:camera. Instead, I edited device/samsung/klte-common/rootdir/etc/ueventd.qcom.rc and changed the /dev/video* line to 0666.
  2. For SE Linux permissions, I added the line allow untrusted_app video_device:chr_file rw_file_perms; to external/sepolicy/untrusted_app.te.

After rebuilding and installing the image, my JNI lib is able to access /dev/video* and my client is happy!

jkoreska
  • 7,210
  • 2
  • 18
  • 21
0

The answers was not enough for me, so I left one more anwser. open API has more parameter 'mode'.

int open(const char *pathname, int flags, mode_t mode);

check out the link http://man7.org/linux/man-pages/man2/open.2.html

you might need to use 'open' with S_IRWXU option. like

open("/dev/video4", O_RDWR | O_CREAT, S_IRWXU )

JungJik Lee
  • 148
  • 8