Timeline for How to get rid of SeLinux Denials in Permissive mode?
Current License: CC BY-SA 4.0
17 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 23, 2019 at 3:29 | comment | added | user1874594 | heyya ok ... fine sure wasnt clear what exactly you are getting at now you articulated it very well I will revert back to you with all the info. 🙏🏻Thank You | |
| Oct 22, 2019 at 9:23 | comment | added | Irfan Latif | As I mentioned in previous comment: If you state clearly, step by step, how you mounted the partition, what are the 1. ownership 2. permission modes and 3. SELinux context of the mount point and inside files, I can try to answer your question directly. If you keep on repeating the same thing, not listening to what others say, no one will be able to help you. Sorry. | |
| Oct 21, 2019 at 19:19 | comment | added | user1874594 | is there a concept that at boot time there are certain rules that are enforced and even after it changes post boot from enforcing to permissive the rules previously en forced are still applicable | |
| Oct 21, 2019 at 19:14 | comment | added | user1874594 |
yes of course it is bind mounted all the folders that I am linking somewhere else from internal storage our bind mounted only for the WhatsApp folder I am not able to download the images when I have the linking on and as soon as it refuses to download the image I go look at ` dmesg ` this ` avc denied ` message which makes me think this is connected with selinux it is a assumption based on on this strong correlation. 1 thing WhatsApp partition's mounted under /storage there are 3 partitions under storage the log message tells me that it mounted SDcardFs on so and so partition
|
|
| Oct 21, 2019 at 19:06 | comment | added | user1874594 |
127|root@android:(unreachable) # getenforce Permissive root@android:(unreachable) #
|
|
| Oct 21, 2019 at 11:24 | comment | added | Irfan Latif |
@user1874594 that's how SELinux works. Android's official documentation says: “SELinux can operate in two global modes: Permissive mode, in which permission denials are logged but not enforced. Enforcing mode, in which permissions denials are both logged and enforced. ” And you can read SELinux documentation where ever you want, the principle remains same. I can't say much if SELinux is enforcing in permissive mode only on your device. You can modify sepolicy to get rid of denial messages but that won't solve your problem for sure.
|
|
| Oct 21, 2019 at 9:41 | comment | added | alecxs | sure it is permissive? selinux changer app only work for kernel which supports that. btw WhatsApp should be bind mounted, sdcardfs does ignore symlinks | |
| Oct 21, 2019 at 9:20 | comment | added | user1874594 |
avc denied cannot be just an f y i m message. there is some actual denial going on and I was asking, if it's in permissive mode.... then what is causing so many denials when nothing in my phone has changed and this is intermittent...it ll stay on for a good amount of time and then goes away on its own to , reappear again
|
|
| Oct 21, 2019 at 4:51 | comment | added | user1874594 |
heyya thx gain... specifically I was asking about AvC denied errors that I put up in the above log snippet. if I have Selinux running in permissive mode then what are these errors coming from ? i guess that was one of the things I was trying to figure out and still haven't gotten a a faint clue 'bout....
|
|
| Oct 20, 2019 at 18:16 | comment | added | Irfan Latif | To understand ownership, must read: android.stackexchange.com/a/210159/218526. Other helpful sources: en.wikipedia.org/wiki/… and android.stackexchange.com/a/208982/218526 and source.android.com/devices/tech/config/filesystem. If you state clearly, step by step, how you mounted the partition, what are the ownership and permission modes and SELinux context of the mount point and inside files, I can try to answer your question directly. | |
| Oct 20, 2019 at 18:09 | comment | added | user1874594 | ownership will vary depending on who is writing to the card it should be made available to all users magisk is running in in global namespace .selinux is permissive | |
| Oct 20, 2019 at 17:53 | comment | added | user1874594 | ok thx very useful framework to think long but I need some more meat between those points any idea where I can read up & how these are customised and configured | |
| Oct 20, 2019 at 17:21 | comment | added | Irfan Latif | I mentioned 4 factors, SELinux is only one of those. | |
| Oct 20, 2019 at 17:13 | comment | added | user1874594 | 🙏🏻Thank You Irfan but if I'm in permissive there shouldn't be any pern issues. why the denials after i dm in permissive mode | |
| Oct 20, 2019 at 12:50 | history | edited | Irfan Latif | CC BY-SA 4.0 |
deleted 341 characters in body; edited title
|
| Oct 20, 2019 at 12:32 | comment | added | Irfan Latif |
1. permissive=1 is just a warning, it doesn't restricts you from doing anything. 2. You need to modify SELinux policy. 3. You need to define an init service. // For mounting a SD card partition to be used by apps for storing data, you need to consider 1. Ownership 2. Permission mode 3. SELinux context 4. Mount namespace. If any of the four isn't configured properly, you'll be in trouble.
|
|
| Oct 20, 2019 at 11:32 | history | asked | user1874594 | CC BY-SA 4.0 |