1

I am having problems setting the kernel to permissive (SElinux). I have already tried the setenforce 0 command with terminal but it immediately goes back to enforcing as soon as I set the setenforce 0 command. So I finally got fed up and decided to monitor what was actually going on in my phone by using a logcat. After looking at the logcat, I found a line of code that could be setting the kernel to enforcing by default.

Here is the code:

/audit   ( 6001): type=1404 msg=audit(1479393162.929:264): config_always_enforce - true; enforcing=1 old_enforcing=1 auid=4294967295 ses=4294967295

The config_always_enforce is set to true so that means I should probably set this to false.

Unfortunately I don't know where this value is in my system. Does anyone have any idea? I have a Galaxy S6.

Also, I removed all the Knox apps, but everytime I reboot, I get Knox folders reappearing and a file called knox emulated in the /storage folder. Have I not removed all the Knox apps?

I will post my logcat that way ya'll can take a look at it.

I hope you all can help me because I really want a custom ROM so I can use Xposed.

Improve this question
6
  • Alternate Solution: Try a custom kernel, if that helps..
    – Gokul NC
    Commented Nov 17, 2016 at 14:54
  • They don't have custom kernel available for my phone as of now. My phone is a Straighttalk.
    – Ryan Noles
    Commented Nov 17, 2016 at 14:55
  • Here's someone who says custom kernel from a different variant will work: forum.xda-developers.com/galaxy-s6/help/…
    – Gokul NC
    Commented Nov 17, 2016 at 15:03
  • What about the knox?
    – Ryan Noles
    Commented Nov 17, 2016 at 15:13
  • @RyanNoles Wait a minute. What's stopping you from flashing a custom recovery and then a custom ROM?
    – Grimoire
    Commented Nov 17, 2016 at 15:54

2 Answers 2

Reset to default
0

If you want permanently change your SElinux status, you can handle the situation by changing two functions of selinux.cpp placed at system/core/init in AOSP 13 source code. You need to only return SELINUX_PERMISSIVE and false for functions StatusFromProperty() and IsEnforcing(), respectively.

For more information, I recommend to check this solution in details.

Improve this answer
0

There's a kernel config option named "NSA SELinux runtime disable" (Symbol "SECURITY_SELINUX_DISABLE") that controls if that setenforce command is able to disable selinux.

If that option isn't checked, trying to run "setenforce 0" as root results in a permission denied.

Now in the case of cheap prepaid android phones (I'm looking at YOU Tracfone) will go this route as an extra security precaution.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .