I've added a exec command at the end of init.rc file.

on property:dev.bootcomplete=1
    exec u:r:shell:s0 shell shell -- /system/bin/am start -n com.example.package/com.example.package.MainActivity

This exec runs in u:r:shell:s0 SELinux context, from user shell and in group shell. But SELinux still believes in access denial:

[28.918751] init: Starting service 'exec 3 (/system/bin/am)'...
[28.920227] init: cannot execve('/system/bin/am'): Permission denied
[28.920356] type=1400 audit(22128374.236:11): avc: denied { entrypoint } for pid=3887 comm="init" path="/system/bin/am" dev="dm-0" ino=292 scontext=u:r:shell:s0 tcontext=u:object_r:system_file:s0 tclass=file permissive=0
[28.921791] init: Service 'exec 3 (/system/bin/am)' (pid 3887) exited with status 127

That's wonderful when I issue the very same following command in adb shell and it runs successfully, having SELinux enabled.

/system/bin/am start -n com.example.package/com.example.package.MainActivity

This is id of adb shell:

uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats) context=u:r:shell:s0

So, why does my exec command fail even though it has exactly the same identity of adb shell?


I finally managed to solve the problem. There are two problems:

  • You're not using the "exactly the same identity of adb shell". There are a couple of groups to which adb shell belongs but they're not mentioned in that exec command.

  • /system/bin/am on its own is not executable, it's a shell script and should be passed to /system/bin/sh to be executed.

So, here's the final and working init.rc statements:

on property:dev.bootcomplete=1
    exec u:r:shell:s0 shell shell input log adb sdcard_rw sdcard_r net_bt_admin net_bt inet net_bw_stats -- /system/bin/sh /system/bin/am start -n com.example.package/com.example.package.MainActivity
  • It's still valid for the latest Oreo (tested on Lineage 15.1). Great job! – koras Jun 5 '18 at 16:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.