0

I've been happy using android-x86 nougat on my system. Thanks to everyone who made that work. I'm now trying to make one small change which is that I want to run a custom init script (a shell script) at bootup. It seemed like a simple idea which I've done before on kitkat without problems. I modified init.rc and added a service to start my script. But what happens is on bootup, I see:

04-17 13:16:14.823 1210 1210 I init : type=1400 audit(0.0:6): avc: denied { execute_no_trans } for path="/system/bin/mystart" dev="loop1" ino=280 scontext=u:r:init:s0 tcontext=u:object_r:system_file:s0 tclass=file permissive=1

That error is a selinux permission error so I then proceeded to try these solutions.

a) disabling selinux write /sys/fs/selinux/enforce 0

and checked that this causes the system to be in permissive mode but at bootup, the same error still occurs.

b) adding a custom selinux policy I added: build/target/board/generic/sepolicy/mystart.te type mystart, domain; type mystart_exec, exec_type, file_type;

init_daemon_domain(mystart)

But this still doesn't allow the service to proceed.

c) tried to run it as a post action on property:dev.bootcomplete=1 exec u:r:shell:s0 shell shell input log adb sdcard_rw sdcard_r net_bt_admin net_bt inet net_bw_stats -- /system/bin/sh /system/bin/mystart

This still hits the same avc issue.

I'm kind of stuck so I'm looking for any ideas. I tried asking on the android-x86 irc but that seems silent, and the mailing list is currently blocked as I'm waiting for the admin to approve my membership for the past 2 days.

Any help would be greatly appreciated.

Thanks!

Edit: Irfan, this issue is for a boot script (not an elf executable as in the other case) and furthermore, as I mentioned above, turning off selinux enforce (which is the solution listed in that issue) does not permit the script to be run. Thanks.

  • 1
  • Edited to explain why it is not a duplicate in response to Irfan. – Jaya Kumar Apr 18 at 14:24
  • AVC denials are only logged when SELinux is permissive, not enforced. permissive=1 means the actions is not denied, only logged. – Irfan Latif Apr 18 at 14:28
  • Thanks Irfan. I'm unsure of your meaning about the avc denial. What I'm seeing is that the script is not executed, meaning none of the commands I have in it are run, eg: touch /tmp/myscript_started or eg: echo hello > /dev/console Is your meaning that the avc denial is unrelated to why those commands are not run? I read your link, do you mean that even though I set permissive in init.rc, something is already in a forced enforcing state? The sysfs value shows permissive though. Thanks. – Jaya Kumar Apr 18 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.