How to make SELinux permissive with `systemless-root` on a `system-as-root device`?

Question

I have a Samsung S10 5G device that is actually a system-as-root device. I have rooted it by following the instructions given here.

As the system-as-root devices have no ramdisk in boot.img but in recovery.img so, I have to always boot the device with a recovery combination to get the root access.

I have an app that requires some SELinux policies to work. I have injected them with the help of sepolicy-inject using following commands:

    sepolicy-inject -s init -t su -c process -p transition -l
    sepolicy-inject -s su -t system_file -c file -p entrypoint -l
    sepolicy-inject -s init -t su -c process -p rlimitinh -l
    sepolicy-inject -s init -t su -c process -p siginh -l
    sepolicy-inject -s su -t shell_exec -c file -p read -l
    sepolicy-inject -s su -t shell_exec -c file -p execute -l
    sepolicy-inject -s su -t shell_exec -c file -p getattr  -l
    sepolicy-inject -s su -t vendor_toolbox_exec -c file -p execute_no_trans -l
    sepolicy-inject -s init -t su -c process -p noatsecure -l
    sepolicy-inject -s su -t toolbox_exec -c file -p getattr -l
    sepolicy-inject -s su -t toolbox_exec -c file -p execute -l
    sepolicy-inject -s su -t system_file -c file -p execute_no_trans -l
    sepolicy-inject -s su -t storage_file -c dir -p search -l
    sepolicy-inject -s su -t storage_file -c lnk_file -p read -l
    sepolicy-inject -s su -t tmpfs -c dir -p search -l
    sepolicy-inject -s su -t mnt_user_file -c dir -p search -l
    sepolicy-inject -s su -t mnt_user_file -c lnk_file -p read -l
    sepolicy-inject -s su -t sdcardfs -c dir -p search -l
    sepolicy-inject -s su -t sdcardfs -c file -p append -l
    sepolicy-inject -s su -t toolbox_exec -c file -p read -l
    sepolicy-inject -s su -t toolbox_exec -c file -p open -l
    sepolicy-inject -s su -t sdcardfs -c file -p read -l
    sepolicy-inject -s su -t sdcardfs -c file -p write -l
    sepolicy-inject -s su -t sdcardfs -c file -p open -l
    sepolicy-inject -s su -t media_rw_data_file -c file -p read -l
    sepolicy-inject -s su -t media_rw_data_file -c file -p write -l
    sepolicy-inject -s su -t media_rw_data_file -c file -p open -l
    sepolicy-inject -s su -t media_rw_data_file -c file -p append -l

but after reboot, I need to run this command again as they are not persistent. I don't want to use a key combination on the device to use my app on the root mode of the device. So, I am searching for any way to inject them permanently.

I can think of the following solutions:

• Modify init.rc file of system.img to run these commands but when I have tried to modify init.rc with just adding a comment and flashed it on the device then that comment is lost. Don't know what happens. I have flashed it with all Odin files and within AP file. This AP file is patched by Magisk.
• Change the SELinux from enforcing to permissive. I am not sure how can I do it with either root access or Modified ROM Flashing.

Any suggestion?

Answer 1

I am searching for any way to inject them permanently.

As explained in my answer to your previous question: How to make SELinux injected rules persistent without unpacking-packing boot.img? you need to modify SELinux policy file in order to inject rules permanently.

Policy could either be monolithic (pre-compiled sepolicy file on initramfs or /system or /vendor) or split.

In latter case it can be either pre-compiled SEPolicy (/vendor/etc/selinux/precompiled_sepolicy) or you need to compile it from .cil files in /system/etc/selinux/ and /vendor/etc/selinux/ using SEPolicy compiler (/system/bin/secilc).

In former case the hashes of both platform and non-platform policies (/system/etc/selinux/plat_and_mapping_sepolicy.cil.sha256 and /vendor/etc/selinux/precompiled_sepolicy.plat_and_mapping.sha256) must match, otherwise init won't load it.

In either case you can't retain systemless approach.

Modify init.rc file of system.img to run these commands but when I have tried to modify init.rc with just adding a comment and flashed it on the device then that comment is lost.

As explained in my answer to your previous question: How to boot system-as-root device always as rooted? on rooted SAR device system.img is mounted at /system_root by Magisk init, contents of ramdisk are then copied to / cleaning everything previously existing, files are added / modified in rootfs /, /system_root/system is bind-mounted to /system, and finally [/system]/init is executed for normal boot. So you need to edit /system_root/init.rc for permanent changes. Please note that modifying system.img (or vendor.img) would break dm-verity and OTAs.

Change the SELinux from enforcing to permissive. I am not sure how can I do it with either root access or Modified ROM Flashing.

SELinux is set enforcing by init (if it's not already enforcing), so you need to modify init source. Or on userdebug ROMs pass androidboot.selinux=permissive kernel command-line parameter. For details see What sepolicy context will allow any other context to access it?

With root access just execute the following in any .rc file:

on property:sys.boot_completed=1
    exec u:r:magisk:s0 -- /system/bin/setenforce 0

For details see How to fix SELinux “avc: denied” errors?