8

My device is Samsung Galaxy Note 3 SM-N9005.

This phone comes with SELinux set to Enforcing by default.

I have been trying to change this to permissive but to no avail.

I built the kernel from source code following Samsung instructions, and added a line to init.rc file in the ramdisk: "setenforce 0" and this worked, however WiFi broke and I am not clued up on kernel development.

I have tried, as root, running "setenforce 0" in terminal and via adb. There is no error, however it stays Enforcing.

I am running out of options have looked through the init files in the Samsung source code and cannot find anywhere where Samsung set SELinux to be Enforcing.

Any help will be vastly appreciated!

Improve this question
4
  • I tried "su setenforce 0" in terminal which worked temporarily but init.rc file seems like renewing on every boot and "setenforce 0" command is not gonna be permanently. However I'm using i9505 MI8 android 4.3 CF-Rooted and setenforce command works in terminal which means SElinux is not locked on my device. I hope Note3 would be the same
    – user42975
    Oct 9, 2013 at 12:00
  • 2
    setenforce changes only the runtime mode, so if you want the change to persist over reboots, add setenforce 0 to your init.rc files or edit the value of ro.boot.selinux
    – onik
    Oct 9, 2013 at 12:25
  • 1
    I'm not sure how this answers the question.
    – ale
    Oct 9, 2013 at 12:27
  • You cannot get root shell from ADB on stock and Enforced devices since 4.2.2, without additional boot.img hacking. This make a terrible mess for everyone, but you can do it from a local terminal shell.
    – not2qubit
    May 12, 2014 at 13:15

1 Answer 1

Reset to default
6

If you're rooted, install Android Terminal Emulator from Play Store and open a root shell. Also make sure you use latest (>2.00) SuperSU to handle SELinux. Then type: su 0 setenforce 0 and see what happens. Check with id. If that doesn't work, also try with: su system setenforce 0. In AOS >4.3, it's not enough to just be "root" (uid=0), you also have to use the right context.

EDIT: 2015-11-06

Apparently, since AOS >4.4, Google started using a permanent enforcing mode which actually enforces the SELinux policy. These phones have disabled the Permissive option through the DCONFIG_ALWAYS_ENFORCE=true kernel config flag in their Kernels. You need to flash an insecure Kernel (e.g. CF_Root) or a brand new kernel where this flag has been disabled.

Google writes here:

In the Android 5.0 (L) release, Android moves to full enforcement of SELinux. This builds upon the permissive release of 4.3 and the partial enforcement of 4.4. In short, Android is shifting from enforcement on a limited set of crucial domains (installd, netd, vold and zygote) to everything (more than 60 domains). This means manufacturers will have to better understand and scale their SELinux implementations to provide compatible devices. Understand that:

  • Everything is in enforcing mode in the 5.0 release
  • No processes other than init should run in the init domain
  • Any generic denial (for a block_device, socket_device, default_service, etc.) indicates that device needs a special domain

For more info how to recompile your Kernel, look here.

Improve this answer
1
  • doesn't work on my S5, still enforcing :-/
    – Matthias Urlichs
    Oct 18, 2014 at 11:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .