7

My device is Samsung Galaxy Note 3 SM-N9005.

This phone comes with SELinux set to Enforcing by default.

I have been trying to change this to permissive but to no avail.

I built the kernel from source code following Samsung instructions, and added a line to init.rc file in the ramdisk: "setenforce 0" and this worked, however WiFi broke and I am not clued up on kernel development.

I have tried, as root, running "setenforce 0" in terminal and via adb. There is no error, however it stays Enforcing.

I am running out of options have looked through the init files in the Samsung source code and cannot find anywhere where Samsung set SELinux to be Enforcing.

Any help will be vastly appreciated!

  • I tried "su setenforce 0" in terminal which worked temporarily but init.rc file seems like renewing on every boot and "setenforce 0" command is not gonna be permanently. However I'm using i9505 MI8 android 4.3 CF-Rooted and setenforce command works in terminal which means SElinux is not locked on my device. I hope Note3 would be the same – user42975 Oct 9 '13 at 12:00
  • 2
    setenforce changes only the runtime mode, so if you want the change to persist over reboots, add setenforce 0 to your init.rc files or edit the value of ro.boot.selinux – onik Oct 9 '13 at 12:25
  • 1
    I'm not sure how this answers the question. – ale Oct 9 '13 at 12:27
  • You cannot get root shell from ADB on stock and Enforced devices since 4.2.2, without additional boot.img hacking. This make a terrible mess for everyone, but you can do it from a local terminal shell. – not2qubit May 12 '14 at 13:15
5

If you're rooted, install Android Terminal Emulator from Play Store and open a root shell. Also make sure you use latest (>2.00) SuperSU to handle SELinux. Then type: su 0 setenforce 0 and see what happens. Check with id. If that doesn't work, also try with: su system setenforce 0. In AOS >4.3, it's not enough to just be "root" (uid=0), you also have to use the right context.

EDIT: 2015-11-06

Apparently, since AOS >4.4, Google started using a permanent enforcing mode which actually enforces the SELinux policy. These phones have disabled the Permissive option through the DCONFIG_ALWAYS_ENFORCE=true kernel config flag in their Kernels. You need to flash an insecure Kernel (e.g. CF_Root) or a brand new kernel where this flag has been disabled.

Google writes here:

In the Android 5.0 (L) release, Android moves to full enforcement of SELinux. This builds upon the permissive release of 4.3 and the partial enforcement of 4.4. In short, Android is shifting from enforcement on a limited set of crucial domains (installd, netd, vold and zygote) to everything (more than 60 domains). This means manufacturers will have to better understand and scale their SELinux implementations to provide compatible devices. Understand that:

  • Everything is in enforcing mode in the 5.0 release
  • No processes other than init should run in the init domain
  • Any generic denial (for a block_device, socket_device, default_service, etc.) indicates that device needs a special domain

For more info how to recompile your Kernel, look here.

  • doesn't work on my S5, still enforcing :-/ – Matthias Urlichs Oct 18 '14 at 11:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.