2

I have a Samsung note 2014 which I rooted following this tutorial. However I now have problems with SELinux which (apparently) is preventing me from installing a Linux virtual box. I backed up and uninstalled KNOX using Titanium backup but still no success. When I type setenforce permissive in a terminal, if get no error message but when I type getenforce, I get "enforcing".

Is there any way I can change this? The device is running Android 4.3.

Improve this question
3
  • Have you 0x1 Knox flag? Have you installed any ROMs in the meantime? You have uninstalled the KNOX APP, but that doesn't have an effect on this. Have you flashed a custom Kernel with SEPermissive set on it? You could try the app recommended here: techbeasts.com/2014/02/25/… but I'm doubtful to be honest.
    – RossC
    Mar 3, 2014 at 13:01
  • I think I have the 0x1 flah because I can't get new updates. And not I've not flashed any ROMs. Should I go for Cyanogenmod?
    – Reza
    Mar 3, 2014 at 13:51
  • Up to you what ROM to use, but I would not recommend CyanogenMod outside of a STABLE release, there are numerous known bugs in nightlies! It's all preference, try a few and see what you like. Don't forget BACKUPS! :)
    – RossC
    Mar 3, 2014 at 14:15

3 Answers 3

Reset to default
1

Getting around Militant SELINUX

You need to run a custom kernel build.

  1. Samsung open source is here
  2. My harvested info for setting up your build system for Linux is here
  3. The kernel patch you will need to fix SElinux to permissive is here. It should absolutely work for Kitkat source as well.

I would post the diff but it doesn't wrap right.

You should not need to set the SElinux boot flag and userspace disable options during menuconfig, but do remember to disable Samsung anti-root in the kernel hacking section.

Improve this answer
5
  • The 3 step, it's link is dead, it leads to a 404 error on github, can you please either elaborate on what it was doing or post a new link.
    – Matt07211
    Oct 31, 2016 at 8:18
  • You should have posted the diff. Link is dead as mentioned by @Matt07211.
    – Marc.2377
    Apr 12, 2019 at 3:08
  • @Marc.2377 if my memory servers me correctly (figured out how to myself at a latter point) it was a simple 1 line/1 value change in the selinux subdir/makefile. I'll see if I can locate it again
    – Matt07211
    Apr 12, 2019 at 3:11
  • Found it, basically you set this to false I believe, it's Been a long time and I was a utterly clueless back then github.com/Matt07211/android_kernel_samsung_xcover3lte/blob/…
    – Matt07211
    Apr 12, 2019 at 3:13
  • Thanks @Matt07211.
    – Marc.2377
    Apr 12, 2019 at 3:18
1

You need to open a local terminal shell, by using a "Terminal Emulator" like app. Otherwise you will not get an su'able shell. Since AOS 4.2.2, ADB is not letting you use "su", to get root shell, on stock "Enforced" SELinux devices.

Then do this:

su 0 setenforce 0

If you need to make this permanent to last between re-boots, you need to find where this is originally set in the various init.*.rc files in boot.img and change it, and reflash...

EDIT: 2015-09-22

The above trick no longer work on Stock devices using AOS 4.4.4 and above, even with insecure kernels. (Such as those provided by cf-autoroot.) That you can blame Google who made Enforcing permanent. Your only option, other than re-compiling your own ROM, is learning about SEAndroid and context changing using SuperSU's supolicy command to inject the policy files.

Improve this answer
5
  • The commands didn't work: I ran 'getenforce' immediately after and the result was "Enforcing". But maybe modifying the files in boot.img would work. How should I flash it? Using Odin of course but how exactly. (Usually the costom ROM is given already.)
    – Reza
    May 12, 2014 at 13:23
  • @Reza: Try again by updating your SuperSU (currently 1.99r2). I think older SuperSU < 1.94 are not behaving well with recent SELinux's.
    – not2qubit
    May 27, 2014 at 16:25
  • I have Supersu v1.94 and it's the same version on the Play Store. Where can I get 1.99?
    – Reza
    May 31, 2014 at 19:16
  • From HERE.
    – not2qubit
    May 31, 2014 at 19:38
  • Doesn't work for me (SuperSU 2.01)
    – Matthias Urlichs
    Oct 18, 2014 at 11:16
0

In Terminal emulator app, enter su and then enter setenforce 0. Now check the phone. It should show "permissive" until a reboot. You can execute the commands again after reboot or get SELinuxModeChanger from XDA which switches it automatically at boot.

Improve this answer
2
  • Which app from XDA specifically?
    – Firelord ♦
    Sep 23, 2015 at 0:50
  • It is called SELinuxModeChanger.
    – user5281155
    Sep 28, 2015 at 15:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .