How can I set the correct SELinux / SEAndroid policy for an App?

Question

I am using the free SSHelper SSH server on my phone to get SSH access. However, the application is not behaving correctly under SELinux when set to Enforcing mode, but seem to be OK when using Permissive mode. This is not surprising as it was developed under CyanogenMod, making the author unaware of these issues for later SELinux Enforcing stock AOS's.

The problem occurs when the App is trying to allocate a /dev/pts/N pseudo-terminal, during SSH connection. This fails and the resulting shell is essentially useless for development. After having spent considerable time trying to track down this problem as documented HERE. Where I found the following "errors" in the /data/misc/audit/audit.log file:

audit(1401291488.480:203): avc:  denied  { setattr } for  pid=11441 comm="sshelper_sshd" name="0" dev="devpts" ino=3 scontext=u:r:untrusted_app:s0 tcontext=u:object_r:untrusted_app_devpts:s0 tclass=chr_file VE=SEPF_GT-I9195_4.2.2_0022_M
audit(1401291488.480:203): arch=40000028 syscall=15 per=840000 success=no exit=-13 a0=beffd438 a1=190 a2=27da a3=c0000000 items=1 ppid=8499 pid=11441 auid=4294967295 uid=10202 gid=10202 euid=10202 suid=10202 fsuid=10202 egid=10202 sgid=10202 fsgid=10202 tty=(none) ses=4294967295 comm="sshelper_sshd" exe="/data/data/com.arachnoid.sshelper/bin/sshelper_sshd" subj=u:r:untrusted_app:s0 key=(null)
audit(1401291488.480:203):  cwd="/"
audit(1401291488.480:203): item=0 name="/dev/pts/0" inode=3 dev=00:09 mode=020600 ouid=10202 ogid=10202 rdev=88:00 obj=u:object_r:untrusted_app_devpts:s0

However, since I have no previous experience in SELinux and its mysterious protection mechanisms, and could really use some help. I don't even know if this is the real issue, just guessing. Checking the permissions of the above file gives:

# ls -alZ /data/data/com.arachnoid.sshelper/bin/sshelper_sshd
-rwxr-xr-x u0_a202  u0_a202           u:object_r:app_data_file:s0 sshelper_sshd

But this context doesn't seem to correspond at all to what was shown in the log.

How can I fix these permissions to play well with SELinux when in Enforcing mode?

(Also, what tools and file are available in Android to fix this?)

Answer 1

I think the problem could be the default "unconfined domain" the binary gets executed when no policy is specified.

An attempt I'd try would be to move the sshelper_sshd (I think it's the sshd server?) somewhere on the /system partition (/system/sbin/?)

I think the best and updated document to read to deal with SELinux implementation on Android (SEAndroid) is How-To SU.

Here an extract from Chapter 5.4.4. Android 4.4.3

A good example of the unconfined domain not being all-mighty, is executing files from /data. Starting Android 4.4.3, this will no longer be possible from the unconfined domain (see #74082 and #78801).

The established practise of including binaries and scripts in your APK, extracting them to /data/data/[package]/files/ or placing them in /data/data/[package]/lib/ and executing them from there through a su call will no longer work out-of-the-box. While there are other work-arounds possible (like copying to and executing from rootfs), one solution is switching contexts to a context not in the unconfined domain (like u:r:untrusted_app:s0, the context the rest of your app is likely to run as). You will need to do extensive testing to see if all the calls you want to make still run in the context you choose, though, and you may have to try some different ones to get the capabilities you want.

Note that executing files in /data will still work as expected from your app if you are not trying to run it as root.