I am using the free SSHelper SSH server on my phone to get SSH access. However, the application is not behaving correctly under SELinux when set to Enforcing mode, but seem to be OK when using Permissive mode. This is not surprising as it was developed under CyanogenMod, making the author unaware of these issues for later SELinux Enforcing stock AOS's.

The problem occurs when the App is trying to allocate a /dev/pts/N pseudo-terminal, during SSH connection. This fails and the resulting shell is essentially useless for development. After having spent considerable time trying to track down this problem as documented HERE. Where I found the following "errors" in the /data/misc/audit/audit.log file:

audit(1401291488.480:203): avc:  denied  { setattr } for  pid=11441 comm="sshelper_sshd" name="0" dev="devpts" ino=3 scontext=u:r:untrusted_app:s0 tcontext=u:object_r:untrusted_app_devpts:s0 tclass=chr_file VE=SEPF_GT-I9195_4.2.2_0022_M
audit(1401291488.480:203): arch=40000028 syscall=15 per=840000 success=no exit=-13 a0=beffd438 a1=190 a2=27da a3=c0000000 items=1 ppid=8499 pid=11441 auid=4294967295 uid=10202 gid=10202 euid=10202 suid=10202 fsuid=10202 egid=10202 sgid=10202 fsgid=10202 tty=(none) ses=4294967295 comm="sshelper_sshd" exe="/data/data/com.arachnoid.sshelper/bin/sshelper_sshd" subj=u:r:untrusted_app:s0 key=(null)
audit(1401291488.480:203):  cwd="/"
audit(1401291488.480:203): item=0 name="/dev/pts/0" inode=3 dev=00:09 mode=020600 ouid=10202 ogid=10202 rdev=88:00 obj=u:object_r:untrusted_app_devpts:s0

However, since I have no previous experience in SELinux and its mysterious protection mechanisms, and could really use some help. I don't even know if this is the real issue, just guessing. Checking the permissions of the above file gives:

# ls -alZ /data/data/com.arachnoid.sshelper/bin/sshelper_sshd
-rwxr-xr-x u0_a202  u0_a202           u:object_r:app_data_file:s0 sshelper_sshd

But this context doesn't seem to correspond at all to what was shown in the log.

How can I fix these permissions to play well with SELinux when in Enforcing mode?

(Also, what tools and file are available in Android to fix this?)

  • Is it a question about developing the application or about configuring the device? – Vi0 May 28 '14 at 23:25
  • Configuring the device and "repairing" the app, since the app is already developed, but I have not been able to contact the developer. I have also tried other similar apps with the same exact issues. It seem that most app developers have not yet gotten to know and understand how to properly set and use these mysterious and highly annoying SELinux features. – not2qubit May 28 '14 at 23:37

I think the problem could be the default "unconfined domain" the binary gets executed when no policy is specified.

An attempt I'd try would be to move the sshelper_sshd (I think it's the sshd server?) somewhere on the /system partition (/system/sbin/?)

I think the best and updated document to read to deal with SELinux implementation on Android (SEAndroid) is How-To SU.

Here an extract from Chapter 5.4.4. Android 4.4.3

A good example of the unconfined domain not being all-mighty, is executing files from /data. Starting Android 4.4.3, this will no longer be possible from the unconfined domain (see #74082 and #78801).

The established practise of including binaries and scripts in your APK, extracting them to /data/data/[package]/files/ or placing them in /data/data/[package]/lib/ and executing them from there through a su call will no longer work out-of-the-box. While there are other work-arounds possible (like copying to and executing from rootfs), one solution is switching contexts to a context not in the unconfined domain (like u:r:untrusted_app:s0, the context the rest of your app is likely to run as). You will need to do extensive testing to see if all the calls you want to make still run in the context you choose, though, and you may have to try some different ones to get the capabilities you want.

Note that executing files in /data will still work as expected from your app if you are not trying to run it as root.

  • Yes, I have been reading all that many times, but still not sure what exact action to take. I've tried to chcon the binary before with non-working results. Perhaps soft-linking binary in /xbin, but then how can I make sure the App is using that instead of the original? Also, what context should it be? How do I know which context is (or is not) in the "Unconfined Domain"? – not2qubit Jun 11 '14 at 12:30
  • I should add that I am not the developer of that App, so I have no way of changing it. I can only change the location and context of the files involved from command line, once installed. – not2qubit Jun 11 '14 at 12:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.