2

I'm writing a root app following Chainfire's documentation, but I found I've to run some command in another SELinux context.

Using that context on my device (OnePlus One with CM12 nightly), I've no problem, but when I try to run it on another device (HTC One) the command fails. If I temporarily disable SELinux (setenforce 0), the command runs without problems.

The analysis I made revealed that some file on the HTC One has a different SELinux domain than the OnePlus One. I used ls -Z and id -Z to figure out where the problem was and I verified the output of supolicy --dumpav, too.

Is it possible to find the SELinux policies definitions of the flagship devices from all the major OEMs?

It could be sufficient a supolicy --dumpav output of each device.

1

Yes, but it depend where these policy files are stored. Many manufacturers like to move stuff around, thinking their own security solution is better. On top of that depending on you AOS version, things may have changed again, since SEAndroid is a quite recent implementation. One place to look for these files is at the Android Census site. There you can navigate to each device policy/context file. For example:

/seapp_contexts:

isSystemServer=true domain=system
user=system domain=system_app type=system_data_file
user=bluetooth domain=bluetooth type=bluetooth_data_file
user=nfc domain=nfc type=nfc_data_file
user=radio domain=radio type=radio_data_file
user=_app domain=untrusted_app type=app_data_file
user=system name=com.sec.knox.containeragent domain=knox_system_app type=system_data_file
user=system name=com.policydm domain=knox_system_app type=system_data_file
user=_app name=com.centrify.mdm.samsung seinfo=knox_untrusted domain=knox_untrusted_app type=app_data_file
...
  • Hey wonderful resource! So I can download the sepolicy file and inspect it with a GNU/Linux box and the command sesearch -A sepolicy, too. Great. – MaxChinni Feb 5 '15 at 16:43
  • @m-chinni Yeah, but if we could find some Android binary to do the same, that would be awesome. It's a real PITA to have to transfer the files to a linux box, just to see what's inside. Apparently Chainfire has some tool to inject policy files with. That would be great to have, since Samsung are doing a great job at supplying broken SE policies... – not2qubit Feb 5 '15 at 16:55
  • 1
    Chainfire's supolicy can live patch and dump SELinux policies. The command supolicy --dumpav I wrote in the question can be run on the device itself. – MaxChinni Feb 5 '15 at 17:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.