Questions tagged [selinux]
For questions relating to error messages and other problems that throw up references to selinux.
103 questions
23
votes
1
answer
57k
views
How dangerous is the fact that SELinux is in "Permissive" mode? What should I be wary of?
I have installed a certain ROM which comes with SELinux in "Permissive" mode. This is the only (good) ROM that properly fits my device and there is no way to change the state of SELinux.
Now I'm not ...
- 333
22
votes
1
answer
11k
views
SELinux and chroot system call
TL; DR: This is a question about the final step, in a portable, developer-oriented rooting process, that works across all Android machines. It is not based on any exploit - it is something that we are ...
- 691
16
votes
4
answers
66k
views
How to unpack/repack system.img of android ROM?
I have OnePlus 6T device which has A/B partition system and has a ROM of user type i.e [ro.build.type]: [user]. This device is rooted with Magisk. I have a requirement(Want to place customized ...
- 1,061
13
votes
5
answers
11k
views
Examine android (v30) selinux policy
I'm trying to find what policy is actually enforced by my phone using selinux. You'd think this would be easy. After all, for security it is good to verify that your policy matches expectations. ...
- 271
12
votes
1
answer
35k
views
How to run DNSCrypt as a background service on Android?
I've installed an unofficial lineage OS 14.1 ROM on my phone and i want to have dnscrypt used on boot by default.
There is what i have done:
Download arm binaries from: https://github.com/jedisct1/...
- 121
9
votes
1
answer
5k
views
How does SuperSu provide root privilege?
Has a write-up ever been released on exactly how SuperSu works? After searching around for a while I found mostly guides on how to use the app, not the implementation details.
I did, however, find ...
- 235
8
votes
2
answers
55k
views
How to disable dm-verity on Android with "user" build type ROM?
I have One Plus 6T Android device which has a ROM of build type user. This device is rooted with Magisk and I want to disable dm-verity on this device. I have tried to run adb disable-verity but I got ...
- 1,061
8
votes
1
answer
68k
views
How can I change SELinux from Enforcing to Permissive on Samsung Galaxy Note 3?
My device is Samsung Galaxy Note 3 SM-N9005.
This phone comes with SELinux set to Enforcing by default.
I have been trying to change this to permissive but to no avail.
I built the kernel from ...
- 181
7
votes
1
answer
10k
views
What special privileges "/system/xbin/su" does have w.r.t. root access?
This answer says:
Because of the way directory/file permissions are configured on
Android, you need to have the su binary on your /system partition
in order for it to work. Putting elsewhere ...
- 201
7
votes
1
answer
14k
views
What does TWRP "Fix Contexts" do?
In my blu_spark TWRP, I have an option (under "Advanced") named 'Fix Contexts'.
When I press it, it says:
Note: Fixing contexts is rarely needed
Fixing SELinux Contexts may cause your ...
- 457
6
votes
2
answers
4k
views
How to make SELinux injected rules persistent without unpacking-packing boot.img?
I am working on an application that needs root access and I have a device which is rooted but not with Magisk. This device has only adb shell root available. So, I need an alternative to call the ...
- 1,061
5
votes
1
answer
2k
views
How to run a program in an app context with Magisk?
Let's say I'm currently as root in Bash on a terminal, outside any app like Termux. I'm running Magisk.
Now I want to synchronously invoke Termux's Bash, such that it behaves the same way as it would ...
- 653
4
votes
1
answer
3k
views
What is 02 in the magisk patched vbmeta.img?
According to the Additional Info given for rooting the Android device that doesn't have ramdisk but can be rooted via recovery: we need an empty vbmeta.img and I am trying to check what it actually ...
- 1,061
4
votes
1
answer
5k
views
SELinux permissive kernel - is it a security risk?
As in title. I am talking of Kernel, not ROM (plenty of questions dealing with ROM on this site).
I have a OnePlus 7 running stock Android 10 and prefer a custom kernel. Of late, OnePlus hasn't ...
- 41.3k
4
votes
1
answer
6k
views
Where can I configure SELinux in Cyanogenmod 10.1.3?
Cyanogenmod released the stable version 10.1.3 yesterday and it apparently includes SELinux enhancements running in permissive mode per default.
I thought that you could change the mode in the ...
- 257
4
votes
1
answer
5k
views
How to mount system under super partion?
Google has recently changed the way to mount system and introduced Dynamic Partitions. Previously in a rooted adb shell, I used to run mount -o rw,remount /system to mount system in read-write mode. ...
- 1,061
4
votes
1
answer
11k
views
What is SELinux and its purpose?
For those of you who don't know, SELinux is a collection of administrative tools on Linux OS'. However, what is it for on android, and what does it do on android? After all, Android is not Linux.
...
- 1,721
4
votes
1
answer
6k
views
How can I set the correct SELinux / SEAndroid policy for an App?
I am using the free SSHelper SSH server on my phone to get SSH access. However, the application is not behaving correctly under SELinux when set to Enforcing mode, but seem to be OK when using ...
- 847
4
votes
1
answer
4k
views
How to disable dm-verity on `Treble` , `system-as-root` device?
Background: Please check following links
How to disable dm-verity on Android with “user” build type ROM?
Stuck in boot-loop when unpack and pack system.img?
Update: So, I am trying to disable dm-...
- 1,061
4
votes
1
answer
385
views
Does Android's implementation of SELinux's MAC inhibit apps with root privileges from accessing other app's data?
Starting with Android 4.4, SELinux's MAC is enforced. Does this mean that if an app somehow can get installed and exploit the kernel to get root privileges, that MAC will still prevent that app with ...
3
votes
1
answer
29k
views
How to fix: only official released binaries are allowed to be flashed(recovery) on device / FAIL! (Auth) on Odin3 v3.13?
I have Samsung S10 5G(Qualcomm) device. This device has unlocked bootloader but it is not rooted yet.
I am trying to learn Unpack-Modify-Pack the ROM images.
Currently, I have VZW stock ROM ...
- 1,061
3
votes
1
answer
2k
views
Is it possible to find the full SELinux ruleset for OEM's stock ROMs?
I'm writing a root app following Chainfire's documentation, but I found I've to run some command in another SELinux context.
Using that context on my device (OnePlus One with CM12 nightly), I've no ...
- 1,095
3
votes
1
answer
1k
views
Can't remount /system as rw because "read only filesystem" (SELinux problem)
I tried to replace Kingroot with SuperSU since in the newer versions of Kingroot you can't block all of its connections. I had some problems, SuperSU always failed to install the newer binaries, ...
- 41
3
votes
1
answer
3k
views
Android 6 (cyanogenmod 13) external sd card write access
I always used "Samba server" application on all my android devices for uploading files, it worked great with CM12, but in CM13 even with root access Samba server can't write to external SD card, ...
- 141
3
votes
1
answer
7k
views
How to fix file permissions on Android 5 so that a certain app can access certain files?
Background: I had a rooted Nexus 4 with Android 4.4.4 that was working well. Then I got the notification to update to Android 5. To this end, I flashed the stock recovery for Android 4.4.4 from Google ...
- 211
3
votes
0
answers
430
views
Create custom SELinux domain using magiskpolicy
Tried to make custom domain for an app that is installed from PlayStore. I created a module that would patch the policy at boot and edited system/etc/selinux/plat_seapp_contexts to assign the app my ...
- 31
3
votes
0
answers
157
views
unable to connect to my nexus 10 with android 4.4 and cyanogenmod with a remote desktop manager
Hello android users and developers.
I would like to give a developer temporary access to my tablet so he can help me solve a problem. On the tablet is running android 4.4 + cyanogen mod 11. I have ...
- 213
2
votes
1
answer
5k
views
Why reading permission to /proc/1/maps is denied and why doesn't the denial appear in logcat?
I'm developing a native app for Android, and I'm occasionally confronted with permission denied which doesn't trigger a log in the logcat logs.
For example, trying to run:
shell@kltevzw:/ $ cat /proc/...
- 23
2
votes
1
answer
2k
views
How SElinux protects android from rooting
I know when rooting we execute a script and we use a thing that is already root and tell it to execute if it executes the script as root and then roots the phone so how does SElinux helps to protect ...
- 238
2
votes
1
answer
4k
views
What sepolicy context will allow any other context to access it?
I am on a bootloader locked Sprint Samsung Galaxy S7, eng boot.img flashed to phone with SELinux permissive, which gives root adb shell from where I can change system partitions, debloat, install ...
- 121
2
votes
1
answer
9k
views
SELinux prevents my init.rc exec command to execute
I've added a exec command at the end of init.rc file.
on property:dev.bootcomplete=1
exec u:r:shell:s0 shell shell -- /system/bin/am start -n com.example.package/com.example.package.MainActivity
...
- 157
2
votes
3
answers
44k
views
How to make SELinux permissive on a Knox Samsung device?
I have a Samsung note 2014 which I rooted following this tutorial. However I now have problems with SELinux which (apparently) is preventing me from installing a Linux virtual box. I backed up and ...
- 169
2
votes
1
answer
2k
views
Exploring options for customizing SeLinux policy ( SePolicy to enable bind-mounting ) , including kernel recompilation
As I realized selinux for Android is more than tad bit different creature than what I can get done on Linux . I need SeLinux policy to be modified so I can bind mount my folders. Unless that happens ...
- 81
2
votes
1
answer
2k
views
Run script using init.rc doesn't work
I'm trying to run a script that exectues when the device has finished booting. This particular device does not support running scripts from an init.d directory, which is why I am using init.rc.
The ...
- 41
2
votes
1
answer
169
views
How are apps installed on Android ? context - symbolic links of only some apps disappear after reboot
I am using Apps2sd to move some apps to ext4 partition mmcblk1p2. It successfully moved 1 app ( see code below ) but after linking another , the symblink for app gets deleted but data folder's ...
- 507
2
votes
1
answer
2k
views
Need to add custom script as service in init.rc for Android 10
I am trying run shell script in device boot-up time.
Steps:
Created shell script and placed into /system/bin/usbmountd.sh
Added test.sh in inir.rc.
service usbmountd /system/bin/usbmountd.sh
user ...
- 129
2
votes
1
answer
4k
views
lsusb returns "permission denied" in Termux
When I run lsusb in Termux, the output is permission denied. I don't have root access.
Perhaps the Android system allows me to get specific access in root?
- 121
2
votes
0
answers
578
views
How to redirect DNS traffic to dnsmasq on Android
I’m trying filter all DNS traffic using dnsmasq on Android (LineageOS). Here is what I did (thanks to the help of @IrfanLatif):
I installed it using termux:
pkg i root-repo && pkg up &&...
- 101
2
votes
0
answers
339
views
pstore/ramoops won't work on Poco M3, rooted
I'm trying to use pstore logs on my Poco M3. I tried everything. PSTORE configs are activated on the kernel, pstore module is loaded on the phone, phone is rooted, /sys/fs/pstore is mounted ...
- 71
2
votes
0
answers
770
views
remount, turn off SElinux, all fails even though I am root
I have a device which is never hacked into before, mostly as nobody has it, it is a android tv box. I have temp root using the dirty cow exploit, and tried to remount system using the mount command. ...
2
votes
0
answers
61
views
How would the app DiskDigger be able to get past SELinux when adbd/SuperSU/etc. cannot?
Okay, so I was able to recover my deleted files after all. I am the furthest thing from a software developer, and I don't have more time to spend on this, but I wanted to explain how I fixed it and ...
- 49
2
votes
0
answers
951
views
SUPolicy to allow custom service to read and write from Internal Storage
I'm setting up custom service with custom sepolicy using this as a base:
How to fix SELinux "avc: denied" errors when launching DNSCrypt as init.d script?
In 99% I follow the quick summary ...
- 79
2
votes
1
answer
7k
views
How to set SELinux enforcing, config file not found?
I have Samsung Galaxy J7 Core (SM-J701F), I'm running Magisk on my device and I ran the SafteyNet test and it failed. While trying to solve this I tried to change selinux state to enforced by editing /...
2
votes
0
answers
1k
views
Write protection of loop device // Read-Only Filesystem
After spending days on that topic I am in need of additional ideas ;)
Facts: MTK6757 / Android 7 / Kernel 4.4.15 / FS EXT4 (No F2FS) / Working Root
I have a fresh and clean 64MB EXT4 .IMG File in /...
- 21
2
votes
0
answers
627
views
Tried many ways to root my Telenor Infinity E
I have been trying to root my phone for two weeks using various exploits but till now all in vain. The devices isn't international so its not famous and I couldn't find any recovery, custom root or ...
- 121
2
votes
0
answers
1k
views
SELinux context init_shell in boot.img permission denied with Android 5.0.2
I'am used to start a service in the android boot image with inherited context of the init.rc script (u:r:init:s0).
In Android 5.0.2 (Samsung), my service does not inherity the init context anymore, it ...
- 186
2
votes
1
answer
1k
views
selinux denies busybox although selinux is set to permissive?
Device-info:
Phone: Sony Xperia Z1
Model number: C6903
Android version: 5.1.1
Build Number: 14.6.A.1.236
Rooted, BusyBox and Terminal Emulator installed (Play Store Version!!!)
I have formatted an ...
- 203
1
vote
1
answer
190
views
SELinux denials after migrating application data between devices
I'm trying to migrate application data between devices. The application was installed to the work profile using Shelter The steps I did were:
On source phone, tar cvf appdata.tar.gz /data/user/10/com....
- 259
1
vote
1
answer
30k
views
How to set SELinux to Permissive
Since installing XtreStoLite 3.1.1, SELinux is set to Enforcing (when I try to boot into TWRP recovery). I tried setting it to permissive (Enforcing = 0) using a terminal emulator (the phone is rooted)...
- 71
1
vote
1
answer
8k
views
ssh: No controlling tty: open /dev/tty: No such device or address
When connecting from PC/Cygwin via SSH (over WiFi) to phone, I am always greeted with the following macabre message:
$ ssh -T [email protected] -p 50000
Authenticated with partial success.
root@192....
- 847