Hot answers tagged

7

Pardon me if I fail to sum up the wast subject in a brief answer :) SELINUX AND AVC DENIALS Android is based on Linux kernel that makes use of Discretionary and Mandatory Access Controls (DAC, MAC) to restrict access to system resources such as files on a certain filesystem. DAC includes classic UNIX RWX file modes, owner/group or UID/GID, Extended ...


5

How much is the possibility that Android will kill my executable? Privileged native processes usually don't get killed by Android except if they can't handle an error occurred inside, such as some system resource not available or permission denied because of SELinux etc. To free up memory, Android only kills processes within its framework i.e. running under ...


3

If it’s the terminal thing @IrfanLatif wrote, try this: #!/system/bin/sh # run a command block in the background, detached from all terminals /system/bin/sh -T- -c ' # Wait for boot to complete until [ "$(getprop sys.boot_completed)" ]; do sleep 300 done while true; do ( new_dir="/storage/emulated/0/temp/AppData/$...


3

Your SD card isn't prepared at the time that the bind command is executed, because the mounting process hasn't ended yet. To bind, you have to wait several seconds for the mounting of SD card & external SD to be finished. #!system/bin/sh sleep 10 n="$(dumpsys mount | grep -c 'external')" until [ $n -eq 1 ] do sleep 1 n="$(dumpsys ...


3

ROOT USER AND SELINUX: User root (with UID 0) is the super user in Discretionary Access Control (DAC) implementation of *NIX operating systems. DAC is allowed by-default i.e. anyone can access anything unless UIDs, GIDs and permission mode restrict something. So root can do anything because it's the kernel's SUPER USER who isn't denied anything. SELinux is ...


2

I finally managed to solve the problem. There are two problems: You're not using the "exactly the same identity of adb shell". There are a couple of groups to which adb shell belongs but they're not mentioned in that exec command. /system/bin/am on its own is not executable, it's a shell script and should be passed to /system/bin/sh to be executed. So, ...


1

By running the command dmesg | grep -C5 initAsic I saw that I was getting this error code returned service initAsic does not have a SELinux domain defined The issue what that I needed to add the line seclabel u:r:init:s0 to my init service as this is a requirement of init. The complete service now looks like this. The disabled keyword has also been added ...


1

Removing avb checks form boot.img/ramdisk/fstab.qcom has fixed the issue.


1

To patch the policies, do the following: Change the value in /system/etc/selinux/plat_and_mapping_sepolicy.cil.sha256 OR empty this file. Inject required policies in /system/etc/selinux/plat_sepolicy.cil "Loading compiled SELinux policy" should show in logs and the init service will run fine.


1

Use init's write command in /init.rc or any other .rc file. You may also create your own: # /system/etc/init/custom.rc on property:sys.boot_completed=1 write /proc/sys/kernel/hostname MyDroid Set permissions and reboot device. ~# chown 0.0 /system/etc/init/custom.rc ~# chmod 0644 /system/etc/init/custom.rc ~# chcon u:object_r:system_file:s0 /system/...


1

The init service you have defined won't inject SELinux policy rules because of two reasons: The syntax of sepolicy-inject commands is incomplete; .rc files aren't shell scripts. The correct syntax would be: #/etc/init/custom.rc ... on property:sys.boot_completed=1 exec - -- /system/bin/sepolicy-inject -s init -t su -c process -p transition -l ... ...


1

Here the error is: audit: type=1400 audit(1560142274.289:131): avc: denied { transition } for pid=8035 comm="init" path="/system/bin/custom.sh" dev="sda24" ino=8146 scontext=u:r:init:s0 tcontext=u:r:su:s0 tclass=process permissive=0 In easy words it states that init is running with its context u:r:init:0, you want it to execute /system/bin/custom.sh with ...


1

My comment does not work too. I have understood, sleep does not work then screen is off. You should perhaps keep the system awaked for sleep command to be working.


1

Having no success with sleep, I ended up going the crond route, as suggested by @Irfan Latif: /system/su.d/99crond (-rwx------ root root) #!/system/bin/sh # File: 99crond # Desc: Start cron daemon ( # Wait for boot to complete until [ "$(getprop sys.boot_completed)" ] do sleep 2 done # Symlink default cron dir to /data/local/crontabs ...


1

I think that most easy way would be by using app Kernel Adiutor. It has ability to emulate init.d Open app and swipe from left edge, it will reveal menu, scroll to tools section and than tap on init.d There you have a switch to enable or disable init.d emulator, for devices that doesn't support init.d, in bottom right you have a "plus" icon to add scripts ...


1

Just use any root file manager like root browser and browse to system/etc/init.d and delete all scripts manually Alternatively, download and install terminal emulator. Open it and enter these commands One by One-> su mount -o rw,remount /system mkdir /sdcard/init/ cp /system/etc/init.d /sdcard/init/ rm -r /system/etc/init.d/* In first command, we gain ...


1

If you have stock ROM you probably don't have init.d support. Permissions of file located in init.d folder should be 755 or 777. If you don't have init.d support you can use kernel adiutor which have init.d emulator


1

In my version of Android (cm11 / LolliKat) there is a 90userinit script in init.d that tries to run a script named /data/local/userinit.sh if it finds it. I've not tried this, but naming your script /data/local/userinit.sh might do the trick. [I know it's an old question, but for posterity...]


1

You have two choices here: Edit the stock kernel (or the kernel you're using) to enable init.d support or edit the init.rc Use a custom kernel with init.d support already enabled. I would suggest the second option as is far more easier to achieve. Once flashed a kernel with init.d support, you can add all the scripts you want to the folder that will be ...


Only top voted, non community-wiki answers of a minimum length are eligible