Hot answers tagged

20 votes
Accepted

How dangerous is the fact that SELinux is in "Permissive" mode? What should I be wary of?

TL;DR: Feel free to jump directly to the conclusion at the bottom if you like :) ! SELinux goal is to prevent privilege escalation by enforcing a mandatory policy which restricts possible actions ...
user avatar
15 votes

How to fix SELinux "avc: denied" errors when launching DNSCrypt as init.d script?

Pardon me if I fail to sum up the vast subject in a brief answer :) SELINUX AND AVC DENIALS Android is based on Linux kernel that makes use of Discretionary and Mandatory Access Controls (DAC, MAC) to ...
user avatar
  • 17.6k
12 votes
Accepted

SELinux and chroot system call

Who the heck is blocking me from chrooting? It wasn't SELinux - that was a wild goose chase (getenforce returning "Permissive" means that SELinux is indeed no longer in the picture). The culprit - ...
user avatar
  • 701
12 votes
Accepted

How to disable dm-verity on Android with "user" build type ROM?

I'm going to give a general overview of how dm-verity and related things work on Android according to my limited knowledge. Situation might differ on different devices and ROMs. HOW IS DM-VERITY ...
user avatar
  • 17.6k
8 votes

Examine android (v30) selinux policy

First of all, I must admit that I fully agree with your "I've found this shockingly hard to do" statement. Google has designed Android mainly from a consumer perspective, and not for power users. The ...
user avatar
8 votes

What special privileges "/system/xbin/su" does have w.r.t. root access?

Since Android is based on Linux kernel, getting root access by executing /system/xbin/su - like one can do on a Linux system - used to work in good old days but not now. The story is a bit twisted. ...
user avatar
  • 17.6k
7 votes
Accepted

Why reading permission to /proc/1/maps is denied and why doesn't the denial appear in logcat?

REASON 1: Apart from traditional Discretionary Access Control (DAC), - that makes use of *NIX owner/group/mode of processes/files to allow/deny access - Android implements several other access ...
user avatar
  • 17.6k
7 votes

How does SuperSu provide root privilege?

SuperSU is no more actively developed, the new prevailing standard is Magisk which was originally based on SuperSU (ideas and perhaps some code too) but now it has moved far ahead. So better go for a ...
user avatar
  • 17.6k
7 votes

What does TWRP "Fix Contexts" do?

SELinux is a security mechanism which stops unauthorized access of processes to other processes, actions and filesystems (UNIX's "file" includes all regular files, directories, block devices, ...
user avatar
  • 17.6k
6 votes

How can I change SELinux from Enforcing to Permissive on Samsung Galaxy Note 3?

If you're rooted, install Android Terminal Emulator from Play Store and open a root shell. Also make sure you use latest (>2.00) SuperSU to handle SELinux. Then type: su 0 setenforce 0 and see what ...
user avatar
  • 817
6 votes

How to unpack/repack system.img of android ROM?

These commands don't work always: sometimes the system_new.img size becomes greater than system.img.ext4 and hence it doesn't flash on the device. As per my knowledge, the new image size should be ...
user avatar
6 votes
Accepted

What is 02 in the magisk patched vbmeta.img?

According to this piece of source code by Intel, there is an uint32_t starting at position0x78 (120) and ending at 0x7b (124). This location is marked as "flags from the AvbVBMetaImageFlags ...
user avatar
  • 2,907
5 votes
Accepted

How SElinux protects android from rooting

SELinux depends upon labels to match actions and policies. Labels determine what is allowed. Sockets, files, and processes all have labels in SELinux. SELinux decisions are based fundamentally on ...
user avatar
  • 1,927
5 votes

How to run a program in an app context with Magisk?

Android framework takes care of a lot of things when forking an app from zygote. In short, it's nearly impossible to run an app process from commandline so that it behaves “exactly the same way” as if ...
user avatar
  • 17.6k
4 votes

What sepolicy context will allow any other context to access it?

ROOT USER AND SELINUX: User root (with UID 0) is the super user in Discretionary Access Control (DAC) implementation of *NIX operating systems. DAC is allowed by-default i.e. anyone can access ...
user avatar
  • 17.6k
3 votes

How to set SELinux to Permissive

If SELinux Mode Changer doesn't work, and you are properly rooted, then your kernel likely isn't compiled with permissive mode and was compiled with the flag EXTRA_CFLAGS += -DCONFIG_ALWAYS_ENFORCE=...
user avatar
  • 5,816
3 votes
Accepted

How to fix: only official released binaries are allowed to be flashed(recovery) on device / FAIL! (Auth) on Odin3 v3.13?

For LZ4 compression: lz4 -B6 --content-size system.img.ext4 system.img.ext4.lz4 command can be used to make a valid Odin Flashable file. To Fix "FAIL! (Auth)", we need to truncate the vbmeta.img file ...
user avatar
3 votes
Accepted

SELinux permissive kernel - is it a security risk?

SELinux is a security framework which restricts (kernel and userspace) processes within their domains according to defined policy. So the ultimate goal is to load a working policy, label filesystems ...
user avatar
  • 17.6k
2 votes

How can I set the correct SELinux / SEAndroid policy for an App?

I think the problem could be the default "unconfined domain" the binary gets executed when no policy is specified. An attempt I'd try would be to move the sshelper_sshd (I think it's the ...
user avatar
  • 1,075
2 votes

ssh: No controlling tty: open /dev/tty: No such device or address

You are using ssh -T which prevents tty(4) allocation. Without a controlling tty, many things do not work – without any tty at all, a lot more things do not work. Do note that your original problem ...
user avatar
  • 633
2 votes

Examine android (v30) selinux policy

You should first build an older version of libsepol from the AOSP code (like the one corresponding the 6.0 version), then link sepolicy-inject, dispol, etc against it. This recipe worked for me on ...
user avatar
  • 121
2 votes
Accepted

Is it possible to find the full SELinux ruleset for OEM's stock ROMs?

Yes, but it depend where these policy files are stored. Many manufacturers like to move stuff around, thinking their own security solution is better. On top of that depending on you AOS version, ...
user avatar
  • 817
2 votes
Accepted

What is SELinux and its purpose?

The purpose of SElinux is for security and explained by the Android site: As part of the Android security model, Android uses SELinux to enforce mandatory access control (MAC) over all processes, ...
user avatar
  • 2,498
2 votes
Accepted

SELinux prevents my init.rc exec command to execute

I finally managed to solve the problem. There are two problems: You're not using the "exactly the same identity of adb shell". There are a couple of groups to which adb shell belongs but they're not ...
user avatar
  • 157
2 votes
Accepted

How to make SELinux injected rules persistent without unpacking-packing boot.img?

The init service you have defined won't inject SELinux policy rules because of two reasons: The syntax of sepolicy-inject commands is incomplete; .rc files aren't shell scripts. The correct syntax ...
user avatar
  • 17.6k
2 votes

SELinux Policy from Permissive to Enforcing

If a custom ROM has SEL set to enforcing, it means the dev is confident that features are working under strict SEL, and you can safely change it to permissive knowing that things will continue to work ...
user avatar
  • 9,370
2 votes

how to extend support for EXT4 file system for microSD cards in stock or non lineage / CyanogenMod ROMS

I don't think I understand your question fully. It's not clear what and how you have tried so far and faced what constraints or limitations in achieving what you want to. But precisely answering your ...
user avatar
  • 17.6k
2 votes

How to mount system under super partion?

On devices with enough disk space one can convert ext4-dedup dynamic partition into r/w system partition. This can be done offline on linux computer using (official) Dynamic Partition Tools lpunpack ...
user avatar
  • 3,215
1 vote

lsusb returns "permission denied" in Termux

lsusb command lists entries in /sys/bus/usb/devices which is world-readable but SELinux would be denying access because u:r:untrusted_app:s0 context isn't allowed to access u:object_r:sysfs:s0. ...
user avatar
  • 17.6k
1 vote

Fix SELinux contexts for a SU binary

Apps can't elevate their privileges by making use of set-uid-root or file capabilities. It's due to Security Enhancements in Android 4.3: No setuid/setgid programs. Added support for filesystem ...
user avatar
  • 17.6k

Only top scored, non community-wiki answers of a minimum length are eligible