Hot answers tagged

13

TL;DR: Feel free to jump directly to the conclusion at the bottom if you like :) ! SELinux goal is to prevent privilege escalation by enforcing a mandatory policy which restricts possible actions from both unprivileged and privileged users. The term "users" here also includes any process running on the device, no matter if it is directly related to the ...


12

Who the heck is blocking me from chrooting? It wasn't SELinux - that was a wild goose chase (getenforce returning "Permissive" means that SELinux is indeed no longer in the picture). The culprit - after adding quite a number of printk in the kernel's source to trace the failures of both chroot and mount - turned out to be capabilities. More specifically, ...


8

First of all, I must admit that I fully agree with your "I've found this shockingly hard to do" statement. Google has designed Android mainly from a consumer perspective, and not for power users. The result is that, as soon as you want to do something outside of using the latest Facebook app or playing with Candy Crush, you very quickly find yourself back in ...


7

I'm going to give a general overview of how dm-verity and related things work on Android according to my limited knowledge. Situation might differ on different devices and ROMs. HOW IS DM-VERITY ENFORCED? dm-verity (Verified Boot and AVB) as well as dm-crypt (FDE) are targets of device-mapper feature of Linux kernel. dm-verity verifies the integrity of ...


7

Pardon me if I fail to sum up the wast subject in a brief answer :) SELINUX AND AVC DENIALS Android is based on Linux kernel that makes use of Discretionary and Mandatory Access Controls (DAC, MAC) to restrict access to system resources such as files on a certain filesystem. DAC includes classic UNIX RWX file modes, owner/group or UID/GID, Extended ...


6

If you're rooted, install Android Terminal Emulator from Play Store and open a root shell. Also make sure you use latest (>2.00) SuperSU to handle SELinux. Then type: su 0 setenforce 0 and see what happens. Check with id. If that doesn't work, also try with: su system setenforce 0. In AOS >4.3, it's not enough to just be "root" (uid=0), you also have to use ...


6

SELinux is a security mechanism which stops unauthorized access of processes to other processes, actions and filesystems (UNIX's "file" includes all regular files, directories, block devices, character devices, sockets etc.). Every process, file, directory and action is labeled with an SELinux context, then a policy is defined what a context can do to other ...


6

According to this piece of source code by Intel, there is an uint32_t starting at position0x78 (120) and ending at 0x7b (124). This location is marked as "flags from the AvbVBMetaImageFlags enumeration", which "must be set to zero if the vbmeta image is not a top-level image". On to the enumeration itself. AvbVBMetaImageFlags is defined in the same file and ...


4

SELinux depends upon labels to match actions and policies. Labels determine what is allowed. Sockets, files, and processes all have labels in SELinux. SELinux decisions are based fundamentally on labels assigned to these objects and the policy defining how they may interact. In SELinux, a label takes the form: user:role:type:mls_level, where the type is the ...


4

Go to Settings -> About phone menu and scroll all the way to the bottom: Tap the "SELinux status" menu 3 times in a row in a quick succession. This will bring up a prompt asking you to confirm enabling the other modes: Be aware that currently this feature is still under heavy development, and isn't supported on all devices yet.


4

REASON 1: Apart from traditional Discretionary Access Control (DAC), - that makes use of *NIX owner/group/mode of processes/files to allow/deny access - Android implements several other access control mechanisms of Linux kernel to make itself more secure, such as Seccomp Filter was implemented in Oreo. REASON 2: While DAC is allowed by-default, SELinux (a ...


4

Since Android is based on Linux kernel, getting root access by executing /system/xbin/su - like one can do on a Linux system - used to work in good old days but not now. The story is a bit twisted. WHAT IS SUID? Special thing about /system/xbin/su isn't that it's in /system partition, but the set-user-ID-root (SUID) bit set on this binary makes it special. ...


4

Android framework takes care of a lot of things when forking an app from zygote. In short, it's nearly impossible to run an app process from commandline so that it behaves “exactly the same way” as if the app was properly launched. Continue reading to have an idea of why it's so. In order to run bash in Termux app's context so that it behaves exactly the ...


3

ROOT USER AND SELINUX: User root (with UID 0) is the super user in Discretionary Access Control (DAC) implementation of *NIX operating systems. DAC is allowed by-default i.e. anyone can access anything unless UIDs, GIDs and permission mode restrict something. So root can do anything because it's the kernel's SUPER USER who isn't denied anything. SELinux is ...


3

If SELinux Mode Changer doesn't work, and you are properly rooted, then your kernel likely isn't compiled with permissive mode and was compiled with the flag EXTRA_CFLAGS += -DCONFIG_ALWAYS_ENFORCE=true which doesn't allow permissive mode to be set in anyway. You will need to get the kernel source from the manufacturer, which should be available if they ...


3

SuperSU is no more actively developed, the new prevailing standard is Magisk which was originally based on SuperSU (ideas and perhaps some code too) but now it has moved far ahead. So better go for a new actively maintained open-source solution wherever possible. Or if you want some adventure, try this: How to manually root a phone?. My answer to How Magisk ...


3

SELinux is a security framework which restricts (kernel and userspace) processes within their domains according to defined policy. So the ultimate goal is to load a working policy, label filesystems with proper contexts and set SELinux enforcing. It doesn't matter who does this; kernel or some userspace process, though the sooner the better. And permissive ...


2

I think the problem could be the default "unconfined domain" the binary gets executed when no policy is specified. An attempt I'd try would be to move the sshelper_sshd (I think it's the sshd server?) somewhere on the /system partition (/system/sbin/?) I think the best and updated document to read to deal with SELinux implementation on Android (SEAndroid) ...


2

You are using ssh -T which prevents tty(4) allocation. Without a controlling tty, many things do not work – without any tty at all, a lot more things do not work. Do note that your original problem is not due to the lack of a controlling tty, but due to the lack of a pty/tty pair allocation. What you are having here is basically input line “editing” – in ...


2

The purpose of SElinux is for security and explained by the Android site: As part of the Android security model, Android uses SELinux to enforce mandatory access control (MAC) over all processes, even processes running with root/superuser privileges (a.k.a. Linux capabilities). SELinux enhances Android security by confining privileged processes and ...


2

You should first build an older version of libsepol from the AOSP code (like the one corresponding the 6.0 version), then link sepolicy-inject, dispol, etc against it. This recipe worked for me on debian jessie: cd /to/the/aosp/dir [repo init, etc] repo sync external/selinux cd external/selinux git checkout android-6.0.0_r1^ cd libsepol make libsepol=`pwd` ...


2

I finally managed to solve the problem. There are two problems: You're not using the "exactly the same identity of adb shell". There are a couple of groups to which adb shell belongs but they're not mentioned in that exec command. /system/bin/am on its own is not executable, it's a shell script and should be passed to /system/bin/sh to be executed. So, ...


2

If a custom ROM has SEL set to enforcing, it means the dev is confident that features are working under strict SEL, and you can safely change it to permissive knowing that things will continue to work under a more lax SEL environment. On the other hand, however, if he chooses to release with SEL permissive (especially if he lists it in the "bugs" section), ...


2

I don't think I understand your question fully. It's not clear what and how you have tried so far and faced what constraints or limitations in achieving what you want to. But precisely answering your questions: Mount multi ext4 partitioned external card at boot time, as against manual mounting which I can do Mounting external SD card is handled by vold. ...


1

See this answer and this issue for details on how SELinux is enforced on Android. In short it depends on cmdline parameters of kernel and build configuration of init. Check on your device: ~# cat /proc/cmdline It must contain androidboot.selinux=permissive. You need to remove this parameter from kernel cmdline permanently in order to enforce SELinux on ...


1

These commands don't work always: sometimes the system_new.img size becomes greater than system.img.ext4 and hence it doesn't flash on the device. As per my knowledge, the new image size should be equal to or less than the size of the original system image. ---- If anyone will be able to determine the new commands then please share it. To Unpack-Modify-Pach ...


1

The init service you have defined won't inject SELinux policy rules because of two reasons: The syntax of sepolicy-inject commands is incomplete; .rc files aren't shell scripts. The correct syntax would be: #/etc/init/custom.rc ... on property:sys.boot_completed=1 exec - -- /system/bin/sepolicy-inject -s init -t su -c process -p transition -l ... ...


1

I'm not an expert, but disabling SELinux is almost certainly more insecure. Nothing that's not already in /system should be able to write there without root in either case, or an exploit that would let malicious code remount it anyways. But disabling SELinux hamstrings Android's process sandboxing and access controls, meaning a malicious app could modify ...


1

To the people facing the issue with: policydb version 30 does not match my version range 15-29 while working with AOSP code. Assuming, your AOSP code is checked out to ~/android/source dir: cd ~/android/source source build/envsetup.sh export ANDROID_BUILD_TOP=$(pwd) And now you are free to use bundled audit2allow utility: ./external/selinux/prebuilts/...


1

You should try to apply this patch to the sources of libsepol, and then incrementaly rebuild all that stuff. It worked for me in the sam issue You can try to use libsepol clone with applied patch from this repo https://metizik@bitbucket.org/metizik/selinux_tools.git I use it to build dispol under Windows, and it works to me fine (still notice that I'm ...


Only top voted, non community-wiki answers of a minimum length are eligible