[Q] 'Correct' way to compile a permissive SELinux kernel? topic

SOCIALIZE IT ⇨

As the title suggests, I'm attempting to compile a (Lollipop) Nexus 5 kernel with SELinux in permissive mode by default. For reference, I am using the msm kernel source tree at commit 8a80a0e.

I have managed to accomplish this by modifying msm/security/selinux/selinuxfs.c and inserting new_value = 0; into sel_write_enforce to prevent the mode being changed:


Code:

        length = -EINVAL;
        if (sscanf(page, "%d", &new_value) != 1)
                goto out;

        new_value = 0; /* inserted this line */

        if (new_value != selinux_enforcing) {
                length = task_has_security(current, SECURITY__SETENFORCE);
                if (length)
                        goto out;
                audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_STATUS,
                        "enforcing=%d old_enforcing=%d auid=%u ses=%u",

This method, however, doesn't seem particularly good, as it relies on the intricacies of the specific implementation of SELinux used in this kernel, and prevents the mode being changed later.

This post suggests changing the CONFIG_ALWAYS_ENFORCE flag for a Samsung device, however the Nexus 5 kernel does not appear to have such an option. Setting the default state of SELinux using various menuconfig options and kernel command line parameters does not appear to have any effect, and disabling it entirely causes the device to crash after boot, before any logcat output is produced.

I have noticed than when started with a kernel with SELinux enabled, one of the first messages from logcat is from auditd, of the form enforcing=1 old_enforcing=0 auid=... ses=..., indicating that something is setting the SELinux mode to enforcing almost immediately after boot.

Thus, I am wondering if anyone knows where this command to set SELinux to enforcing comes from, how to disable it, or another way to compile a kernel with SELinux set to permissive?

xda-developers


  1. [KERNEL] 5.1 modified kernel (Alpha) topic
  2. [Q] Kernel for cm7 topic
  3. OC Kernel for I9195 CM12 topic
  4. {Q}Why Dont Update Kernel Version By Samsung? topic
  5. Is root required to roll back to KitKat? topic
  6. [REQ] Multi DPI Stock Camera topic
  7. May be this is it for Xperia J topic
  8. [Q] No IMEI and baseband anymore. So back to stock rom for repair! topic
  9. [Q] New to phone - on 24A rooted - where to go from here? topic
  10. Htc desire 816 official lollipop update video review topic
  11. [Q] Galaxy S6 Edge T-Mobile Unlock by SIM code topic
  12. How to roll back to KK topic
  13. What is this in Greenify settings topic
  14. [Q] How to update? topic
  15. [REQ] N900 Kernel With Permissive SELinux topic
  16. SELINUX mode topic
  17. Selinux mod topic
  18. How to correct the pink tint of the screen ? topic
  19. [Q] 'Correct' way to compile a permissive SELinux kernel? topic
  20. correct region? topic

0 commentaires:

Enregistrer un commentaire

©2014 mobile | Design by MyBloggerBlog