The master branch of SELinux doesn't include native android support,
and the external selinux repo from google is limited and only targets host for tools.
You can make a few edits to get some useful binaries to use on Android on master branch
even though libsepol and libselinux aren't patched for android compliance, the tools are still useful.
dispol for example allows you to dump sepolicy rules for everything, for example you could recreate the supersu.te if you wanted.
checkpolicy allows you to write out a new sepolicy with edits.
getfilecon and setfilecon are very useful for getting contexts and setting contexts.
I only enabled a few binaries, but there are many more you can add by following the examples in the Android.mk
by default it builds:and the external selinux repo from google is limited and only targets host for tools.
You can make a few edits to get some useful binaries to use on Android on master branch
even though libsepol and libselinux aren't patched for android compliance, the tools are still useful.
dispol for example allows you to dump sepolicy rules for everything, for example you could recreate the supersu.te if you wanted.
checkpolicy allows you to write out a new sepolicy with edits.
getfilecon and setfilecon are very useful for getting contexts and setting contexts.
I only enabled a few binaries, but there are many more you can add by following the examples in the Android.mk
checkmodule
checkpolicy
chkcon
dismod
dispol
getfilecon
sefcontext_compile
setfilecon
I thought id share this here as folks often only use libsepol for sepolicy-inject and as security gets tighter it will be useful to know how to compile for target devices.
dispol is very useful, selecting a file to output to and then choosing option 1 dumps all rules.
also you can see specific rules, such as the filename_trans rule I implemented for Substratum's Interfacer,
allowing it to auto set the contexts on files it creates in /data/system/theme to "theme_data_file"
dispol is very useful, selecting a file to output to and then choosing option 1 dumps all rules.
also you can see specific rules, such as the filename_trans rule I implemented for Substratum's Interfacer,
allowing it to auto set the contexts on files it creates in /data/system/theme to "theme_data_file"
Select a command:
1) display unconditional AVTAB
2) display conditional AVTAB (entirely)
3) display conditional AVTAB (only ENABLED rules)
4) display conditional AVTAB (only DISABLED rules)
5) display conditional bools
6) display conditional expressions
7) change a boolean value
8) display role transitions
c) display policy capabilities
p) display the list of permissive types
u) display unknown handling setting
F) display filename_trans rules
f) set output file
m) display menu
q) quit
Command ('m' for menu): F
filename_trans rules:
ueventd device :chr_file klog_device __kmsg__
wpa wifi_data_file :dir wpa_socket sockets
interfacer system_data_file :file theme_data_file theme
system_server system_data_file :sock_file system_ndebug_socket ndebugsocket
hostapd wifi_data_file :dir wpa_socket hostapd
hostapd wifi_data_file :dir wpa_socket sockets
Command ('m' for menu): p
permissive sids:
recovery
su
supersu
Command ('m' for menu):
similarly checkpolicy makes it easy to write out a new policy
Theres quite a bit of trickery/makefile l33tness going on, so id encourage you to understand/look at this Sexy af Android.mk below, considering this is where most of the magic happens.
theres a submodule for libpcre2 so you'll have to use git clone --recursive, AKA
git clone --recursive https://github.com/Surge1223/selinux.git selinux-master
or ideally, just clone SELinux master and cherry-pick the 3 commits that allow building for target devices
then building also depends on the NDK build system reading the jni/Application.mk first, before Android.mk so the NDK build command is
The main purpose of me posting this here is so that in the future, if it becomes necessary to create/build tools to deal with the additional restrictions on Android, this can serve as a starting point on building.
No I dont plan on posting binaries. If you're in this thread and you can't use the NDK, then you need to up your game son.
