[Patch] Persistent automatic disabling SELinux in any kernel

[Bonoboo]

Warning: SELinux – important security feature.
After disabling it you obliviously make Android less secure. Use it on your own risk.

Why it needed?
SELinux can prevent work some mods, like Viper. Or you can have own reasons.
Executing in Terminal "setenforce 0" or via scripts / apps turns SELinux off only after booting: this is not good.
This solution disables SELinux directly in kernel.
Compatible with any MIUI or custom ROM.

How it works
After flashing ZIP creates kernel dump, then it repacks with new command line androidboot.selinux=permissive and writes back.
Into /system/bin copied script.sh and two binaries: mkbootimg and unpackbootimg plus auto-restore script (addon.d)
Last required for keeping and launching that files at every ROM update. This works only on custom ROM's, on MIUI you need re-apply patch manually.

Note: on previous phone at some rare unknown conditions after updating ROM kernel repackaging ended with error and device can't boot.
In this case enter recovery and restore boot from backup or flash boot.img from ROM via fastboot / TWRP.

How to install
1. Once flash attached ZIP
2. Then flash required mods

How to delete
1. Delete file /system/addon.d/99-selinux.sh (and other, that belong to mods that not work with SELinux)
2. Flash current ROM

P.S. This patch probably will work on any device (at least with custom ROM because stock kernel can use different structure).
Rare, but may be required change path to boot partition in script.sh: /dev/block/bootdevice/by-name/boot, twice.

 

[lebigmac]

Hi does this method still work in Android 10 and newer?
Great job. This is exactly what I was searching for!

 

[Bonoboo]

does this method still work in Android 10 and newer?

Very likely, don't know for sure because still on Pie. Try yourself and share result

 

[lebigmac]

When I run this command:

cat /proc/cmdline

I get this result:

BOOT_IMAGE=/boot/vmlinuz-5.0.0-13-generic root=UUID=XXXXX-XXXX-XXXX-XXXX-XXXXXXXXX ro quiet splash vt.handoff=1

Maybe in Android 10 and newer they moved the androidboot.selinux=permissive parameter to somewhere else kind of like how they moved the system partition into the super image?

 

[Bonoboo]

Maybe in Android 10 and newer they moved parameter to somewhere else

Parameter not present by default.

It's not clear if you tried to flash ZIP. If yes and got no result: probably script can't handle changes in boot.img structure because it was created 4 years ago. Try some tool on PC to unpack boot and add line manually.

 

[DocMAX]

after setting this parameter the phone wont boot