How to make SELinux injected rules persistent without unpacking-packing boot.img?
6
votes
2
answers
4340
views
I am working on an application that needs root access and I have a device which is rooted but not with Magisk. This device has only
adb shell
root available. So, I need an alternative to call the required functionality without the use of Magisk or other tools. I did it by placing my executable inside system directory and run it as a daemon. This daemon required access on some location which is restricted by SELinux policies.
I have injected the required policy with following commands:
sepolicy-inject -s init -t su -c process -p transition -l
sepolicy-inject -s su -t system_file -c file -p entrypoint -l
sepolicy-inject -s init -t su -c process -p rlimitinh -l
sepolicy-inject -s init -t su -c process -p siginh -l
sepolicy-inject -s su -t shell_exec -c file -p read -l
sepolicy-inject -s su -t shell_exec -c file -p execute -l
sepolicy-inject -s su -t shell_exec -c file -p getattr -l
sepolicy-inject -s su -t vendor_toolbox_exec -c file -p execute_no_trans -l
sepolicy-inject -s init -t su -c process -p noatsecure -l
sepolicy-inject -s su -t toolbox_exec -c file -p getattr -l
sepolicy-inject -s su -t toolbox_exec -c file -p execute -l
sepolicy-inject -s su -t system_file -c file -p execute_no_trans -l
sepolicy-inject -s su -t storage_file -c dir -p search -l
sepolicy-inject -s su -t storage_file -c lnk_file -p read -l
sepolicy-inject -s su -t tmpfs -c dir -p search -l
sepolicy-inject -s su -t mnt_user_file -c dir -p search -l
sepolicy-inject -s su -t mnt_user_file -c lnk_file -p read -l
sepolicy-inject -s su -t sdcardfs -c dir -p search -l
sepolicy-inject -s su -t sdcardfs -c file -p append -l
sepolicy-inject -s su -t toolbox_exec -c file -p read -l
sepolicy-inject -s su -t toolbox_exec -c file -p open -l
sepolicy-inject -s su -t sdcardfs -c file -p read -l
sepolicy-inject -s su -t sdcardfs -c file -p write -l
sepolicy-inject -s su -t sdcardfs -c file -p open -l
sepolicy-inject -s su -t media_rw_data_file -c file -p read -l
sepolicy-inject -s su -t media_rw_data_file -c file -p write -l
sepolicy-inject -s su -t media_rw_data_file -c file -p open -l
sepolicy-inject -s su -t media_rw_data_file -c file -p append -l
The problem is that they are not persistent after reboot. I know I can extract boot.img and ramdisk, replace /sepolicy with new policy file copied from /sys/fs/selinux/policy, repack boot.img and flash back.
I want to do it without reflashing boot.img
. Is there any way with which I can execute above commands after Android finishes with generating SELinux files?
I have tried following rc files:
#/etc/init/custom.rc
# define service, use executable here if script not needed
service custom /system/bin/custom.sh
# don't start unless explicitly asked to
disabled
# Use seclabel u:r:magisk:s0
to run with unrestricted SELinux context to avoid avc denials
# can also use "u:r:su:s0" on userdebug / eng builds if no Magisk
# it's required if SELinux is enforcing and service needs access
# to some system resources not allowed by default sepolicy
seclabel u:r:su:s0
# start the service when boot is completed
on property:sys.boot_completed=1
sepolicy-inject -s init -t su -c process -p transition -l
sepolicy-inject -s su -t system_file -c file -p entrypoint -l
sepolicy-inject -s init -t su -c process -p rlimitinh -l
sepolicy-inject -s init -t su -c process -p siginh -l
sepolicy-inject -s su -t shell_exec -c file -p read -l
sepolicy-inject -s su -t shell_exec -c file -p execute -l
sepolicy-inject -s su -t shell_exec -c file -p getattr -l
sepolicy-inject -s su -t vendor_toolbox_exec -c file -p execute_no_trans -l
sepolicy-inject -s init -t su -c process -p noatsecure -l
sepolicy-inject -s su -t toolbox_exec -c file -p getattr -l
sepolicy-inject -s su -t toolbox_exec -c file -p execute -l
sepolicy-inject -s su -t system_file -c file -p execute_no_trans -l
sepolicy-inject -s su -t storage_file -c dir -p search -l
sepolicy-inject -s su -t storage_file -c lnk_file -p read -l
sepolicy-inject -s su -t tmpfs -c dir -p search -l
sepolicy-inject -s su -t mnt_user_file -c dir -p search -l
sepolicy-inject -s su -t mnt_user_file -c lnk_file -p read -l
sepolicy-inject -s su -t sdcardfs -c dir -p search -l
sepolicy-inject -s su -t sdcardfs -c file -p append -l
sepolicy-inject -s su -t toolbox_exec -c file -p read -l
sepolicy-inject -s su -t toolbox_exec -c file -p open -l
sepolicy-inject -s su -t sdcardfs -c file -p read -l
sepolicy-inject -s su -t sdcardfs -c file -p write -l
sepolicy-inject -s su -t sdcardfs -c file -p open -l
sepolicy-inject -s su -t media_rw_data_file -c file -p read -l
sepolicy-inject -s su -t media_rw_data_file -c file -p write -l
sepolicy-inject -s su -t media_rw_data_file -c file -p open -l
sepolicy-inject -s su -t media_rw_data_file -c file -p append -l
start custom
but it is not working because I think Android generates SELinux files after my custom service has been triggered.
Also tried above commands on onrestart
option of init service but failed.
Any suggestion?
Asked by Vatish Sharma
(1101 rep)
Jul 22, 2019, 11:20 AM
Last activity: Aug 22, 2022, 11:36 AM
Last activity: Aug 22, 2022, 11:36 AM