i.MX Processors中的主题 Re: Android 7.1 SELinux vdc & sh unlabeled boot fail

Android 7.1 SELinux vdc & sh unlabeled boot fail

ericnelson1 — Thu, 08 Feb 2018 17:19:59 GMT

I am porting Android 7.1 to our IMX53 product. I ran into a problem with SELinux that doesn't seem to make sense. The boot log looks like this:

[ 3.506650] Freeing unused kernel memory: 1024K
[ 3.528875] init: init first stage started!
[ 3.553382] SELinux: Permission validate_trans in class security not defined in policy.
[ 3.562534] SELinux: Class cap_userns not defined in policy.
[ 3.568418] SELinux: Class cap2_userns not defined in policy.
[ 3.574269] SELinux: Class bpf not defined in policy.[ 3.579623] SELinux: the above unknown classes and permissions will be denied
[ 3.701006] audit: type=1403 audit(3.689:2): policy loaded auid=4294967295 ses=4294967295
[ 3.712563] audit: type=1404 audit(3.699:3): enforcing=1 old_enforcing=0 auid=4294967295 ses=4294967295
[ 3.745760] init: (Initializing SELinux enforcing took 0.21s.)
[ 3.766315] init: init second stage started!
[ 3.792985] init: Running restorecon...
[ 3.880962] init: waitpid failed: No child processes
[ 3.887834] init: (Loading properties from /default.prop took 0.00s.)
[ 3.903302] init: (Parsing /init.environ.rc took 0.00s.)
[ 3.910929] init: (Parsing /init.usb.rc took 0.00s.)
[ 3.918296] init: (Parsing init.rti.usb.rc took 0.00s.)
[ 3.923605] init: (Parsing /init.rti.rc took 0.01s.)
[ 3.931310] init: (Parsing /init.usb.configfs.rc took 0.00s.)
[ 3.937856] init: (Parsing /init.zygote32.rc took 0.00s.)
[ 3.962443] ueventd: ueventd started!
[ 4.942899] ueventd: Coldboot took 0.97s.
[ 5.078709] EXT4-fs (mmcblk0p2): mounted filesystem with ordered data mode. Opts: (null)
[ 5.139472] EXT4-fs (mmcblk0p3): mounted filesystem with ordered data mode. Opts: errors=panic
[ 5.182104] EXT4-fs (mmcblk0p4): mounted filesystem with ordered data mode. Opts: errors=panic
[ 5.493959] audit: type=1400 audit(5.479:4): avc: denied { execute } for pid=110 comm="init" name="vdc" dev="mmcblk0p2" ino=654340 scontext=u:r:init:s0 tcontext=u:object_r:unlabeled:s0 tclass=file permissive=0
[ 5.593161] binder: 111:111 transaction failed 29189/-22, size 0-0 line 3004
[ 5.607788] audit: type=1400 audit(5.599:5): avc: denied { execute } for pid=112 comm="init" name="sh" dev="mmcblk0p2" ino=654293 scontext=u:r:init:s0 tcontext=u:object_r:unlabeled:s0 tclass=file permissive=0
[ 6.663334] binder: 111:111 transaction failed 29189/-22, size 0-0 line 3004
[ 7.670798] binder: 111:111 transaction failed 29189/-22, size 0-0 line 3004
[ 8.678255] binder: 111:111 transaction failed 29189/-22, size 0-0 line 3004
[ 9.685626] binder: 111:111 transaction failed 29189/-22, size 0-0 line 3004

As you can see "vdc", and "sh" seem to be missing a label for SELinux. However, I clearly see the label being set in android source under /system/sepolicy/file_contexts:

/system/bin/sh -- u:object_r:shell_exec:s0

/system/bin/vdc u:object_r:vdc_exec:s0

Further, if I try to provide my own label for these same files in /device/rti/kx10/sepolicy/file_contexts, I get a compile errors:

out/target/product/kx10/obj/ETC/file_contexts.bin_intermediates/file_contexts.concat.tmp: Multiple same specifications for /system/bin/sh.

out/target/product/kx10/obj/ETC/file_contexts.bin_intermediates/file_contexts.concat.tmp: Multiple same specifications for /system/bin/vdc.

So if sh & vdc have a label defined, why does the SELinux audit indicates these files are "unlabeled"???

Because of this error I cannot get a shell started to allow me to use other debug tools (ex. logcat). Does anyone have any ideas, thoughts, or suggestions that might help me proceed??

Thanks in advance,

Eric Nelson

Re: Android 7.1 SELinux vdc & sh unlabeled boot fail

b36401 — Fri, 09 Feb 2018 09:27:56 GMT

Please try to set androidboot.selinux=disabled option in u-boot.

Have a great day,
Victor

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

Re: Android 7.1 SELinux vdc & sh unlabeled boot fail

ericnelson1 — Mon, 12 Feb 2018 16:59:04 GMT

Thanks for the suggestion Victor. I changed the linux command line in uboot to androidboot.selinux=disabled. The debug UART during boot now shows selinux set to disabled:

[ 0.000000] Kernel command line: console=ttymxc1,115200 init=/init androidboot.console=ttymxc1 androidboot.selinux=disabled androidboot.hardware=rti fec_mac=16:25:34:43:52:61

Later in the boot log when android starts, I see similar (but not identical) behavior. Strangely I still see SeLinux message with "denied", and "permissive=0":

[ 3.496813] Freeing unused kernel memory: 1024K
[ 3.519002] init: init first stage started!
[ 3.543559] SELinux: Permission validate_trans in class security not defined in policy.
[ 3.552690] SELinux: Class cap_userns not defined in policy.
[ 3.558577] SELinux: Class cap2_userns not defined in policy.
[ 3.564467] SELinux: Class bpf not defined in policy.
[ 3.569671] SELinux: the above unknown classes and permissions will be denied
[ 3.690836] audit: type=1403 audit(3.679:2): policy loaded auid=4294967295 ses=4294967295
[ 3.702339] audit: type=1404 audit(3.689:3): enforcing=1 old_enforcing=0 auid=4294967295 ses=4294967295
[ 3.735700] init: (Initializing SELinux enforcing took 0.21s.)
[ 3.756117] init: init second stage started!
[ 3.782669] init: Running restorecon...
[ 3.871135] init: waitpid failed: No child processes
[ 3.878082] init: (Loading properties from /default.prop took 0.00s.)
[ 3.893401] init: (Parsing /init.environ.rc took 0.00s.)
[ 3.901061] init: (Parsing /init.usb.rc took 0.00s.)
[ 3.908407] init: (Parsing init.rti.usb.rc took 0.00s.)
[ 3.913779] init: (Parsing /init.rti.rc took 0.01s.)
[ 3.921436] init: (Parsing /init.usb.configfs.rc took 0.00s.)
[ 3.928031] init: (Parsing /init.zygote32.rc took 0.00s.)
[ 3.952284] ueventd: ueventd started!
[ 4.933427] ueventd: Coldboot took 0.97s.
[ 5.069612] EXT4-fs (mmcblk0p2): mounted filesystem with ordered data mode. Opts: (null)
[ 5.122878] EXT4-fs (mmcblk0p3): recovery complete
[ 5.132952] EXT4-fs (mmcblk0p3): mounted filesystem with ordered data mode. Opts: errors=panic
[ 5.190442] EXT4-fs (mmcblk0p4): recovery complete
[ 5.198959] EXT4-fs (mmcblk0p4): mounted filesystem with ordered data mode. Opts: errors=panic
[ 5.479781] audit: type=1400 audit(5.469:4): avc: denied { execute } for pid=110 comm="init" name="vdc" dev="mmcblk0p2" ino=654340 scontext=u:r:init:s0 tcontext=u:object_r:unlabeled:s0 tclass=file permissive=0
[ 5.598026] binder: 111:111 transaction failed 29189/-22, size 0-0 line 3004
[ 5.617970] audit: type=1400 audit(5.609:5): avc: denied { execute } for pid=112 comm="init" name="sh" dev="mmcblk0p2" ino=654293 scontext=u:r:init:s0 tcontext=u:object_r:unlabeled:s0 tclass=file permissive=0
[ 6.672095] binder: 111:111 transaction failed 29189/-22, size 0-0 line 3004
[ 7.679587] binder: 111:111 transaction failed 29189/-22, size 0-0 line 3004
[ 8.687039] binder: 111:111 transaction failed 29189/-22, size 0-0 line 3004
[ 9.694341] binder: 111:111 transaction failed 29189/-22, size 0-0 line 3004
[ 10.682690] init: Starting service 'console'...
[ 10.692087] audit: type=1400 audit(10.679:6): avc: denied { execute } for pid=115 comm="init" name="sh" dev="mmcblk0p2" ino=654293 scontext=u:r:init:s0 tcontext=u:object_r:unlabeled:s0 tclass=file permissive=0
[ 10.711351] binder: 111:111 transaction failed 29189/-22, size 0-0 line 3004
[ 10.719237] init: cannot execve('/system/bin/sh'): Permission denied
[ 10.727762] init: Service 'console' (pid 115) exited with status 127
[ 10.734198] init: Service 'console' (pid 115) killing any children in process group
[ 11.711681] binder: 111:111 transaction failed 29189/-22, size 0-0 line 3004
[ 12.719108] binder: 111:111 transaction failed 29189/-22, size 0-0 line 3004
[ 13.726545] binder: 111:111 transaction failed 29189/-22, size 0-0 line 3004
[ 14.733860] binder: 111:111 transaction failed 29189/-22, size 0-0 line 3004
[ 15.741400] binder: 111:111 transaction failed 29189/-22, size 0-0 line 3004
[ 15.748768] init: Starting service 'console'...
[ 15.758260] audit: type=1400 audit(15.749:7): avc: denied { execute } for pid=116 comm="init" name="sh" dev="mmcblk0p2" ino=654293 scontext=u:r:init:s0 tc

Taking your suggestion further I tried setting SeLinux to permissive:

[ 0.000000] Kernel command line: console=ttymxc1,115200 init=/init androidboot.console=ttymxc1 androidboot.selinux=permissive androidboot.hardware=rti fec_mac=16:25:34:43:52:61

[ 3.506792] Freeing unused kernel memory: 1024K
[ 3.529112] init: init first stage started!
[ 3.553537] SELinux: Permission validate_trans in class security not defined in policy.
[ 3.562679] SELinux: Class cap_userns not defined in policy.
[ 3.568567] SELinux: Class cap2_userns not defined in policy.
[ 3.574421] SELinux: Class bpf not defined in policy.
[ 3.579777] SELinux: the above unknown classes and permissions will be denied
[ 3.701027] audit: type=1403 audit(3.689:2): policy loaded auid=4294967295 ses=4294967295
[ 3.712812] init: (Initializing SELinux non-enforcing took 0.18s.)
[ 3.733396] init: init second stage started!
[ 3.760392] init: Running restorecon...
[ 3.848540] init: waitpid failed: No child processes
[ 3.855405] init: (Loading properties from /default.prop took 0.00s.)
[ 3.870987] init: (Parsing /init.environ.rc took 0.00s.)
[ 3.878685] init: (Parsing /init.usb.rc took 0.00s.)
[ 3.886130] init: (Parsing init.rti.usb.rc took 0.00s.)
[ 3.891443] init: (Parsing /init.rti.rc took 0.01s.)
[ 3.899093] init: (Parsing /init.usb.configfs.rc took 0.00s.)
[ 3.905626] init: (Parsing /init.zygote32.rc took 0.00s.)
[ 3.929687] ueventd: ueventd started!
[ 4.919447] ueventd: Coldboot took 0.98s.
[ 5.056730] EXT4-fs (mmcblk0p2): mounted filesystem with ordered data mode. Opts: (null)
[ 5.169732] EXT4-fs (mmcblk0p3): recovery complete
[ 5.182124] EXT4-fs (mmcblk0p3): mounted filesystem with ordered data mode. Opts: errors=panic
[ 5.284456] EXT4-fs (mmcblk0p4): recovery complete
[ 5.293213] EXT4-fs (mmcblk0p4): mounted filesystem with ordered data mode. Opts: errors=panic
[ 5.572581] audit: type=1400 audit(5.559:3): avc: denied { execute } for pid=110 comm="init" name="vdc" dev="mmcblk0p2" ino=654340 scontext=u:r:init:s0 tcontext=u:object_r:unlabeled:s0 tclass=file permissive=1
[ 5.592848] audit: type=1400 audit(5.579:4): avc: denied { execute_no_trans } for pid=110 comm="init" path="/system/bin/vdc" dev="mmcblk0p2" ino=654340 scontext=u:r:init:s0 tcontext=u:object_r:unlabeled:s0 tclass=file permissive=1
[ 54.755199] random: crng init done

With SeLinux set to permissive, I don't get the repeating binder errors, but I still don't get my console (hitting keys on the terminal does nothing). Note, I have verified my UART connection by booting into U-Boot, and booting into the Linux kernel without launching android.

Your (or anyone else's) help is greatly appreciated. Any other ideas, or things to try?

Re: Android 7.1 SELinux vdc & sh unlabeled boot fail

timgruijters — Thu, 26 Jul 2018 15:19:56 GMT

Hey Eric,

Did you solve your problem in the meantime? I'm experiencing the same problem:
audit: type=1400 audit(63.320:4): avc: denied { write } for pid=1 comm="init" name="mmcblk0p1" dev="tmpfs" ino=8892 scontext=u:r:init:s0 tcontext=u:object_r:boot_block_device:s0 tclass=blk_file permissive=0
audit: type=1400 audit(63.430:5): avc: denied { execute } for pid=204 comm="init" name="vdc" dev="mmcblk0p1" ino=45961 scontext=u:r:init:s0 tcontext=u:object_r:unlabeled:s0 tclass=file permissive=0
audit: type=1400 audit(63.490:6): avc: denied { execute } for pid=206 comm="init" name="sh" dev="mmcblk0p1" ino=45869 scontext=u:r:init:s0 tcontext=u:object_r:unlabeled:s0 tclass=file permissive=0

With kind regards,
Tim

Re: Android 7.1 SELinux vdc & sh unlabeled boot fail

ericnelson1 — Thu, 26 Jul 2018 18:41:47 GMT

Hi Tim,

Unfortunately I did not. I have since abandon the en devour & gone to a different processor & different BSP. Although I still wish I knew the answer if for no other reason than to learn from it.

Re: Android 7.1 SELinux vdc & sh unlabeled boot fail

timgruijters — Sun, 07 Oct 2018 14:24:19 GMT

Hey Eric,

Thank you for your response. My problem results from the SELinux context being dropped by copying a file from the system image when the context from that file isn't understood by the operating system and archiving it into a tarball. Although tar has the 'p' option for preserving permissions for files, it doesn't keep the SELinux context.

With kind regards,

Tim