Android 9 Pie - Sepolicy

leonardoprates — Thu, 24 Dec 2020 11:05:35 GMT

In Android 9 I start a shell script at init.rc as a Android service. At ENG build I can see AVC denied messages from Sepolicy and add all permissions requested, one by one, dozens of them.

In ENG build (even without giving SEPolicy the permissions) my script works as expected, but at USER build the script doesn't work. The problem is that at USER build I cant start the script manually to see any echo messages to debug whats happens and at USER I cant see any new AVC denied messages. If I give all SePolicy permissions why the script doesn't work at USER build? Are there a way to force Android show AVC denied messages from USER build (I'm considering that there are necessary permissions that were not requested with AVC messages in the ENG variant).

Thanks,

Leonardo

Re: Android 9 Pie - Sepolicy

Zhiming_Liu — Tue, 29 Dec 2020 02:54:12 GMT

Sepolicy has three modes:Enforcing, Permissive,Disabled.You can use getenforce to see which mode it run.In/etc/selinux/config you can set sepolicy mode and i think you can set Permissive,the sepolicy will show avc messages but will not stop the scripts you add.

Zhiming

i.MX ProcessorsのトピックRe: Android 9 Pie - Sepolicy

Android 9 Pie - Sepolicy

Re: Android 9 Pie - Sepolicy