1

My application is working in permissive mode, but not in Enforcing mode for SEAndroid. Here i cleared (allowed) all denials,so now there is no denial logs coming in my logcat logs.So it might be cause dontaudit rules to hide denials. For that how to disable dontaudit denials in SEAndroid.... Please Suggest me the command to disable dontaudit in SEAndroid.

Thanks,

  • How did you clear the denials? – Vincent Achard Jun 10 at 21:06
  • Cleared denials by writing allow rules .. Thanks, – rammohan Jun 11 at 0:38
0

Dontaudit is an avc rule: https://selinuxproject.org/page/AVCRules#dontaudit

Disabling this rule is like disabling neverallow, allow, or auditallow rules: it involves re-writing the selinux policy. To do so you have to modify the .te files concerning your app's SEcontext in 2 directories in your aosp source:

system/sepolicy/private/
system/sepolicy/public/

you then rebuild the selinux_policy module in aosp (via make selinux_policy)

then copy 3 compiled files to your phone:

cd  out/target/product/<the_name_of_your_build>/system/etc/selinux/
adb push plat_sepolicy.cil plat_and_mapping_sepolicy.cil.sha256 plat_file_contexts /etc/selinux/

reboot the phone and... voilà!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.