It appears root access is irrelevant on my device as everything is managed by SeLinux (the root user basically can’t execute anything).

The problem is I can’t just create my new polices. I need to keep the existing ones in order to keep the fingerprint scanner and the lte module firmwares happy.

Almost every settings seem to be in sepolicy. But this is a binary file:

% file sepolicy
sepolicy: SE Linux policy v30 MLS 8 symbols 7 ocons

I just found apol from setools to view it’s content but not to dump or edit it.

What’s the expected way to edit such file’s type?

  • Example CentOS 8 : $ file sepolicy → → sepolicy: Python script, ASCII text executable, with very long lines – Knud Larsen Mar 28 '20 at 15:18
  • @KnudLarsen in my case, that’s a binary file generated by vendor through the standard SELinux format not a python script. It exists. I need to keep most of what it contains (the phone crash with SELinux disabled). I need a way to read first without learning the binary format details (I mean I don’t want to do it inside an hex editor but something more friendly). – user2284570 Mar 28 '20 at 15:31
  • There are tools like sepolicy-inject which you can use to edit a selinux database. But you won't be able to edit that file on android, because it's part of the initramfs boot image. You can of course rebuild the boot image and reflash your device. The process is quite complicated and involves factory-resetting your device. – mosvy Mar 28 '20 at 16:39
  • build permissive kernel from source, otherwise you will face a chiggen-egg-dilemma – alecxs Mar 28 '20 at 16:46
  • @mosvy flashing the boot image is how I can modify the file. But I can’t modify /system only the initrd. – user2284570 Mar 28 '20 at 16:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.