It appears root access is irrelevant on my device as everything is managed by SeLinux (the root user basically can’t execute anything).

The problem is I can’t just create my new polices. I need to keep the existing ones in order to keep the fingerprint scanner and the lte module firmwares happy.

Almost every settings seem to be in sepolicy. But this is a binary file:

% file sepolicy
sepolicy: SE Linux policy v30 MLS 8 symbols 7 ocons

I just found apol from setools to view it’s content but not to dump or edit it.

What’s the expected way to edit such file’s type?

  • Example CentOS 8 : $ file sepolicy → → sepolicy: Python script, ASCII text executable, with very long lines Mar 28, 2020 at 15:18
  • @KnudLarsen in my case, that’s a binary file generated by vendor through the standard SELinux format not a python script. It exists. I need to keep most of what it contains (the phone crash with SELinux disabled). I need a way to read first without learning the binary format details (I mean I don’t want to do it inside an hex editor but something more friendly). Mar 28, 2020 at 15:31
  • There are tools like sepolicy-inject which you can use to edit a selinux database. But you won't be able to edit that file on android, because it's part of the initramfs boot image. You can of course rebuild the boot image and reflash your device. The process is quite complicated and involves factory-resetting your device.
    – mosvy
    Mar 28, 2020 at 16:39
  • build permissive kernel from source, otherwise you will face a chiggen-egg-dilemma
    – alecxs
    Mar 28, 2020 at 16:46
  • @mosvy flashing the boot image is how I can modify the file. But I can’t modify /system only the initrd. Mar 28, 2020 at 16:50


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.