Hello,
I'm running CyanogenMod 12 on a Nexus 7 (2013, flo, 2015-02-03 nightly).
I messed with SELinux contexts while on recovery (MultiROM TWRP) and now none of the applications work. I temporarily fixed it by editing the kernel's command line and setting SELinux policy to permissive and flashing the updated kernel, but this is obviously not a permanent fix as it lowers security and needs to be reset after every update. How can I restore all the contexts for all the apps without wiping data (I have important stuff)?
I tried "restorecon -FR /data/*" but it didn't help.
Thank you very much, have a nice day!
Sorry to bring this back, but this issue is likely to be shared by others (beyond me right now), so did you ever find a solution?
Well for those interested, I found a solution. To restore the SELinux context for an app whose data is in "/data/data/org.app.app", run (as root):
Code:
restorecon -Rv /data/data/org.app.app
You can run
Code:
ls -Z
before and after to see the changes made to the files.
Once SELinux context is restored, should be able to use your app normally and check that SELinux is still being enforced with getenforce:
Code:
[email protected]:/data/data/org.app.app # getenforce
Enforcing
Hope this helps.
Please help
thisisabore said:
Well for those interested, I found a solution. To restore the SELinux context for an app whose data is in "/data/data/org.app.app", run (as root):
Code:
restorecon -Rv /data/data/org.app.app
You can run
Code:
ls -Z
before and after to see the changes made to the files.
Once SELinux context is restored, should be able to use your app normally and check that SELinux is still being enforced with getenforce:
Code:
[email protected]:/data/data/org.app.app # getenforce
Enforcing
Hope this helps.
Click to expand...
Click to collapse
I'm very inexperienced with all this, and I don't understand how to do the given solution. I need step by step instructions ?. I don't know if the type of os matters, but I'm running kitkat on a rooted Samsung Galaxy s4
Mikey6God said:
I'm very inexperienced with all this, and I don't understand how to do the given solution. I need step by step instructions ?. I don't know if the type of os matters, but I'm running kitkat on a rooted Samsung Galaxy s4
Click to expand...
Click to collapse
Hi. Just to be sure, if you are very inexperienced, why do you think you are having SELinux-related issues?
Otherwise, to answer your question, you need to run these commands in a terminal emulator. So either using adb shell on your computer or directly on the device with a terminal emulator such as Termux. If you don't know how to run commands, then look into that before, as there is a real possibility to mess things up badly when using a shell as root.
thisisabore said:
Well for those interested, I found a solution. To restore the SELinux context for an app whose data is in "/data/data/org.app.app", run (as root):
Hope this helps.
Click to expand...
Click to collapse
Thank you very much. It solves all my problems !!!
I really had alot problems with selinux.
After two years, I have the solution, because of you.
Thank you very much again
I have a weird problem that I can't figure out....
I installed the rooted 5.1.1 from this thread, http://forum.xda-developers.com/xpe...3-23-4-0-546-completeguide-t3171219?nocache=1, to a rooted Z2.
Root checker shows as rooted...SuperSU and Busybox up to date, can get to # in terminal emulator. I have tried ES File Explorer, Root Explorer and Terminal emulator, and all fail. The only error message I get is from Terminal emulator which is mount: Operation not permitted.
Any ideas what might be wrong?
Thanks!
Sony ric protection is probably still running on your phone... easiest way to defeat it is to install nut's dual recovery, it disables ric on boot and works on locked bootloader:
http://forum.xda-developers.com/showthread.php?t=2261606
There is also a zip you can flash that only disables ric if you have your bootloader unlocked and a recovery in the kernel...can't remember the thread search if you need it.
Edit: SElinux might also make your system read only, if you face this problem either set nut's dual recovery .prop file to keep byeselinux always running, or install selinux mode changer app and disable it when you need.
You Sir, are a GOD to me!!!!
I already had dual recovery installed, but I updated it and problem solved!
Thank you so much for your very able assistance!
@nhpilot43 no problem, just remember something important too, don't install / update busybox from the playstore as it will break nut's dual recovery and everything that comes with it. xzdr has integrated busybox too, you don't need anything else
Will do and good to know!
I don't know if anyone else tried and ran into the same issue...
After installing Android N (NPC56W build) on my 6P I wanted to have Viper4Android working, so I enabled permissive mode.
Booom. The phone rebooted itself, I needed a few seconds to realize, it was in "safe mode", and looked like after the first boot (after flashing the rom). I was wondering what the hell went wrong. After a reboot everything went back to normal. I thought it is because the kernel doesn't support permissive mode. So I tried 3 other kernels, always the same result. Then I started to look deeper, and found out, that there is a "system integrity check", which reboots the phone into safe mode on selinux mode change.
I found the part in the source code, and disabled it. After two days of compiling, I finally got the that little binary called "logd".
I replaced the original in /system/bin in recovery and rebooted and in a root shell ran "setenforce 0". And it worked! This time no reboot, and the command "getenforce" returns "Permissive". I'm a happy person now that Viper is working.!
It was damn straight worth the 2 days of s**ing!
I didn't test it for more than an hour yet, so use it at your own risk! I'm not responsible if you phone get's damaged, or broken....
If any of you know a better solution, I'm open for it!
Otherwise: enjoy it!
This worked for me. Although it doesn't seem permissive stays through a reboot. But it's easy enough to change back. And viper works. Thanks.
bamfsig45 said:
This worked for me. Although it doesn't seem permissive stays through a reboot. But it's easy enough to change back. And viper works. Thanks.
Click to expand...
Click to collapse
Yes, the setting resets on reboot. You could put a one liner shell script in /system/etc/init.d. Then it would be set during boot.
I'm glad it worked for you too!
Is this a flashable zip?
Hmm....I also noticed this, because restoring of apps in Titanium Backup on Dev Preview only work if the phone in permissive.
Will this work in the Dev Preview 2????
EDIT: Thanks, it works for Dev Preview 2 as well
duminduweera said:
Hmm....I also noticed this, because restoring of apps in Titanium Backup on Dev Preview only work if the phone in permissive.
Will this work in the Dev Preview 2????
Click to expand...
Click to collapse
Just tested it on preview 2 and it works
TBU now able to restore my apps
hermes2xgreat said:
Is this a flashable zip?
Click to expand...
Click to collapse
I made a flashable zip to make it easier for most. Thank @gubacsek for the logd file.
This one will copy the original logd to the root of your sdcard in case you want to restore it: http://www.mediafire.com/download/6i2rrgr4f5wc4ty/copy_logd_backup.zip
MD5Sum: 800b86bb130f7cc0f558944569d62891
This one will replace the current logd with the modified logd: http://www.mediafire.com/download/9uo1j6h88x8o8z0/logd_replacement_permissive.zip
MD5Sum: f0f219552ace44e5f12297403f5fc8e3
Side Note: If you want Permissive to survive a reboot you will have to run a script in /su/su.d to make it persist.
Side Note 2: Don't forget to go into terminal and type su for root acces, then type setenforce 0 to set as permissive. You could also do this in an adb shell. You can test to see if it's in Permissive mode by typing getenforce in terminal (this info. is in the OP, but people tend to skip OP's).
EDIT: If you guys want to add a script so that SELinux boots up as Permissive every time you reboot, then flash this file: http://www.mediafire.com/download/6klkabmpa5h5xbf/add_permissive_boot.zip
MD5Ssum: ab3584c4044659653d3ec30f9732a50f
bouchigo said:
I made a flashable zip to make it easier for most. Thank gubacsek for the logd file.
This one will copy the original logd to the root of your sdcard in case you want to restore it: http://www.mediafire.com/download/6i2rrgr4f5wc4ty/copy_logd_backup.zip
MD5Sum: 800b86bb130f7cc0f558944569d62891
This one will replace the current logd with the modified logd: http://www.mediafire.com/download/9uo1j6h88x8o8z0/logd_replacement_permissive.zip
MD5Sum: f0f219552ace44e5f12297403f5fc8e3
Side Note: If you want permissive to survive you will have to run a script in /su/su.d to make it persist.
Click to expand...
Click to collapse
You're welcome! I was too lazy to create a zip file.
I will update the thread title to say it works on npc91k build too.
And I didn't even notice that TB works in permissive. I always install the app from playstore and restore only the data afterwards, because that was working. Thanks for the tip!
This is awesome. Thanks guys
This work great with my Preview 2 build.:laugh::laugh::laugh:
bouchigo said:
I made a flashable zip to make it easier for most. Thank @gubacsek for the logd file.
This one will copy the original logd to the root of your sdcard in case you want to restore it: http://www.mediafire.com/download/6i2rrgr4f5wc4ty/copy_logd_backup.zip
MD5Sum: 800b86bb130f7cc0f558944569d62891
This one will replace the current logd with the modified logd: http://www.mediafire.com/download/9uo1j6h88x8o8z0/logd_replacement_permissive.zip
MD5Sum: f0f219552ace44e5f12297403f5fc8e3
Side Note: If you want Permissive to survive a reboot you will have to run a script in /su/su.d to make it persist.
Side Note 2: Don't forget to go into terminal and type su for root acces, then type setenforce 0 to set as permissive. You could also do this in an adb shell. You can test to see if it's in Permissive mode by typing getenforce in terminal (this info. is in the OP, but people tend to skip OP's).
EDIT: If you guys want to add a script so that SELinux boots up as Permissive every time you reboot, then flash this file: http://www.mediafire.com/download/6klkabmpa5h5xbf/add_permissive_boot.zip
MD5Ssum: ab3584c4044659653d3ec30f9732a50f
Click to expand...
Click to collapse
Thanks soo much. This is a great tool to get done what I need without all the frikkin hassle
Work well on NPC91K build. Thanks
@gubacsek
I was browsing the supersu forums earlier and you should be able to type this in terminal or adb shell:
Code:
stop logd
setenforce 0
This will allow you set as permissive without replacing logd, and without rebooting into safemode.
So, we can have a script with those lines in init.d or /su/su.d to run at boot without messing with logd...this is probably good since the logd you complied may not work on Preview 3, etc.
EDIT: Just wanted to let everyone know it works. Fastboot flashed system.img to make sure logd was working as intended, meaning that it will send you to safemode when attempting to change SELinux. Once I made sure it was working properly I applied the commands mentioned earlier, and...
Success :good:
bouchigo said:
@gubacsek
I was browsing the supersu forums earlier and you should be able to type this in terminal or adb shell:
Code:
stop logd
setenforce 0
This will allow you set as permissive without replacing logd, and without rebooting into safemode.
So, we can have a script with those lines in init.d or /su/su.d to run at boot without messing with logd...this is probably good since the logd you complied may not work on Preview 3, etc.
EDIT: Just wanted to let everyone know it works. Fastboot flashed system.img to make sure logd was working as intended, meaning that it will send you to safemode when attempting to change SELinux. Once I made sure it was working properly I applied the commands mentioned earlier, and...
Success :good:
Click to expand...
Click to collapse
Nice! There is only one question left... What the f* is this logd doing? What happens if you stop it?
Anyway! Nice out of the box thinking I didn't even think about stopping it...
A very very big thanks for your great work @gubacsek and @bouchigo
With your work now I've got ViperMod and OK Google working at my N6 with preview 2 at http://forum.xda-developers.com/nexus-6/development/rom-stock-flashables-t3348657
Gesendet von meinem Nexus 6
spevil07 said:
A very very big thanks for your great work @gubacsek and @bouchigo
With your work now I've got ViperMod and OK Google working at my N6 with preview 2 at http://forum.xda-developers.com/nexus-6/development/rom-stock-flashables-t3348657
Gesendet von meinem Nexus 6
Click to expand...
Click to collapse
You are welcome! I'm happy I could help!
And I know the feeling I was also damn happy when it worked. Viper is the most important mod for me. Once heard the music through it, I can't live without it anymore...
YEAEEEEAAAAAHHH its absolutly that what i need!!!!
With this music its absolutly obligation
https://soundcloud.com/toxic-sickness/doctor-terror-exclusive-guest-mix-on-toxic-sickness-april-2016
https://soundcloud.com/eargasmpodcastofficial/eargasm-podcast-2-by-unproven
spevil07 said:
A very very big thanks for your great work @gubacsek and @bouchigo
With your work now I've got ViperMod and OK Google working at my N6 with preview 2 at http://forum.xda-developers.com/nexus-6/development/rom-stock-flashables-t3348657
Gesendet von meinem Nexus 6
Click to expand...
Click to collapse
It works without any crashes and with the screen off?
gubacsek said:
Nice! There is only one question left... What the f* is this logd doing? What happens if you stop it?
Anyway! Nice out of the box thinking I didn't even think about stopping it...
Click to expand...
Click to collapse
It looks like logd is just a logging binary; it seems like logd monitors for changes to the system that Google wants to keep track of, be it for informational purposes or, to stop people from messing with SELinux like we are seeing in this case. In this case logAudit.cpp and logAudit.h look for changes specifically to SELinux, and if one is detected it will either boot you to SafeMode, or to recovery depending on how the change comes about.
Does logd really need to be running? I'm not sure the answer to that, but I've had it shut off for the past couple of days so far with no ill effects that I have noticed.
EDIT: I compiled a new logd with preview2 source, and though it's a bit smaller in size than the one you compiled for preview 1, the result is the same as the one you compiled. It should be easy enough to compile a new logd for preview 3 in case your current one stops working for preview 3...as long as the preview 3 source is released quickly...or still use the stop logd command to completely stop it from running :good:
bouchigo said:
It seems like logd is just a logging binary; it seems like logd monitors for changes to the system that Google wants to keep track of, be it for informational purposes or, to stop people from messing with SELinux like we are seeing in this case. In this case logAudit.cpp and logAudit.h look for changes specifically to SELinux, and if one is detected it will either boot you to SafeMode, or to recovery depending on how the change comes about.
Does logd really need to be running? I'm not sure the answer to that, but I've had it shut off for the past couple of days so far with no ill effects that I have noticed.
EDIT: I compiled a new logd with preview2 source, and though it's a bit smaller in size than the one you compiled for preview 1, the result is the same as the one you compiled. It should be easy enough to compile a new logd for preview 3 in case your current one stops working for preview 3...as long as the preview 3 source is released quickly...or still use the stop logd command to completely stop it from running :good:
Click to expand...
Click to collapse
sighs... I know security and all, but it is just exhausting to try and get around new restrictions google is building into android all the time. I know it is okay for the masses, but seriously, there should be a master switch in android, or a special developer version which allows us to do what ever we want with our devices.
Anyway. Android is still by far the best and "developer friendly" OS in my opinion, so I'm just shutting up.
Yes, I also compiled a new logd already, but there is no change in the source, so of course it is working with both N builds. And I hope it will stay so in future releases
Hi,
some information for everyone who's interested: I tried to install Xposed Framework and Viper4Android on my rooted H960A and that worked very well.
1. Xposed Framework:
I just installed the latest framework V85 for arm64 and the second screen fix for MM, which you can find here.
Both zip files were flashed via TWRP after I flashed the SuperSu.zip to root my phone. Afterwards I installed the XposedInstaller_3.0-alpha4.apk.
You can find the latest xposed framework here and the Xposed Installer here.
To test the Xposed frameword I installed some modules (RootCloak and Flat Style Bar Indicators). Both modules work perfectly on the V10.
2. Viper4Android:
Why would you want to install Viper4Android if you have a very good Hifi DAC onboard? Simple answers at least for me: Viper4Android supports sound settings for Bluetooth devices. I have a nice Bluetooth headset I wanted to use with my V10 and after the installation I must say it was totally worth it.
You need:
* rooted H960A
* Viper4Android (I used version 2.4.0.1)
* install Busybox and run it at least once to obtain root rights
* set Selinux to permissive
* After the phone is rooted install Busybox and run the installation procedure to have busybox installed (current version 1.24.2).
* Then Viper4Android can be installed and started to install the drivers. The phone needs to be restarted afterwards.
* Then I tried to change Selinux setting to permissive with the app SelinuxModeChanger. But that did not work for me as after starting the app and granting root rights I just received the message that the superuser manager did not allow the application to access root or that my device is not rooted at all.
I tried a manual way by installing a terminal emulator and entering the commands
Code:
su
setenforce 0
Opening Viper4Android and showing the driver status revealed that the driver was now active.
The downside of this manual method is that after a reboot Selinux is set to enforced again and you would have to enter above commands in the terminal emulator again.
To set Selinux to permissive at boot time you can do the following:
* install the "Universal inid.d Tool" from the play store. Start the application and switch the slider at the top of the page to "on" to activate inid.d support. Reboot your phone.
* after the reboot is done start the universal init.d tool again and tap on the entry "scripts" under "Manage your inid.d scripts". Then tap on the pen symbol at the top right of the app screen to edit this script.
* a popup window opens showing "no scripts found". If you tap on this line you can change it. Remove everything and enter the following code instead:
Code:
#!/system/sh
setenforce 0
* tap on "save"
That should be it. Now every reboot Selinux is set to permissive again.
Have fun.
If you have questions I will try to answer them.
thank you very much for this tutorial
did you notice any battery drain ?
vip57 said:
thank you very much for this tutorial
did you notice any battery drain ?
Click to expand...
Click to collapse
No, so far no noticeable battery drain. But I have this running only since yesterday afternoon. I will observe the battery consumption an let you now should I notice any drain.
Hi guys.
Selinux mode changer can't get root access, so i can't use ViperFX. On lolipop it was working properly, but not on Marshmallow. Does anyone know maybe some solution to change the Selinux to permissive? There is some command through ADB, and it's working, but after hard restart, it goes back to enforce. I need a permanent solution, if there is any, or if there is any other way to run ViperFX without changing to permissive... Thanks.
Use kernel adiutor app and download plugin.