Hello,
I'm running CyanogenMod 12 on a Nexus 7 (2013, flo, 2015-02-03 nightly).
I messed with SELinux contexts while on recovery (MultiROM TWRP) and now none of the applications work. I temporarily fixed it by editing the kernel's command line and setting SELinux policy to permissive and flashing the updated kernel, but this is obviously not a permanent fix as it lowers security and needs to be reset after every update. How can I restore all the contexts for all the apps without wiping data (I have important stuff)?
I tried "restorecon -FR /data/*" but it didn't help.
Thank you very much, have a nice day!
Sorry to bring this back, but this issue is likely to be shared by others (beyond me right now), so did you ever find a solution?
Well for those interested, I found a solution. To restore the SELinux context for an app whose data is in "/data/data/org.app.app", run (as root):
Code:
restorecon -Rv /data/data/org.app.app
You can run
Code:
ls -Z
before and after to see the changes made to the files.
Once SELinux context is restored, should be able to use your app normally and check that SELinux is still being enforced with getenforce:
Code:
[email protected]:/data/data/org.app.app # getenforce
Enforcing
Hope this helps.
Please help
thisisabore said:
Well for those interested, I found a solution. To restore the SELinux context for an app whose data is in "/data/data/org.app.app", run (as root):
Code:
restorecon -Rv /data/data/org.app.app
You can run
Code:
ls -Z
before and after to see the changes made to the files.
Once SELinux context is restored, should be able to use your app normally and check that SELinux is still being enforced with getenforce:
Code:
[email protected]:/data/data/org.app.app # getenforce
Enforcing
Hope this helps.
Click to expand...
Click to collapse
I'm very inexperienced with all this, and I don't understand how to do the given solution. I need step by step instructions ?. I don't know if the type of os matters, but I'm running kitkat on a rooted Samsung Galaxy s4
Mikey6God said:
I'm very inexperienced with all this, and I don't understand how to do the given solution. I need step by step instructions ?. I don't know if the type of os matters, but I'm running kitkat on a rooted Samsung Galaxy s4
Click to expand...
Click to collapse
Hi. Just to be sure, if you are very inexperienced, why do you think you are having SELinux-related issues?
Otherwise, to answer your question, you need to run these commands in a terminal emulator. So either using adb shell on your computer or directly on the device with a terminal emulator such as Termux. If you don't know how to run commands, then look into that before, as there is a real possibility to mess things up badly when using a shell as root.
thisisabore said:
Well for those interested, I found a solution. To restore the SELinux context for an app whose data is in "/data/data/org.app.app", run (as root):
Hope this helps.
Click to expand...
Click to collapse
Thank you very much. It solves all my problems !!!
I really had alot problems with selinux.
After two years, I have the solution, because of you.
Thank you very much again
Related
Hey guys, I came up with a basic set of tools which I find useful. You may redistribute , include in any custom ROMs and/or distributions.
This includes:
Rewrite /default.prop for ADB
Install and deploy busybox in /system/xbin
install bash, ipctool, strace, tcpdump, and viewmem binaries.
To install, you must be rooted.
Unzip the attached file
place it on your nook.
cd to the folder you installed
Run the following
Code:
sh /sdcard/BHT/run.sh
Please note, I use Android Market app QuickSSH to get into my nook terminal, your results may very.. I hope someone else grabs these files and makes it all more user friendly. I've got too many other things going on.
I encourage other developers to include these valuable debugging tools in their packages.
You, sir, are a monster! You get my vote.
Sent from my Nexus S using xda premium
AdamOutler said:
Hey guys, I came up with a basic set of tools which I find useful. You may redistribute , include in any custom ROMs and/or distributions.
This includes:
Rewrite /default.prop for ADB
Install and deploy busybox in /system/xbin
install bash, ipctool, strace, tcpdump, and viewmem binaries.
To install, you must be rooted.
Unzip the attached file
place it on your nook.
cd to the folder you installed
Run the following
Code:
sh /sdcard/BHT/run.sh
Please note, I use Android Market app QuickSSH to get into my nook terminal, your results may very.. I hope someone else grabs these files and makes it all more user friendly. I've got too many other things going on.
I encourage other developers to include these valuable debugging tools in their packages.
Click to expand...
Click to collapse
I can turn this into an apk, if you don't mind. By turn on adb with this method, adb will be rooted and the device will still be allowed to sleep?
brianf21 said:
I can turn this into an apk, if you don't mind. By turn on adb with this method, adb will be rooted and the device will still be allowed to sleep?
Click to expand...
Click to collapse
By all means. Please do.
My vote too. I just hope after you win that you keep up the great work on the Nook Tablet. The last two weeks or so have looked very promising towards getting custom roms on here and a lot of that has to do with Adam's hard work along with a few others
Nearly all of these are already in snowball-mod, but I'll include ipctool, and viewmem for the next release.
cfoesch said:
Nearly all of these are already in snowball-mod, but I'll include ipctool, and viewmem for the next release.
Click to expand...
Click to collapse
How did you get default.prop reread into memory? The only think I can see is the 2nd init hijack? Am I missing something a lot easier?
brianf21 said:
How did you get default.prop reread into memory? The only think I can see is the 2nd init hijack? Am I missing something a lot easier?
Click to expand...
Click to collapse
Note, I said "nearly all". I don't really see though how changing /default.prop would keep over reboots... rootfs is stored in memory and recreated every time, isn't it?
I've added the binaries to NT Hidden Settings. I have not implemented /default.prop swap yet. I have to play with hijacking init before I do. Thanks again.
brianf21 said:
I've add the binaries to NT Hidden Settings. I have not implemented /default.prop swap yet. I have to play with hijacking init before I do. Thanks again.
Click to expand...
Click to collapse
cool. where are you hosting that binary? I currently have a mirror set up at nook1.adamoutler.com for easy access... When someone gets a new device, they need to download 3 things onto their device to make it a real tablet.. nook1=hidden settings, nook2=homecatcher, nook3=market.. I may change 3 to launcherpro, but hidden settings is the number1 tool required for the nook Tablet.
AdamOutler said:
cool. where are you hosting that binary? I currently have a mirror set up at nook1.adamoutler.com for easy access... When someone gets a new device, they need to download 3 things onto their device to make it a real tablet.. nook1=hidden settings, nook2=homecatcher, nook3=market.. I may change 3 to launcherpro, but hidden settings is the number1 tool required for the nook Tablet.
Click to expand...
Click to collapse
Homecatcher? I mean, I understand if you want to keep using the B&N store and stuff, but if you don't care about the B&N stuff, then the hacked SystemUI.apk is a way better option than Homecatcher.
But then, you're advancing "launcher pro", while I would more generally say "any non-B&N launcher"...
I added another option to nt hidden settings to run adb as root. It doesn't require a reboot and it automatically turns off auto mount. I am using nemith's adbd.
remount / as rw
stop adbd
replace /sbin/adbd
remount / as ro
setprop to turn off auto mount
start adbd as root
It's not persistent after reboot, but it works and doesn't kill the battery. I am not going to bother with hkvc's hijacking init method, because it looks like you, hkvc, bauwks, and nemith will be able to replace the os soon. Thanks.
I would like to think I am very familiar with GNU/Linux/UN*X permissions, but I don't have the foggiest idea as to what "fix permissions" does in Android recoveries and apps.
Is anyone willing to give an accurate overview of what's happening? If so, please do. Finally, can anyone point me towards some opensource code that implements such a task? That would be most appreciated.
Thanks in advance.
exiquio said:
I would like to think I am very familiar with GNU/Linux/UN*X permissions, but I don't have the foggiest idea as to what "fix permissions" does in Android recoveries and apps.
Is anyone willing to give an accurate overview of what's happening? If so, please do. Finally, can anyone point me towards some opensource code that implements such a task? That would be most appreciated.
Thanks in advance.
Click to expand...
Click to collapse
In order not to have applications to affect others, Android creates a new user/group to store data for each app and the permission information is keep in packages.xml. fix_permissions is to ensure permission integrity.
ROM Manager bundles fix_permissions shell script (I am sure others too):
/data/data/com.koushikdutta.rommanager/files/fix_permissions
Tingtan already explained the process of fix permissions and suggested ROM Manager as the shell commander but you can also fix permissions in CWM recovery by going to advanced/fix permissions/yes
Sent from my PC36100 using XDA App
hmmm, not realy clear for newbie like me, can you explain what problem will happen if fix permision ( in CMW ) is needed but i don't do it ?
When I flashed a rom, I always fix permissions at the end, then reboot.. That's how I learned to flash. :thumbup:
You can also fix permissions in rom toolbox under the "manage apps. " Its on bottom, just slide bottom bar to left and you will see it.
Codename FC18
taitrandht said:
hmmm, not realy clear for newbie like me, can you explain what problem will happen if fix permision ( in CMW ) is needed but i don't do it ?
Click to expand...
Click to collapse
http://wiki.cyanogenmod.com/wiki/Fix_permissions
Just found that. Sounds like what tingtan was saying.
Thanks I did not know that I could fix my permissions in Rom Tool Box.
Hello.
I suspect that fixing permissions implementation differs between tools. I suspect some of them doing worse to the system by performing this.
I'd appreciate a suggestion of tool doing this best (ie. no bad impact on system performance)
I just ran this from ROM Manager and thought... oh what have I done now...
I didn't really need to do it or anything. At least it didn't appear to have created issues
But, is it more or less secure now?
problem starting all aps after fix permission
just trying fix permission after flash rom and now my andriod cann't execute launcher and android system.
Nav bar and notification bar still show up, so the only thing i can use is setting menu.
Clear data on apps cann't do either due to, in active button (keep computing size all time)
Any idea how to fix this?
darkfader said:
I just ran this from ROM Manager and thought... oh what have I done now...
I didn't really need to do it or anything. At least it didn't appear to have created issues
But, is it more or less secure now?
Click to expand...
Click to collapse
More secure - tingtan answered that a couple of posts up now hit his thanks button
I am using Phil Touch recovery and for some reason I don't have the option "fix permissions" in the advanced section. Any theories for why?
mafra staue
H0LT3R said:
I am using Phil Touch recovery and for some reason I don't have the option "fix permissions" in the advanced section. Any theories for why?
Click to expand...
Click to collapse
its been removed with 5.10.0 version i think
wyklocnik said:
its been removed with 5.10.0 version i think
Click to expand...
Click to collapse
Guess it's a background process.
Stock Recovery Permission Fix?
How do you 'fix permissions' if you have only stock recovery?
I thought I needed to do this with my Titanium backup file.
I read that you must move the file into the system directory (off of SD Card or EXT SD Card) to do this, however this can be a problem and an inconvenience for such a large file, is there another recommended way of doing this if your Rooted but pure stock?
(Ideally this would alleviate the need to move the file, or at least would take care of the manual process if it's not possible to rectify in place.)
Fix permission?
Guys i have a note 3 sm n9005 and i am running cm12.1 ever since it came out. Well the rom is pretty good and stable but its missing some features on my device like the( on screen nav bar, ambient display , themer for cm themes) and im kinda frustrated cuz they are some nice features to be missing. Anyhow i tried liquidsmooth 4.1 and i did get the nav bar and the other settings, but now im back to cm cuz ls 4.1 has some bugs and again im without these features on cm12.1. Will this fix permissions thing solve the problem?? And if any one knows the fix for it please share it with me. Thanks.
I would like to invite you guys to test my new app Parasol which can solve the permission problem in Android M~
http://forum.xda-developers.com/android/apps-games/app-parasol-alpha-t3190615
Hi there,
Parasol is a new app to solve the permission problem in Android M. Here is the link: http://forum.xda-developers.com/android/apps-games/app-parasol-alpha-t3190615
Just try it and give me some expert feedback. Thanks a lot~
shell script to fix permissions
This is my first shell script but it fixed the permissions on an app that started crashing after I upgraded to android M
it takes the /data/data/XXX folder name as its only parameter
This script only repairs the owner:group of the data files
Please send comments - this script can be used by anyone in any way
Code:
#!/bin/sh
if [ "$1" != "" ]; then
#The folders in /data/data each have a different owner. The next line gets the owner and the strips the whitespace
appusername=$(stat -c "%U" /data/data/$1 | xargs)
#The next line constructs the chown command to repair the permissions for all the files in the target folder
fixperm="chown -R $appusername:$appusername /data/data/$1/*"
#Display the command to the user
echo "$fixperm"
#Uncomment the next line if you would like the script to fix the permission
#eval $fixperm
else
echo "Missing target folder parameter"
fi
Hi all,
I'm running a newly rooted verizon phone and trying to make a safestrap backup so that I can install a custom rom and finally be rid of touchwiz. As far as I can tell, the only thing stopping me is a swap from enforcing to passive status -- using terminal emulator to enter setenforce 0 or setenforce permissive doesn't work: getenforce returns Enforcing for both. Previous posts make this seem like a relatively simple thing, am I missing something?
Thanks!
Maybe try the SELinux Mode Changer app from Google Play and see what happens.
Hello guys, maybe one of you might be able to help me out
I have a sh script that patches the fstab before it got mounted.
Sadly since its in the during the init process i need to define some se permissions to busybox
here is the debug kernel log
http://pastebin.com/HZmJdRWv
anyone could help me out how to setup the permissions required?
Khaon said:
Hello guys, maybe one of you might be able to help me out
I have a sh script that patches the fstab before it got mounted.
Sadly since its in the during the init process i need to define some se permissions to busybox
here is the debug kernel log
http://pastebin.com/HZmJdRWv
anyone could help me out how to setup the permissions required?
Click to expand...
Click to collapse
maybe these pages will help?
http://selinuxproject.org/page/TypeRules
http://www.newandroidbook.com/21-Security.pdf
selinux has been giving me fits since it went enforcing in kitkat.
as far as busybox goes, running it as su seems to let it get past selinux restrictions... I was able to use busybox in root adb shell to mount an ext2 partition without the ext2 security attribute set in the kernel config, while trying to mount it with any other method would fail because of selinux.
I don't know if anyone else tried and ran into the same issue...
After installing Android N (NPC56W build) on my 6P I wanted to have Viper4Android working, so I enabled permissive mode.
Booom. The phone rebooted itself, I needed a few seconds to realize, it was in "safe mode", and looked like after the first boot (after flashing the rom). I was wondering what the hell went wrong. After a reboot everything went back to normal. I thought it is because the kernel doesn't support permissive mode. So I tried 3 other kernels, always the same result. Then I started to look deeper, and found out, that there is a "system integrity check", which reboots the phone into safe mode on selinux mode change.
I found the part in the source code, and disabled it. After two days of compiling, I finally got the that little binary called "logd".
I replaced the original in /system/bin in recovery and rebooted and in a root shell ran "setenforce 0". And it worked! This time no reboot, and the command "getenforce" returns "Permissive". I'm a happy person now that Viper is working.!
It was damn straight worth the 2 days of s**ing!
I didn't test it for more than an hour yet, so use it at your own risk! I'm not responsible if you phone get's damaged, or broken....
If any of you know a better solution, I'm open for it!
Otherwise: enjoy it!
This worked for me. Although it doesn't seem permissive stays through a reboot. But it's easy enough to change back. And viper works. Thanks.
bamfsig45 said:
This worked for me. Although it doesn't seem permissive stays through a reboot. But it's easy enough to change back. And viper works. Thanks.
Click to expand...
Click to collapse
Yes, the setting resets on reboot. You could put a one liner shell script in /system/etc/init.d. Then it would be set during boot.
I'm glad it worked for you too!
Is this a flashable zip?
Hmm....I also noticed this, because restoring of apps in Titanium Backup on Dev Preview only work if the phone in permissive.
Will this work in the Dev Preview 2????
EDIT: Thanks, it works for Dev Preview 2 as well
duminduweera said:
Hmm....I also noticed this, because restoring of apps in Titanium Backup on Dev Preview only work if the phone in permissive.
Will this work in the Dev Preview 2????
Click to expand...
Click to collapse
Just tested it on preview 2 and it works
TBU now able to restore my apps
hermes2xgreat said:
Is this a flashable zip?
Click to expand...
Click to collapse
I made a flashable zip to make it easier for most. Thank @gubacsek for the logd file.
This one will copy the original logd to the root of your sdcard in case you want to restore it: http://www.mediafire.com/download/6i2rrgr4f5wc4ty/copy_logd_backup.zip
MD5Sum: 800b86bb130f7cc0f558944569d62891
This one will replace the current logd with the modified logd: http://www.mediafire.com/download/9uo1j6h88x8o8z0/logd_replacement_permissive.zip
MD5Sum: f0f219552ace44e5f12297403f5fc8e3
Side Note: If you want Permissive to survive a reboot you will have to run a script in /su/su.d to make it persist.
Side Note 2: Don't forget to go into terminal and type su for root acces, then type setenforce 0 to set as permissive. You could also do this in an adb shell. You can test to see if it's in Permissive mode by typing getenforce in terminal (this info. is in the OP, but people tend to skip OP's).
EDIT: If you guys want to add a script so that SELinux boots up as Permissive every time you reboot, then flash this file: http://www.mediafire.com/download/6klkabmpa5h5xbf/add_permissive_boot.zip
MD5Ssum: ab3584c4044659653d3ec30f9732a50f
bouchigo said:
I made a flashable zip to make it easier for most. Thank gubacsek for the logd file.
This one will copy the original logd to the root of your sdcard in case you want to restore it: http://www.mediafire.com/download/6i2rrgr4f5wc4ty/copy_logd_backup.zip
MD5Sum: 800b86bb130f7cc0f558944569d62891
This one will replace the current logd with the modified logd: http://www.mediafire.com/download/9uo1j6h88x8o8z0/logd_replacement_permissive.zip
MD5Sum: f0f219552ace44e5f12297403f5fc8e3
Side Note: If you want permissive to survive you will have to run a script in /su/su.d to make it persist.
Click to expand...
Click to collapse
You're welcome! I was too lazy to create a zip file.
I will update the thread title to say it works on npc91k build too.
And I didn't even notice that TB works in permissive. I always install the app from playstore and restore only the data afterwards, because that was working. Thanks for the tip!
This is awesome. Thanks guys
This work great with my Preview 2 build.:laugh::laugh::laugh:
bouchigo said:
I made a flashable zip to make it easier for most. Thank @gubacsek for the logd file.
This one will copy the original logd to the root of your sdcard in case you want to restore it: http://www.mediafire.com/download/6i2rrgr4f5wc4ty/copy_logd_backup.zip
MD5Sum: 800b86bb130f7cc0f558944569d62891
This one will replace the current logd with the modified logd: http://www.mediafire.com/download/9uo1j6h88x8o8z0/logd_replacement_permissive.zip
MD5Sum: f0f219552ace44e5f12297403f5fc8e3
Side Note: If you want Permissive to survive a reboot you will have to run a script in /su/su.d to make it persist.
Side Note 2: Don't forget to go into terminal and type su for root acces, then type setenforce 0 to set as permissive. You could also do this in an adb shell. You can test to see if it's in Permissive mode by typing getenforce in terminal (this info. is in the OP, but people tend to skip OP's).
EDIT: If you guys want to add a script so that SELinux boots up as Permissive every time you reboot, then flash this file: http://www.mediafire.com/download/6klkabmpa5h5xbf/add_permissive_boot.zip
MD5Ssum: ab3584c4044659653d3ec30f9732a50f
Click to expand...
Click to collapse
Thanks soo much. This is a great tool to get done what I need without all the frikkin hassle
Work well on NPC91K build. Thanks
@gubacsek
I was browsing the supersu forums earlier and you should be able to type this in terminal or adb shell:
Code:
stop logd
setenforce 0
This will allow you set as permissive without replacing logd, and without rebooting into safemode.
So, we can have a script with those lines in init.d or /su/su.d to run at boot without messing with logd...this is probably good since the logd you complied may not work on Preview 3, etc.
EDIT: Just wanted to let everyone know it works. Fastboot flashed system.img to make sure logd was working as intended, meaning that it will send you to safemode when attempting to change SELinux. Once I made sure it was working properly I applied the commands mentioned earlier, and...
Success :good:
bouchigo said:
@gubacsek
I was browsing the supersu forums earlier and you should be able to type this in terminal or adb shell:
Code:
stop logd
setenforce 0
This will allow you set as permissive without replacing logd, and without rebooting into safemode.
So, we can have a script with those lines in init.d or /su/su.d to run at boot without messing with logd...this is probably good since the logd you complied may not work on Preview 3, etc.
EDIT: Just wanted to let everyone know it works. Fastboot flashed system.img to make sure logd was working as intended, meaning that it will send you to safemode when attempting to change SELinux. Once I made sure it was working properly I applied the commands mentioned earlier, and...
Success :good:
Click to expand...
Click to collapse
Nice! There is only one question left... What the f* is this logd doing? What happens if you stop it?
Anyway! Nice out of the box thinking I didn't even think about stopping it...
A very very big thanks for your great work @gubacsek and @bouchigo
With your work now I've got ViperMod and OK Google working at my N6 with preview 2 at http://forum.xda-developers.com/nexus-6/development/rom-stock-flashables-t3348657
Gesendet von meinem Nexus 6
spevil07 said:
A very very big thanks for your great work @gubacsek and @bouchigo
With your work now I've got ViperMod and OK Google working at my N6 with preview 2 at http://forum.xda-developers.com/nexus-6/development/rom-stock-flashables-t3348657
Gesendet von meinem Nexus 6
Click to expand...
Click to collapse
You are welcome! I'm happy I could help!
And I know the feeling I was also damn happy when it worked. Viper is the most important mod for me. Once heard the music through it, I can't live without it anymore...
YEAEEEEAAAAAHHH its absolutly that what i need!!!!
With this music its absolutly obligation
https://soundcloud.com/toxic-sickness/doctor-terror-exclusive-guest-mix-on-toxic-sickness-april-2016
https://soundcloud.com/eargasmpodcastofficial/eargasm-podcast-2-by-unproven
spevil07 said:
A very very big thanks for your great work @gubacsek and @bouchigo
With your work now I've got ViperMod and OK Google working at my N6 with preview 2 at http://forum.xda-developers.com/nexus-6/development/rom-stock-flashables-t3348657
Gesendet von meinem Nexus 6
Click to expand...
Click to collapse
It works without any crashes and with the screen off?
gubacsek said:
Nice! There is only one question left... What the f* is this logd doing? What happens if you stop it?
Anyway! Nice out of the box thinking I didn't even think about stopping it...
Click to expand...
Click to collapse
It looks like logd is just a logging binary; it seems like logd monitors for changes to the system that Google wants to keep track of, be it for informational purposes or, to stop people from messing with SELinux like we are seeing in this case. In this case logAudit.cpp and logAudit.h look for changes specifically to SELinux, and if one is detected it will either boot you to SafeMode, or to recovery depending on how the change comes about.
Does logd really need to be running? I'm not sure the answer to that, but I've had it shut off for the past couple of days so far with no ill effects that I have noticed.
EDIT: I compiled a new logd with preview2 source, and though it's a bit smaller in size than the one you compiled for preview 1, the result is the same as the one you compiled. It should be easy enough to compile a new logd for preview 3 in case your current one stops working for preview 3...as long as the preview 3 source is released quickly...or still use the stop logd command to completely stop it from running :good:
bouchigo said:
It seems like logd is just a logging binary; it seems like logd monitors for changes to the system that Google wants to keep track of, be it for informational purposes or, to stop people from messing with SELinux like we are seeing in this case. In this case logAudit.cpp and logAudit.h look for changes specifically to SELinux, and if one is detected it will either boot you to SafeMode, or to recovery depending on how the change comes about.
Does logd really need to be running? I'm not sure the answer to that, but I've had it shut off for the past couple of days so far with no ill effects that I have noticed.
EDIT: I compiled a new logd with preview2 source, and though it's a bit smaller in size than the one you compiled for preview 1, the result is the same as the one you compiled. It should be easy enough to compile a new logd for preview 3 in case your current one stops working for preview 3...as long as the preview 3 source is released quickly...or still use the stop logd command to completely stop it from running :good:
Click to expand...
Click to collapse
sighs... I know security and all, but it is just exhausting to try and get around new restrictions google is building into android all the time. I know it is okay for the masses, but seriously, there should be a master switch in android, or a special developer version which allows us to do what ever we want with our devices.
Anyway. Android is still by far the best and "developer friendly" OS in my opinion, so I'm just shutting up.
Yes, I also compiled a new logd already, but there is no change in the source, so of course it is working with both N builds. And I hope it will stay so in future releases