Any Oreo Rom wih SELinux in enforcing state? - Xiaomi Redmi Note 4 Questions & Answers

I am looking for a Oreo ROM that has SELinux in enforcing state by default. Some of the enterprise apps that I use refuse to initiate if the SELinux is in 'permissive' state.
I found that Omni ROM has SELinux set to enforcing by default.
Setting the SElinux to enforcing state manually via terminal results in kernel panic/hung state in roms like AOSPEX.
Can somebody list out the Oreo roms having SELinux as enforcing by default?

y2ksnoop said:
Can somebody list out the Oreo roms having SELinux as enforcing by default?
Click to expand...
Click to collapse
https://forum.xda-developers.com/re...ies--other-development/rom-atomic-os-t3640177

AOSIP

DarthJabba9 said:
https://forum.xda-developers.com/re...ies--other-development/rom-atomic-os-t3640177
Click to expand...
Click to collapse
ebrahem khedr said:
AOSIP
Click to expand...
Click to collapse
Wow that's awesome. Never thought these ROMs would have Selinux enforcing, given their small userbase.
Don't judge a rom by it's userbase. Lesson learnt.

Related

[Patch] Infrared and LeTV Remote app

Hi mates, after some testing i have made a patch to get working IR in roms wich doesnt have it included.
Need selinux permissive or Sepolicy exception with enforcing
ROM maintainers need to enable HSL in kernel
Installation:
-Flash with Twrp
-Nothing more
Download:
-Patch (Updated 26-05-2017)
I'm on Omni though, but still....the same as before, it crashes upon updating....sorry if not helpful, thanks for your effort
Just scanned through logcat, first sign of trouble is once again "no permission on read/write serial port".
I will enable the serial port in next build
Sent from my LEX720 using Tapatalk
It says: "Unable to Initialize" on AOKP how to do you about updating after flashing it through TWRP
Nice work! Thanks!
Installing on AOSPExtended with Black Screen 1.8.5 worked. But after doing the update of the app I had also "Unable to Initialize" and it was not possible to pair with any device. There is no option for it.
Hi,
I have installed it with your RR rom on my x720, but unfortunately it doesn't work and also I don't get any bug message at the first time.
It opens normally but at universal remote it doesn't record any data from IR sensor.
smae said:
Hi,
I have installed it with your RR rom on my x720, but unfortunately it doesn't work and also I don't get any bug message at the first time.
It opens normally but at universal remote it doesn't record any data from IR sensor.
Click to expand...
Click to collapse
Clean data and cache of the app and open again
Updated
villarleg said:
Updated
Click to expand...
Click to collapse
Now it is fully working...
Thanks a looot :good:
Hi. How do I move remote app data for other Rom?
Sorry for my bad English.
Tapatalkkal küldve az én LEX720 eszközömről
bankizsolt said:
Hi. How do I move remote app data for other Rom?
Sorry for my bad English.
Tapatalkkal küldve az én LEX720 eszközömről
Click to expand...
Click to collapse
Backup both Remote Control and UEI Android services SDK(LeTV) using Titanium backup and restore them (Data only) in the new rom (after installing the patch using twrp).
Any one test this patch on LineageOS 14.1 Rom?
How ti enable hsl in kernel?
I'm on LOS 14.1 and it says unable ti initialize
sweetboy02125 said:
Any one test this patch on LineageOS 14.1 Rom?
Click to expand...
Click to collapse
danielexda said:
How ti enable hsl in kernel?
I'm on LOS 14.1 and it says unable ti initialize
Click to expand...
Click to collapse
Enable HSL its for devs only, i think lineage doesnt have it enabled in kernel, so you need to flash another kernel and change selinux to permissive
Can I turn this to permissive by kernel audiutor?
villarleg said:
Enable HSL its for devs only, i think lineage doesnt have it enabled in kernel, so you need to flash another kernel and change selinux to permissive
Click to expand...
Click to collapse
danielexda said:
Can I turn this to permissive by kernel audiutor?
Click to expand...
Click to collapse
Flashing another kernel will change it to permissive (if it's a permissive kernel), and if it's an enforcing kernel it'll have the selinux patches so there's no need to change it to permissive yourself, just flashing the kernel is enough
I change ti permissive by an apk bit it doesn't funciton
danielexda said:
I change ti permissive by an apk bit it doesn't funciton
Click to expand...
Click to collapse
Your kernel needs to have the serial port patch
Can you tell me which kernel i have to install?

SELinux enforcing on pie

i don't have a clear idea about SELinux. i read some articles found on google about selinux.
one of the banking apps i'm using works fine on nougat roms (where SElinux is enforcing)
but on Pie, it force close always. (because pie roms are SElinux permissive)
so, will we get selinux enforcing on pie roms in the near future?
and why is it not enforcing yet?
thanks.
Simoom Sadik said:
i don't have a clear idea about SELinux. i read some articles found on google about selinux.
one of the banking apps i'm using works fine on nougat roms (where SElinux is enforcing)
but on Pie, it force close always. (because pie roms are SElinux permissive)
so, will we get selinux enforcing on pie roms in the near future?
and why is it not enforcing yet?
thanks.
Click to expand...
Click to collapse
Selinux enforced make ur phone very rigid and difficult against malware and spyware attacks.
Making selinux enforcing need little patience and work and hours.
Selinux files contains lots of allow deny permission.
Updating SE policy not easy. Monitoring logs and warning before putting in enforcing mode.
Many things wont work if u wrongly update allow deny permissions.
May be pie breaks stuff right now with enforcing mode. Hope they give some time for it to update it.
Simoom Sadik said:
i don't have a clear idea about SELinux. i read some articles found on google about selinux.
one of the banking apps i'm using works fine on nougat roms (where SElinux is enforcing)
but on Pie, it force close always. (because pie roms are SElinux permissive)
so, will we get selinux enforcing on pie roms in the near future?
and why is it not enforcing yet?
thanks.
Click to expand...
Click to collapse
Use Citrus CAF pie . its is selinux enforced . :highfive:

Is There Any Android P ROM For Redmi Note 3 Having SELinux Set to Enforcing?

All of ROMs based on Android Pie for kenzo I’ve tried so far have SELinux set to permissive. There was a time when even Oreo ROMs didn’t have SELinux enforcing, but later on developers had fixed it. As of now, I didn’t even find a single Android P official custom ROM having SELinux set to Enforcing.
Did anyone find any official Pie ROM having SELinux set to enforcing?
Ya_SG said:
All of ROMs based on Android Pie for kenzo I’ve tried so far have SELinux set to permissive. There was a time when even Oreo ROMs didn’t have SELinux enforcing, but later on developers had fixed it. As of now, I didn’t even find a single Android P official custom ROM having SELinux set to Enforcing.
Did anyone find any official Pie ROM having SELinux set to enforcing?
Click to expand...
Click to collapse
Do you flash magisk?
Black_Stark said:
Do you flash magisk?
Click to expand...
Click to collapse
Yes I do.
Ya_SG said:
Yes I do.
Click to expand...
Click to collapse
So u take ur security seriously. But u dont have problem in rooting ur phone. :laugh:
Just think Why all custom roms today are not prerooted ?
But u keep on crying on every thread for selinux . have u read whats the actual function of selinux and how it works and where its useful. Do u install apk files from untrusted sources from untusted sites??
Even privacy guard can protect ur userspace. Today Most of custom roms have privacy guard.
Understanding Selinux his huge work. Only OEM devs like xiaomi devs who are professional and paid by comapnies knows how to write the SEPOLICY. Custom devs here dont have that much spare time.
And who told u citrus released by Adarsh is unofficial ? :laugh:
Black_Stark said:
So u take ur security seriously. But u dont have problem in rooting ur phone. :laugh:
Just think Why all custom roms today are not prerooted ?
But u keep on crying on every thread for selinux . have u read whats the actual function of selinux and how it works and where its useful. Do u install apk files from untrusted sources from untusted sites??
Even privacy guard can protect ur userspace. Today Most of custom roms have privacy guard.
Understanding Selinux his huge work. Only OEM devs like xiaomi devs who are professional and paid by comapnies knows how to write the SEPOLICY. Custom devs here dont have that much spare time.
And who told u citrus released by Adarsh is unofficial ? :laugh:
Click to expand...
Click to collapse
Having SELinux permissive blocks the use of banking apps. Turning off Google Play services' phone permission may make them work. But if you use Google Maps, you’re certainly gonna notice a message “Google Maps is having trouble, turn on phone permission of Google Play services”.
That’s the reason, I’m not using any Pie ROM.
And I wouldn’t want to use an outdated rom having bugs made by a dev who’s passed away. We all know everyone wants SELinux Enforcing in Pie ROMs.
Citrus-CAF is unofficial
Ya_SG said:
Having SELinux permissive blocks the use of banking apps. Turning off Google Play services phone permission may make them work. But if you use Google Maps, you’re certainly gonna notice a message “Google Maps is having trouble, turn on phone permission of Google Play services”.
That’s the reason, I’m not using any Pie ROM.
And I wouldn’t want to use an outdated rom having bugs made by a dev who’s passed away. We all know everyone wants SELinux Enforcing in Pie ROMs.
Click to expand...
Click to collapse
Hope we see new updated citrus build.
U from which country?
Black_Stark said:
So u take ur security seriously. But u dont have problem in rooting ur phone. :laugh:
Just think Why all custom roms today are not prerooted ?
But u keep on crying on every thread for selinux . have u read whats the actual function of selinux and how it works and where its useful. Do u install apk files from untrusted sources from untusted sites??
Even privacy guard can protect ur userspace. Today Most of custom roms have privacy guard.
Understanding Selinux his huge work. Only OEM devs like xiaomi devs who are professional and paid by comapnies knows how to write the SEPOLICY. Custom devs here dont have that much spare time.
And who told u citrus released by Adarsh is unofficial ? :laugh:
Click to expand...
Click to collapse
Nobody asked for your opinion. He simply asked about the ROMs which have se Linux permissive. You can name the ROMs or GTFO.
DarkSoul101 said:
Nobody asked for your opinion. He simply asked about the ROMs which have se Linux permissive. You can name the ROMs or GTFO.
Click to expand...
Click to collapse
We both good. U go to bed and sweet dreams.
Black_Stark said:
We both good. U go to bed and sweet dreams.
Click to expand...
Click to collapse
*Triggered*

[PATCH][9.0][ZE60xKL] Speaker patch is available

Here are patch sets for speaker working on ze60xkl pie ROMs
<Link>
ZE600KL : http://www.mediafire.com/folder/5l0hwa9n7aice/ze600kl
ZE601KL : http://www.mediafire.com/folder/r8wbjbqjjh46j/ze601kl
<Notice>
These patch sets are only for ZE60xKL model on pie custom rom users.
DO NOT apply these for other models or Andoroid versions.
<Patch Files>
1) Kernel Packages (be careful for mistaking model).
 - ze600kl-spk-pie-kernel-v1.zip (for ZE600KL(Z00L))
 - ze601kl-spk-pie-kernel-v1.zip (for ZE601KL(Z00T))
2) ze60xkl-spk-pie-libs-v1-01.zip (for both ZE600KL and ZE601KL)
<Install Instructions>
1. Download 2 patches (#1 and #2) to any folder
2. Reboot recovery (TWRP)
3. Flash 2 files
4. Reboot system and you can fun sound from device
<Tested Roms>
- Lineage OS
- CrDroid
- AEX
<Features>
- Add speaker sound stream to your rom
- Stereo mic support
<Known Issue>
- Noisy sound with bluetooth and enabling reverb
<Source Code>
https://github.com/zekken1977?tab=repositories
<Change log>
[2019-05-05: v1.0]
- Add tfa9887 driver
[2019-05-26: v1.01]
- Rebased on firekernel r2.10
Finally thank you for helping to test my patch
@Rayonecma, @celtic1453, @fabricio6791 and @ndrancs
First Release On : 2019-05-05
Last Update On : 2019-05-26
Τhanks
Works ok for the ZE600KL
Sent from my MI PAD 4 using Tapatalk
test on ze601kl... working friend
And... For my ze601kl it's working too... ???
can i test the patch on other pie custom rom ?? RR, Cdroid...??
right now i have lineage pie
fabricio6791 said:
can i test the patch on other pie custom rom ?? RR, Cdroid...??
right now i have lineage pie
Click to expand...
Click to collapse
Please
I think this patch will be available for other pie roms unless modified audio HAL or enforced SElinux.
Ze60xkl sound patch
Thx a lot, i've made patch for oreo, but i didn't find any time to work on the pie version .
Great job !!!
You are awesome! Thank you for this work ^-^
zekken1977 said:
Please
I think this patch will be available for other pie roms unless modified audio HAL or enforced SElinux.
Click to expand...
Click to collapse
You are doing Gods work bro!
Hats off to you.
One question.
What about enforced SELinux? LOS will eventually get SELinux to enforcing. What after that? This won't work?
[email protected] said:
You are doing Gods work bro!
Hats off to you.
One question.
What about enforced SELinux? LOS will eventually get SELinux to enforcing. What after that? This won't work?
Click to expand...
Click to collapse
Enforcing SELinux is enabled in stock rom from Oreo (maybe... ) but most custom roms are disabled (permissive) like attached.
Exactly after enabled SELinux, this patch will not work because of enforcing SELinux.
If so, my ideas which we can choose are :
1. Add sepolicy file into patch to access driver
-> It seems to be good but we need to be aware differences of sepolicy between custom roms
2. Change patch design for hold all amp device (tfa9887) controls in userspace (this means kernel patch will be disappeared)
-> It also seems to be good but we need a new designed libs, and making completely independent module from SELinux is difficult, I think.
To be honest, I have no ieda for the best solution
zekken1977 said:
Enforcing SELinux is enabled in stock rom from Oreo (maybe... ) but most custom roms are disabled (permissive) like attached.
Exactly after enabled SELinux, this patch will not work because of enforcing SELinux.
If so, my ideas which we can choose are :
1. Add sepolicy file into patch to access driver
-> It seems to be good but we need to be aware differences of sepolicy between custom roms
2. Change patch design for hold all amp device (tfa9887) controls in userspace (this means kernel patch will be disappeared)
-> It also seems to be good but we need a new designed libs, and making completely independent module from SELinux is difficult, I think.
To be honest, I have no ieda for the best solution
Click to expand...
Click to collapse
We did not have Stock Oreo i guess (Only Custom).
I personally was checking things and found the kernel zip different. That was great thinking on your part though. I tried building this a long ago, but failed (I never thought about patching the kernel).
Hey @Superbezo, can you give some insights in this? What could be possible when we have SELinux as Enforcing on pie?
The LOS 16 has SELinux in bugs, The dev will eventually fix it and turn it to Enforcing.
[email protected] said:
We did not have Stock Oreo i guess (Only Custom).
I personally was checking things and found the kernel zip different. That was great thinking on your part though. I tried building this a long ago, but failed (I never thought about patching the kernel).
Hey @Superbezo, can you give some insights in this? What could be possible when we have SELinux as Enforcing on pie?
The LOS 16 has SELinux in bugs, The dev will eventually fix it and turn it to Enforcing.
Click to expand...
Click to collapse
And another idea is that custom rom maintainers implement tfa9887 driver and sepolicy.
The driver is disappeared without device tree because driver probing doesn't work, this means the driver will not affect to other models except ZE60xKL (strictly other models which are made dtb from not ZE60xKL's device tree).
Otherside we'll distribute patches including audio/amp HALs and audio routing cofigs.
I think this is the most reasonable idea like similar style until Oreo...
zekken1977 said:
And another idea is that custom rom maintainers implement tfa9887 driver and sepolicy.
The driver is disappeared without device tree because driver probing doesn't work, this means the driver will not affect to other models except ZE60xKL (strictly other models which are made dtb from not ZE60xKL's device tree).
Otherside we'll distribute patches including audio/amp HALs and audio routing cofigs.
I think this is the most reasonable idea like similar style until Oreo...
Click to expand...
Click to collapse
I guess, the Devs will implement this driver in to their ROM. But it is more prudent to have a Patch (Like we had upto Oreo). Reason being, there are tens of ROMS. Convincing each dev will be counter productive. The patch can be applied more efficiently.
We'll have to wait and see when the SEPolicy enforcement occurs.
About update patch
Hi patch users,
These patches are based on Firekernel r2.9, then already r2.10 is updated.
So if you'll need to update based on r2.10, pleaase let me know
Thanks
Workaround
[email protected] said:
We did not have Stock Oreo i guess (Only Custom).
I personally was checking things and found the kernel zip different. That was great thinking on your part though. I tried building this a long ago, but failed (I never thought about patching the kernel).
Hey @Superbezo, can you give some insights in this? What could be possible when we have SELinux as Enforcing on pie?
The LOS 16 has SELinux in bugs, The dev will eventually fix it and turn it to Enforcing.
Click to expand...
Click to collapse
Thé selinuxswitch from [email protected] will ne a working workaround to keep selinux disabled even on enforcing mode ROM...
---------- Post added at 05:44 AM ---------- Previous post was at 05:33 AM ----------
zekken1977 said:
Hi patch users,
These patches are based on Firekernel r2.9, then already r2.10 is updated.
So if you'll need to update based on r2.10, pleaase let me know
Thanks
Click to expand...
Click to collapse
Yes, i'm interrested in ...
Please zekken1977 , Can you made jour kernel patch code public ?
Thx a lot.
Superbezo said:
Thé selinuxswitch from [email protected] will ne a working workaround to keep selinux disabled even on enforcing mode ROM...
---------- Post added at 05:44 AM ---------- Previous post was at 05:33 AM ----------
Yes, i'm interrested in ...
Please zekken1977 , Can you made jour kernel patch code public ?
Thx a lot.
Click to expand...
Click to collapse
OK. I'll update but next version will be available on this weekend.
And about source code, please see the link in my 1st post
Thanks
Can you make sound patch for Zenfone Selfie Z00UD (Z00T)?
Because I will try this rom (https://forum.xda-developers.com/zenfone-2-laser/development/rom-prometheusoneui-z00t-t3929198) to my Zenfone Selfie Z00UD (Z00T), but the sound patch only for Zenfone 2 Laser ZE601KL (Z00T). Thanks in advance!
ManOfFeel said:
Zenfone Selfie did not have speaker issue lol
Click to expand...
Click to collapse
But, the prometheusoneui said that need to flash sound patch
fuady7 said:
But, the prometheusoneui said that need to flash sound patch
Click to expand...
Click to collapse
Hi, my patch made for drive spk amp device tfa9887 which mounts on only ZE600 or ZE601KL.
So I guess this patch isn't valuable for other zenfones.
I checked Z00UD schematic and I couldn't find tfa amp.
If you are facing sound issue, my patch can't improve your problem.
Hello, i'll glad to know if someone else encountered the same issue:
I have tested this patch with los ans crdroid with thé same results.
I flashed successfully the ROM & patch and all was working fine (sound ,data ans GSM connexion) for few hours. Then the phone freezes and after reboot,no GSM network détectéd at all... The only way to recover was to do a factory reset with twrp or revert back to oreo backup... Any idea?

Selinux

Can someone explain to me what SElinux does? Also what does permissive and disabled mean? I see a lot of people not using some ROMs just because of the SElinux status.
Thank you in advance.
Basically it tells processes what files/folders they can or cannot use. You don't want some malicious activity to use them, don't you?
Soojikahalwa said:
Can someone explain to me what SElinux does? Also what does permissive and disabled mean? I see a lot of people not using some ROMs just because of the SElinux status.
Thank you in advance.
Click to expand...
Click to collapse
Selinux in Enforcing mode makes ur userspace very rigid against hacking and malware.
All official stock rom comes with enforcing mode. Its mandatory.
Putting Selinux in Enforcing mode is kind of tough. Only few devs can understand and can make it.
Nougat and oreo already in enforcing.
Now latest Aex pie Test build is already released with Enforcing mode.
Thank you guys, so basically SElinux enforced is best. I was under the impression that SElinux enforced isn't too great as your apps will have only restricted access. Thank you very much.

Categories

Resources