Selinux

? ? ? ?SELinux is an optional feature of the Linux kernel that provides support to enforce access control security policies to enforce MAC. It is based on the LSM framework.

Working with SELinux on Android – LineageOS

Android 關閉selinux

? ? ? MT6835 Android系統默認是開啟selinux的，由于selinux限制比較多，所以需要關閉selinux

MT6835 關閉SeLinux方法

軟件代碼直接關閉

target/system/core/init/selinux.cpp

將

bool IsEnforcing() {if (ALLOW_PERMISSIVE_SELINUX) {return StatusFromProperty() == SELINUX_ENFORCING;}return true;
}

修改為

bool IsEnforcing() {/*if (ALLOW_PERMISSIVE_SELINUX) {return StatusFromProperty() == SELINUX_ENFORCING;}*/return false;
}

?mssi/system/core/init/selinux.cpp

將

bool IsEnforcing() {if (ALLOW_PERMISSIVE_SELINUX) {return StatusFromProperty() == SELINUX_ENFORCING;}return true;
}

修改為

bool IsEnforcing() {/*if (ALLOW_PERMISSIVE_SELINUX) {return StatusFromProperty() == SELINUX_ENFORCING;}*/return false;
}

內核配置啟動參數

修改BOARD_KERNEL_CMDLINE增加androidboot.selinux = permissive

查看

./target/build/make/core/board_config.mk

_board_strip_readonly_list += BOARD_KERNEL_CMDLINE
INTERNAL_KERNEL_CMDLINE:= $(BOARD_KERNEL_CMDLINE)

發現BOARD_KERNEL_CMDLINE最終賦值給到INTERNAL_KERNEL_CMDLINE

所以我們只需要修改INTERNAL_KERNEL_CMDLINE接口

修改方法

./target/build/make/core/config.mk

將

ifneq ($(BOARD_SUPER_PARTITION_METADATA_DEVICE),super)
INTERNAL_KERNEL_CMDLINE += androidboot.super_partition=$(BOARD_SUPER_PARTITION_METADATA_DEVICE)
endif

修改為

ifneq ($(BOARD_SUPER_PARTITION_METADATA_DEVICE),super)
INTERNAL_KERNEL_CMDLINE += androidboot.super_partition=$(BOARD_SUPER_PARTITION_METADATA_DEVICE)
endif
INTERNAL_KERNEL_CMDLINE += androidboot.selinux = permissive

./mssi/build/make/core/config.mk

將

# The metadata device must be supplied to init via the kernel command-line.
INTERNAL_KERNEL_CMDLINE += androidboot.super_partition=$(BOARD_SUPER_PARTITION_METADATA_DEVICE)

修改為

# The metadata device must be supplied to init via the kernel command-line.
INTERNAL_KERNEL_CMDLINE += androidboot.selinux = permissive
INTERNAL_KERNEL_CMDLINE += androidboot.super_partition=$(BOARD_SUPER_PARTITION_METADATA_DEVICE)