From mboxrd@z Thu Jan 1 00:00:00 1970 Message-ID: <5050AC29.30400@tycho.ncsc.mil> Date: Wed, 12 Sep 2012 11:37:13 -0400 From: Joman Chu MIME-Version: 1.0 To: Cesar Maiorino CC: William Roberts , selinux@tycho.nsa.gov Subject: Re: Problem with SEManager app on Seandroid 4.0.4 References:

In-Reply-To: Content-Type: multipart/alternative; boundary="------------050801000406050308050205" Sender: owner-selinux@tycho.nsa.gov List-Id: selinux@tycho.nsa.gov This is a multi-part message in MIME format. --------------050801000406050308050205 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit On 09/12/2012 11:01 AM, Cesar Maiorino wrote: > I did have these in my init.rc, but my build was not copying init.rc > to to the out directory. > I copied it over manually and rebuilt the boot.img and it now I can > change the values. > So that is progress. > Now, however, when I toggle on SELinux, my device locks up. On reboot > it is stuck at the > lock screen. > Thanks for the help. > > On Tue, Sep 11, 2012 at 4:37 PM, William Roberts > > wrote: > > My guess is you need to change the permissions of /selinux/* > (/selinux/booleans for the booleans) to system system. > > the init.rc needs to have chown system system for all of the booleans, > setenforce etc > > chown system system /selinux/enforce > chown -R system system /selinux/booleans > chown system system /selinux/commit_pending_bools > > You'll need to patch in the recursive support or enumerate all the > bools. The patch for recursive support can be found: > https://android-review.googlesource.com/#/c/32220/ > > Hope this helps. > > > On Tue, Sep 11, 2012 at 1:23 PM, Cesar Maiorino > > wrote: > > I finally got a version of seandroid (4.0.4) running on my > Qualcomm MSM8960 > > Mobile Development Platform. This required some manual > intervention as the > > patch files did not all apply cleanly, so it's possible that > I've messed > > something up in the process. > > > > That being said, the SEManager app does not let me change any > settings aside > > from toggling "MAC Mode" on and off. So I can't change '"SELinux > Mode" > > (stuck in permissive), and I can't change any of the Booleans. > > > > AVC and MAC logging seem to be working. > > > > Any ideas? > > > > > > -- > Respectfully, > > William C Roberts > > Perhaps you're running into AVC denials. Can you post the kernel logs from /proc/kmsg? --------------050801000406050308050205 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit

On 09/12/2012 11:01 AM, Cesar Maiorino wrote:

I did have these in my init.rc, but my build was not copying init.rc to to the out directory.
I copied it over manually and rebuilt the boot.img and it now I can change the values.
So that is progress.
Now, however, when I toggle on SELinux, my device locks up. On reboot it is stuck at the
lock screen.
Thanks for the help.

On Tue, Sep 11, 2012 at 4:37 PM, William Roberts <bill.c.roberts@gmail.com> wrote:

My guess is you need to change the permissions of /selinux/*
(/selinux/booleans for the booleans) to system system.

the init.rc needs to have chown system system for all of the booleans,
setenforce etc

chown system system /selinux/enforce
chown -R system system /selinux/booleans
chown system system /selinux/commit_pending_bools

You'll need to patch in the recursive support or enumerate all the
bools. The patch for recursive support can be found:
https://android-review.googlesource.com/#/c/32220/

Hope this helps.

On Tue, Sep 11, 2012 at 1:23 PM, Cesar Maiorino
<cesar.maiorino@gmail.com> wrote:
> I finally got a version of seandroid (4.0.4) running on my Qualcomm MSM8960
> Mobile Development Platform. This required some manual intervention as the
> patch files did not all apply cleanly, so it's possible that I've messed
> something up in the process.
>
> That being said, the SEManager app does not let me change any settings aside
> from toggling "MAC Mode" on and off. So I can't change '"SELinux Mode"
> (stuck in permissive), and I can't change any of the Booleans.
>
> AVC and MAC logging seem to be working.
>
> Any ideas?
>

--
Respectfully,

William C Roberts

Perhaps you're running into AVC denials. Can you post the kernel logs from /proc/kmsg?
--------------050801000406050308050205-- -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.