seandroid 4.1.1

seandroid 4.1.1

[Alexandra Test]

[-- Attachment #1: Type: text/plain, Size: 183 bytes --]

Hi all,
I update the release of Seandroid on Samsung Galaxy Nexus. Unfortunately
the camera and the wifi seem to not be working.

Anyone has the same problem?
Any suggestions?
thanks

[-- Attachment #2: Type: text/html, Size: 241 bytes --]

Re: seandroid 4.1.1

[Stephen Smalley]

On Tue, 2012-09-18 at 12:28 +0200, Alexandra Test wrote:
> Hi all,
> I update the release of Seandroid on Samsung Galaxy Nexus.
> Unfortunately the camera and the wifi seem to not be working.
> 
> 
> Anyone has the same problem? 

I have wifi working.  The camera proprietary binary isn't available for
AOSP.  You downloaded the jro03h files, expanded them, ran the extract
scripts, did a make clobber, and then rebuilt?

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: seandroid 4.1.1

[Joshua Brindle]

Alexandra Test wrote:
> Hi all,
> I update the release of Seandroid on Samsung Galaxy Nexus. Unfortunately
> the camera and the wifi seem to not be working.
>

Camera won't work, those binary blobs aren't released by Google (they 
can't get a distribution license). For all other peripherals you need 
the blobs from Google:

<https://developers.google.com/android/nexus/drivers>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: seandroid 4.1.1

[Alexandra Test]

[-- Attachment #1: Type: text/plain, Size: 912 bytes --]

Yes, I did.
I downloaded the proprietary files from the google and extract other
proprietary files from the original android version.
so it is still not possible to use the camera, right?

About the wifi, the problem is that it finds the network but when it tries
to connect, it never succeeds.
What do you suggest to do? built it again?


On Tue, Sep 18, 2012 at 7:13 PM, Stephen Smalley <sds@tycho.nsa.gov> wrote:

> On Tue, 2012-09-18 at 12:28 +0200, Alexandra Test wrote:
> > Hi all,
> > I update the release of Seandroid on Samsung Galaxy Nexus.
> > Unfortunately the camera and the wifi seem to not be working.
> >
> >
> > Anyone has the same problem?
>
> I have wifi working.  The camera proprietary binary isn't available for
> AOSP.  You downloaded the jro03h files, expanded them, ran the extract
> scripts, did a make clobber, and then rebuilt?
>
> --
> Stephen Smalley
> National Security Agency
>
>

[-- Attachment #2: Type: text/html, Size: 1307 bytes --]

Re: seandroid 4.1.1

[Stephen Smalley]

On Wed, 2012-09-19 at 10:25 +0200, Alexandra Test wrote:
> Yes, I did. 
> I downloaded the proprietary files from the google and extract other
> proprietary files from the original android version.
> so it is still not possible to use the camera, right?
> 
> About the wifi, the problem is that it finds the network but when it
> tries to connect, it never succeeds.
> What do you suggest to do? built it again?

Hmm...might want to look at your dmesg and logcat output.
Anyway, your issues don't sound like they are specific to SE Android, so
you should really search the regular android discussion groups, e.g.
android-building, for answers and if unable to find an answer, post
questions there.  But first make sure that the same issue occurs if you
use a vanilla AOSP build without the SE Android modifications.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: seandroid 4.1.1

[Alexandra Test]

[-- Attachment #1: Type: text/plain, Size: 773 bytes --]

I am sorry... it is working when the device is in permissive mode.
I really cannot understand the way to define the policies.
For the wifi, for example, what do I suppose to do?

Thanks for your help

On Tue, Sep 18, 2012 at 7:13 PM, Stephen Smalley <sds@tycho.nsa.gov> wrote:

> On Tue, 2012-09-18 at 12:28 +0200, Alexandra Test wrote:
> > Hi all,
> > I update the release of Seandroid on Samsung Galaxy Nexus.
> > Unfortunately the camera and the wifi seem to not be working.
> >
> >
> > Anyone has the same problem?
>
> I have wifi working.  The camera proprietary binary isn't available for
> AOSP.  You downloaded the jro03h files, expanded them, ran the extract
> scripts, did a make clobber, and then rebuilt?
>
> --
> Stephen Smalley
> National Security Agency
>
>

[-- Attachment #2: Type: text/html, Size: 1184 bytes --]

Re: seandroid 4.1.1

[Stephen Smalley]

On Thu, 2012-09-20 at 12:19 +0200, Alexandra Test wrote:
> I am sorry... it is working when the device is in permissive mode. 
> I really cannot understand the way to define the policies.
> For the wifi, for example, what do I suppose to do?
> 
> Thanks for your help

Follow the instructions on the wiki,
http://selinuxproject.org/page/SEAndroid#Getting_Started_with_SE_Android

In particular, capture the dmesg output to see the avc denials, and then
address those denials in your policy.  If you need help, post the avc
denials to the list and we can help you decipher them.

Boot it permissive, use the wifi, and then run adb shell su 0 dmesg |
grep avc, and post the result.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: seandroid 4.1.1

[Alexandra Test]

[-- Attachment #1: Type: text/plain, Size: 1123 bytes --]

I don't have any denials.
If I change in enforcing mode with the wifi still connected, the wifi
works.
But if, in the enforcing mode, I disconnect it and try to reconnect it, it
doesn't : he says "obtaining IP address", "connecting", "saved" at the end
without being connected...



On Thu, Sep 20, 2012 at 2:55 PM, Stephen Smalley <sds@tycho.nsa.gov> wrote:

> On Thu, 2012-09-20 at 12:19 +0200, Alexandra Test wrote:
> > I am sorry... it is working when the device is in permissive mode.
> > I really cannot understand the way to define the policies.
> > For the wifi, for example, what do I suppose to do?
> >
> > Thanks for your help
>
> Follow the instructions on the wiki,
> http://selinuxproject.org/page/SEAndroid#Getting_Started_with_SE_Android
>
> In particular, capture the dmesg output to see the avc denials, and then
> address those denials in your policy.  If you need help, post the avc
> denials to the list and we can help you decipher them.
>
> Boot it permissive, use the wifi, and then run adb shell su 0 dmesg |
> grep avc, and post the result.
>
> --
> Stephen Smalley
> National Security Agency
>
>

[-- Attachment #2: Type: text/html, Size: 1709 bytes --]

Re: seandroid 4.1.1

[Stephen Smalley]

On Thu, 2012-09-20 at 15:57 +0200, Alexandra Test wrote:
> I don't have any denials.
> If I change in enforcing mode with the wifi still connected, the wifi
> works. 
> But if, in the enforcing mode, I disconnect it and try to reconnect
> it, it doesn't : he says "obtaining IP address", "connecting", "saved"
> at the end without being connected... 

No avc: or SELinux: messages in dmesg output when it fails?

I suppose it could be hidden by a dontaudit rule.  You could try
stripping those from your policy and see if you get anything.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: seandroid 4.1.1

[Alexandra Test]

[-- Attachment #1: Type: text/plain, Size: 1598 bytes --]

effectively I have a problem with dmesg
is it possible I don't have the package installed?
this is the output....
adb shell su 0 dmsg
Usage: su [options] [LOGIN]

Options:
  -c, --command COMMAND         pass COMMAND to the invoked shell
  -h, --help                    display this help message and exit
  -, -l, --login                make the shell a login shell
  -s, --shell SHELL             use SHELL instead of the default in passwd
  -v, --version                 display version number and exit
  -V                            display version code and exit. this is
                                used almost exclusively by Superuser.apk
root@alexandra:~/new/external/sepolicy# adb shell su 0 dmesg
Usage: su [options] [LOGIN]

Options:
  -c, --command COMMAND         pass COMMAND to the invoked shell
  -h, --help                    display this help message and exit
  ...

what is wrong?


On Thu, Sep 20, 2012 at 4:00 PM, Stephen Smalley <sds@tycho.nsa.gov> wrote:

> On Thu, 2012-09-20 at 15:57 +0200, Alexandra Test wrote:
> > I don't have any denials.
> > If I change in enforcing mode with the wifi still connected, the wifi
> > works.
> > But if, in the enforcing mode, I disconnect it and try to reconnect
> > it, it doesn't : he says "obtaining IP address", "connecting", "saved"
> > at the end without being connected...
>
> No avc: or SELinux: messages in dmesg output when it fails?
>
> I suppose it could be hidden by a dontaudit rule.  You could try
> stripping those from your policy and see if you get anything.
>
> --
> Stephen Smalley
> National Security Agency
>
>

[-- Attachment #2: Type: text/html, Size: 2178 bytes --]

RE: seandroid 4.1.1

[Radzykewycz, T (Radzy)]

[-- Attachment #1: Type: text/plain, Size: 1967 bytes --]

Try using "adb shell dmesg" or "adb shell -c dmesg" or "adb shell su -c dmesg" or "adb shell su 0 -c dmesg"


From: owner-selinux@tycho.nsa.gov [mailto:owner-selinux@tycho.nsa.gov] On Behalf Of Alexandra Test
Sent: Thursday, September 20, 2012 7:10 AM
To: Stephen Smalley
Cc: selinux@tycho.nsa.gov
Subject: Re: seandroid 4.1.1

effectively I have a problem with dmesg
is it possible I don't have the package installed?
this is the output....
adb shell su 0 dmsg
Usage: su [options] [LOGIN]

Options:
  -c, --command COMMAND         pass COMMAND to the invoked shell
  -h, --help                    display this help message and exit
  -, -l, --login                make the shell a login shell
  -s, --shell SHELL             use SHELL instead of the default in passwd
  -v, --version                 display version number and exit
  -V                            display version code and exit. this is
                                used almost exclusively by Superuser.apk
root@alexandra:~/new/external/sepolicy# adb shell su 0 dmesg
Usage: su [options] [LOGIN]

Options:
  -c, --command COMMAND         pass COMMAND to the invoked shell
  -h, --help                    display this help message and exit
  ...
what is wrong?


On Thu, Sep 20, 2012 at 4:00 PM, Stephen Smalley <sds@tycho.nsa.gov<mailto:sds@tycho.nsa.gov>> wrote:
On Thu, 2012-09-20 at 15:57 +0200, Alexandra Test wrote:
> I don't have any denials.
> If I change in enforcing mode with the wifi still connected, the wifi
> works.
> But if, in the enforcing mode, I disconnect it and try to reconnect
> it, it doesn't : he says "obtaining IP address", "connecting", "saved"
> at the end without being connected...
No avc: or SELinux: messages in dmesg output when it fails?

I suppose it could be hidden by a dontaudit rule.  You could try
stripping those from your policy and see if you get anything.

--
Stephen Smalley
National Security Agency


[-- Attachment #2: Type: text/html, Size: 6045 bytes --]

Re: seandroid 4.1.1

[Stephen Smalley]

On Thu, 2012-09-20 at 16:10 +0200, Alexandra Test wrote:
> effectively I have a problem with dmesg
> is it possible I don't have the package installed? 
> this is the output....
> adb shell su 0 dmsg
> Usage: su [options] [LOGIN]
> 
> Options:
>   -c, --command COMMAND         pass COMMAND to the invoked shell
>   -h, --help                    display this help message and exit
>   -, -l, --login                make the shell a login shell
>   -s, --shell SHELL             use SHELL instead of the default in
> passwd
>   -v, --version                 display version number and exit
>   -V                            display version code and exit. this is
>                                 used almost exclusively by
> Superuser.apk
> root@alexandra:~/new/external/sepolicy# adb shell su 0 dmesg 

You aren't using the AOSP-provided su command there - that is
Superuser.apk from CM.  Anyway, you should be able to do this:
adb shell
su
dmesg


-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: seandroid 4.1.1

[Stephen Smalley]

On Thu, 2012-09-20 at 14:48 +0000, Radzykewycz, T (Radzy) wrote:
> Try using “adb shell dmesg” or “adb shell –c dmesg” or “adb shell su –
> c dmesg” or “adb shell su 0 –c dmesg”

With 4.1/master, dmesg will only work for root, which is why you have to
su first.

This is controlled by /proc/sys/kernel/dmesg_restrict, which is set to 1
by the init.rc file in 4.1 and master.  Only for kernels which support
it, of course, which would be 2.6.38 and later.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: seandroid 4.1.1

[Alexandra Test]

[-- Attachment #1: Type: text/plain, Size: 1202 bytes --]

The output of
adb shell
su
dmesg

is

"klogctl: Operation not permitted"


On Thu, Sep 20, 2012 at 4:48 PM, Stephen Smalley <sds@tycho.nsa.gov> wrote:

> On Thu, 2012-09-20 at 16:10 +0200, Alexandra Test wrote:
> > effectively I have a problem with dmesg
> > is it possible I don't have the package installed?
> > this is the output....
> > adb shell su 0 dmsg
> > Usage: su [options] [LOGIN]
> >
> > Options:
> >   -c, --command COMMAND         pass COMMAND to the invoked shell
> >   -h, --help                    display this help message and exit
> >   -, -l, --login                make the shell a login shell
> >   -s, --shell SHELL             use SHELL instead of the default in
> > passwd
> >   -v, --version                 display version number and exit
> >   -V                            display version code and exit. this is
> >                                 used almost exclusively by
> > Superuser.apk
> > root@alexandra:~/new/external/sepolicy# adb shell su 0 dmesg
>
> You aren't using the AOSP-provided su command there - that is
> Superuser.apk from CM.  Anyway, you should be able to do this:
> adb shell
> su
> dmesg
>
>
> --
> Stephen Smalley
> National Security Agency
>
>

[-- Attachment #2: Type: text/html, Size: 1709 bytes --]

Re: seandroid 4.1.1

[Stephen Smalley]

On Fri, 2012-09-21 at 10:05 +0200, Alexandra Test wrote:
> The output of 
> adb shell
> su
> dmesg
> 
> is 
> 
> "klogctl: Operation not permitted"

That suggests that su didn't work for you?  Earlier you indicated that
your su program is not the stock AOSP one but rather one from
Superuser.apk.  I'd recommend building a stock SE Android image without
Superuser.apk.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.