运行时调试开关 Selinux
Cmd | Discription | Other |
---|---|---|
adb shell getenforce | 查看当前 Selinux 功能是 permissive(关闭)还是 enforce(打开)的 | |
adb shell setenforce 0 | 开Selinux:设置成模式permissive | |
adb shell setenforce 1 | 关Selinux:设置成模式enforce |
说明:setenforce 修改的状态在设备重启后会失效
,需要重新执行命令重新设置。
修改源码永久开关 Selinux
Android 默认是打开 Selinux 功能的,我们可以按如下方法修改代码强制关闭 Selinux,方便代码功能层面的调试,记得功能调试ok后,把 Selinux 功能恢复,再补充 selinux sepolicy 方面的修改。
关键字:return false;
//add to close selinux
Android 10
bool IsEnforcing() {
{
int fd(open("/mboot/selinux", O_RDONLY | O_CLOEXEC | O_BINARY));
if (fd != -1) {
char v = 0xff;
if (read(fd, &v, 1) < 0)
PLOG(ERROR) << "Failed to read /mboot/selinux";
close(fd);
LOG(WARNING) << "/mboot/selinux is " << v;
return v == '1';
}
}
+ return false; //add to close selinux
if (ALLOW_PERMISSIVE_SELINUX) {
return StatusFromCmdline() == SELINUX_ENFORCING;
}
return true;
}
Android 9.0
/system/core/init/selinux.cpp
bool IsEnforcing() {
+ return false; //add to close selinux
if (ALLOW_PERMISSIVE_SELINUX) {
return StatusFromCmdline() == SELINUX_ENFORCING;
}
return true;
}
Android 8.1
/system/core/init/init.cpp
static bool selinux_is_enforcing(void)
{
+ return false; //add to close selinux
if (ALLOW_PERMISSIVE_SELINUX) {
return selinux_status_from_cmdline() == SELINUX_ENFORCING;
}
Andorid 4.4
/system/core/init/init.c
static bool selinux_is_enforcing(void)
{
char tmp[PROP_VALUE_MAX];
+ return false;//add to close selinux
if (property_get("ro.boot.selinux", tmp) == 0) {
/* Property is not set. Assume enforcing */
return true;
}
if (strcmp(tmp, "permissive") == 0) {
/* SELinux is in the kernel, but we've been told to go into permissive mode */
return false;
}
if (strcmp(tmp, "enforcing") != 0) {
ERROR("SELinux: Unknown value of ro.boot.selinux. Got: \"%s\". Assuming enforcing.\n", tmp);
}
return true;
}