[Android Software/Hacking General [Developers Only]] JellyShakers:
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

#Experimental:

- Try to change SELinux policy rules on Android to allow running Seeder in SELinux "enforcing" mode.

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

#Requires:

-> root permission (Of course, it only works if device is rooted.)

-> busy-box (Probably required, install from playstore)

-> sepolicy-inject (Tool to inject SELinux policies, get it from xda http://xdaforums.com/android/software/setools-android-sepolicy-inject-t2977563 )

-> dmesg, grep, mount, load_policy (May or may not be on your device or installed from busy-box)

-> tasker (For applying SELinux policies on boot, install from playstore)

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

#Get avc:

root@slte:/ # dmesg | grep 'avc' | grep 'seeder'

[12825.053112] [c1] type=1400 audit(1467559720.620:6554): avc: denied { search } for pid=23738 comm="com.lcis.seeder" name="10899" dev="proc" ino=263544

scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:r:sudaemon:s0 tclass=dir permissive=0

[ 221.284770] [c1] type=1400 audit(1467650701.669:1112): avc: denied { read } for pid=6553 comm="com.lcis.seeder" name="cmdline" dev="proc" ino=42921

scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:r:sudaemon:s0 tclass=file permissive=0

[ 541.577696] [c1] type=1400 audit(1467651021.964:1128): avc: denied { open } for pid=6553 comm="com.lcis.seeder" path="/proc/8520/cmdline" dev="proc" ino=67725

scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:r:sudaemon:s0 tclass=file permissive=0

[ 681.807999] [c1] type=1400 audit(1467651162.194:1141): avc: denied { getattr } for pid=6553 comm="com.lcis.seeder" path="/proc/8860/cmdline" dev="proc" ino=59338

scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:r:sudaemon:s0 tclass=file permissive=0

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

#New rules:

root@slte:/ # su

root@slte:/ # mount -o 'rw,remount' -t rootfs /

root@slte:/ # sepolicy-inject -v -s 'untrusted_app' -t 'sudaemon' -c 'dir' -p 'search' -P './sepolicy'

root@slte:/ # sepolicy-inject -v -s 'untrusted_app' -t 'sudaemon' -c 'file' -p 'read,open,getattr' -P './sepolicy'

root@slte:/ # load_policy './sepolicy'

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

#One line:

root@slte:/ # su

root@slte:/ # mount -v -o 'rw,remount' -t rootfs / && sepolicy-inject -v -s 'untrusted_app' -t 'sudaemon' -c 'dir' -p 'search' -P './sepolicy' && sepolicy-inject -v -s 'untrusted_app' -t 'sudaemon' -c 'file' -p 'read,open,getattr' -P './sepolicy' && load_policy './sepolicy'

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

#Output:

libsepol.policydb_index_others: security: 1 users, 2 roles, 579 types, 0 bools

libsepol.policydb_index_others: security: 1 sens, 1024 cats

libsepol.policydb_index_others: security: 87 classes, 5356 rules, 0 cond rules

Adding rule: [AV] ALLOWED untrusted_app-->sudaemon (dir) [search]

Success

libsepol.policydb_index_others: security: 1 users, 2 roles, 579 types, 0 bools

libsepol.policydb_index_others: security: 1 sens, 1024 cats

libsepol.policydb_index_others: security: 87 classes, 5357 rules, 0 cond rules

Adding rule: [AV] ALLOWED untrusted_app-->sudaemon (file) [read]

Adding rule: [AV] ALLOWED untrusted_app-->sudaemon (file) [open]

Adding rule: [AV] ALLOWED untrusted_app-->sudaemon (file) [getattr]

Success

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

#Result:

root@slte:/ # dmesg | grep 'avc' | grep 'seeder'

--> No ouput, cause there are no more "avc: denied" for Seeder.

root@slte:/ # getenforce

Enforcing

--> SELinux status is still "enforcing".

root@slte:/ # ps | grep 'rngd'

root 6740 1 25444 240 hrtimer_na 00039fe4 S /data/data/com.lcis.seeder/rngd

--> "Rngd"-Service seems to be up and running.

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

# Conclusion:

Seeder is running even if SELinux is set to 'enforcing' and does not through any error messages.

The problem is I don't know much about SELinux yet and maybe this solution is a security risk.

For me it looks like every "untrusted_app" is now allowed access these functions.

Maybe I should try to let Seeder run in a different context ("chcon" ?) rather than adding "ALLOWED"'s into "sepolicy" to fix the problem.

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

#Apply on boot:

At this point the changes are not permanent and are restored to default after reboot.

There may be several ways to load SELinux policy rules on boot but I decided to try it with Tasker:

1.) Profile -> Event -> System -> Device Boot

2.) New Task -> Seeder_Policy

3.) Code -> Run Shell -> Command -> *One line from above (without "su"!)*

4.) Use Root -> Enable

Now the SELinux policies get applied on boot and Seeder starts even in "enforcing" mode.

Sometimes when Seeder is startet before Tasker did it's stuff then it's required to launch Seeder by hand.

Still looking for a good way to fix that ...

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

#My OS:

- Samsung Galaxy Alpha (SM-G850F / SLTE)

- Cyanogenmod 13.0 UNOFFICIAL BETA3 (Android 6.0)

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------