[Nexus 6  General] slifox0:
This project is great -- thanks!!

I'm using phhusson's code from source, and I'm having some issues. I'm not very familiar with selinux, so I would appreciate any help.

Basically I'm trying to get AFWall+ to work. From its source, it looks like it acquires a su shell, then does all sorts of stuff (dmesg, iptables, various other checks). In the long run, I'd love to find a way to only grant it access to the things it needs, rather than full root (or give it a different context as root, with minimal access). For now, though, I can't even get it to work at all.

When I run AFWall+, the Superuser app allows it, but then I get these selinux errors:

[ 635.260370] type=1400 audit(1446515872.722:97): avc: denied { ioctl } for pid=5989 comm="sh" path="pipe:[33826]" dev="pipefs" ino=33826 ioctlcmd=5401 scontext=u:r:su:s0 tcontext=u:r:untrusted_app:s0:c512,c768 tclass=fifo_file permissive=0
[ 635.260909] type=1400 audit(1446515872.722:98): avc: denied { ioctl } for pid=5989 comm="sh" path="pipe:[33828]" dev="pipefs" ino=33828 ioctlcmd=5401 scontext=u:r:su:s0 tcontext=u:r:untrusted_app:s0:c512,c768 tclass=fifo_file permissive=0
[ 635.261271] type=1400 audit(1446515872.722:99): avc: denied { getattr } for pid=5989 comm="sh" path="pipe:[33826]" dev="pipefs" ino=33826 scontext=u:r:su:s0 tcontext=u:r:untrusted_app:s0:c512,c768 tclass=fifo_file permissive=0
[ 635.261377] type=1400 audit(1446515872.722:100): avc: denied { ioctl } for pid=5989 comm="sh" path="pipe:[33826]" dev="pipefs" ino=33826 ioctlcmd=5401 scontext=u:r:su:s0 tcontext=u:r:untrusted_app:s0:c512,c768 tclass=fifo_file permissive=0
[ 635.261454] type=1400 audit(1446515872.722:101): avc: denied { getattr } for pid=5989 comm="sh" path="pipe:[33826]" dev="pipefs" ino=33826 scontext=u:r:su:s0 tcontext=u:r:untrusted_app:s0:c512,c768 tclass=fifo_file permissive=0
[ 635.501352] max98925_left_en_put: spk&rcver switch gpio had pulled downtype=1400 audit(1446515873.012:102): avc: denied { write } for pid=5992 comm="app_process" name="system@framework@boot.art" dev="dm-2" ino=1064964 scontext=u:r:su:s0 tcontext=u:object_r:dalvikcache_data_file:s0 tclass=file permissive=0
[ 635.572405] type=1400 audit(1446515873.042:103): avc: denied { write } for pid=5992 comm="main" name="arm64" dev="dm-2" ino=1064963 scontext=u:r:su:s0 tcontext=u:object_r:dalvikcache_data_file:s0 tclass=dir permissive=0
[ 635.603814] type=1400 audit(1446515873.072:104): avc: denied { dac_override } for pid=6003 comm="main" capability=1 scontext=u:r:su:s0 tcontext=u:r:su:s0 tclass=capability permissive=0
[ 635.604229] type=1400 audit(1446515873.072:105): avc: denied { dac_override } for pid=6003 comm="main" capability=1 scontext=u:r:su:s0 tcontext=u:r:su:s0 tclass=capability permissive=0
[ 635.604312] type=1400 audit(1446515873.072:106): avc: denied { sys_nice } for pid=6003 comm="Binder_1" capability=23 scontext=u:r:su:s0 tcontext=u:r:su:s0 tclass=capability permissive=0
[ 635.604389] type=1400 audit(1446515873.072:107): avc: denied { sys_nice } for pid=6003 comm="Binder_1" capability=23 scontext=u:r:su:s0 tcontext=u:r:su:s0 tclass=capability permissive=0
[ 635.604662] type=1400 audit(1446515873.072:108): avc: denied { sys_nice } for pid=6004 comm="Binder_2" capability=23 scontext=u:r:su:s0 tcontext=u:r:su:s0 tclass=capability permissive=0
[ 635.604952] type=1400 audit(1446515873.072:109): avc: denied { sys_nice } for pid=6004 comm="Binder_2" capability=23 scontext=u:r:su:s0 tcontext=u:r:su:s0 tclass=capability permissive=0
[ 635.698045] type=1400 audit(1446515873.162:110): avc: denied { call } for pid=928 comm="Binder_1" scontext=u:r:system_server:s0 tcontext=u:r:su:s0 tclass=binder permissive=0

I actually get very similar deny errors when I run 'su' from 'adb shell' -- though I AM able to become root:

[ 799.279067] type=1400 audit(1446516036.742:131): avc: denied { dac_override } for pid=6173 comm="sh" capability=1 scontext=u:r:su:s0 tcontext=u:r:su:s0 tclass=capability permissive=0
[ 799.601673] type=1400 audit(1446516037.072:132): avc: denied { write } for pid=6176 comm="app_process" name="system@framework@boot.art" dev="dm-2" ino=1064964 scontext=u:r:su:s0 tcontext=u:object_r:dalvikcache_data_file:s0 tclass=file permissive=0
[ 799.634129] type=1400 audit(1446516037.102:133): avc: denied { write } for pid=6176 comm="main" name="arm64" dev="dm-2" ino=1064963 scontext=u:r:su:s0 tcontext=u:object_r:dalvikcache_data_file:s0 tclass=dir permissive=0
[ 799.670136] type=1400 audit(1446516037.132:134): avc: denied { dac_override } for pid=6185 comm="main" capability=1 scontext=u:r:su:s0 tcontext=u:r:su:s0 tclass=capability permissive=0
[ 799.670794] type=1400 audit(1446516037.132:135): avc: denied { dac_override } for pid=6185 comm="main" capability=1 scontext=u:r:su:s0 tcontext=u:r:su:s0 tclass=capability permissive=0
[ 799.671134] type=1400 audit(1446516037.132:136): avc: denied { sys_nice } for pid=6185 comm="Binder_1" capability=23 scontext=u:r:su:s0 tcontext=u:r:su:s0 tclass=capability permissive=0
[ 799.675514] type=1400 audit(1446516037.142:137): avc: denied { sys_nice } for pid=6185 comm="Binder_1" capability=23 scontext=u:r:su:s0 tcontext=u:r:su:s0 tclass=capability permissive=0
[ 799.675708] type=1400 audit(1446516037.142:138): avc: denied { sys_nice } for pid=6186 comm="Binder_2" capability=23 scontext=u:r:su:s0 tcontext=u:r:su:s0 tclass=capability permissive=0
[ 799.676125] type=1400 audit(1446516037.142:139): avc: denied { sys_nice } for pid=6186 comm="Binder_2" capability=23 scontext=u:r:su:s0 tcontext=u:r:su:s0 tclass=capability permissive=0
[ 799.712564] type=1400 audit(1446516037.172:140): avc: denied { call } for pid=928 comm="Binder_1" scontext=u:r:system_server:s0 tcontext=u:r:su:s0 tclass=binder permissive=0

Also, I noticed that when I become root from adb shell, I can't even get a process listing. Whereas with the shell user, I can at least see all running processes. Is this intentional? I can't even run grep as root

I'm testing on Nexus 6P, and I had to patch phhusson's extract and repack code to accept boot.img with 4096 pagesize (rather than just 2048 as in the source). I've also had success using abootimg to do the same operations manually, and it will even autodetect the "bootsize" parameter (whereas repack will just round it up). However I've run into the same issue where I can't repack even the stock initrd.img and get it to boot (either with repack or abootimg) -- so I'm using phhusson's "append method" for now

Also I can't inspect the compiled sepolicy file from here (or even from Chainfire's no-system-write experiment), nor can I run audit2allow to convert those selinux errors into policy adjustments -- because my device's policy is version 30, but all my tools only go up to version 29. I'm not sure if this is just because my libsepol is old, or if android is using some newer policy version or something -- I haven't pursued it yet.

Thanks in advance for any advice!