[OnePlus 2 General] cr1cr1:
This is a quick guide for disabling selinux to allow installation of Xposed framework on OsygenOS 2.2.x. Tested on my OPT.

This means changing the boot partition settings to allow permissive selinux and re-writing it.

It could work theoretically on any other Lollipops, perhaps Marshmallow, however... needs to be tested.

The red disclaimer: you perform all these changes at your own risk!

My current configuration:

- OxygenOS 2.2.1 (rooted, BETA-SuperSU-v2.67-20160121175247, Boeffla-Kernel 1.1-beta11)

- xposed-v80-sdk22-arm64

- mkbootimg-tools

Steps

You can use adb shell from a prompt (windows is quite ugly though).

For windows I recommend Puttytray (https://puttytray.goeswhere.com/) and connect using adb.

For future ROM updated, assuming you keep patch.sh, just use the terminal embedded in TWRP to run it right from the phone, generate the new boot image and apply it again.

Reboot in recovery (I use TWRP 3.0.0-2)

Make sure /system partition is mounted

mount /system

unzip mkbootimg_tools-master.zip

cd mkbootimg_tools-master/ARM

Create the patch.sh script (the wrapper for the mkbooting tools)

vi patch.sh

paste the contents of the attached script:

#!/system/bin/sh
############################################
# Script to alter the boot image and set selinux=permissive
# WARNING! use this at our own risk, I am not responsible for bricking your phone by corrupting the boot partition
# Tested on OxygenOS 2.1.1, 2.2.0, 2.2.1 (Lollipop 5.1.1)
#
# v1.0.2015-12-30
# Author: cr1cr1
############################################

# Mount /system partition rw, if not already mounted
mount -o rw /system 2>/dev/null

# Set some variables
ORIBOOT=ori-boot.img
PATCHEDBOOT=../new-boot.img
OUTDIR=boot~tmp

# Get the actual boot block partition
BOOTPART=`busybox readlink -f /dev/block/platform/*/by-name/boot`
if [ ! -r $BOOTPART ]; then
echo "Boot partition not found at: $BOOTPART!"
exit 1
fi
echo "Using boot partition: $BOOTPART"

# Copy the boot partition
set -x
busybox dd if=$BOOTPART of=$ORIBOOT
set +x
RETCODE=$?
if [ $RETCODE -ne 0 ]; then
echo "Failed to copy boot part using DD utility, retcode=$RETCODE"
exit $RETCODE
fi

# Unpack the boot image
set -x
./mkboot $ORIBOOT $OUTDIR
set +x
RETCODE=$?
if [ $RETCODE -ne 0 ]; then
echo "Failed to run mkboot utility, retcode=$RETCODE"
exit $RETCODE
fi
if [ ! -w $OUTDIR/img_info ]; then
echo "$OUTDIR/img_info is not writable, exiting!"
exit 1
fi

# Change the kernel command line parameters
if [ "$(busybox grep selinux $OUTDIR/img_info)" == "" ]; then
set -vx
busybox sed -i "s/cmd_line\='/cmd_line\='androidboot.selinux=permissive /" $OUTDIR/img_info
set +vx
else
set -vx
busybox sed -Ei 's/\.selinux=[^ '\'']+/.selinux=permssive/' $OUTDIR/img_info
set +vx
fi

# Repack the boot image
set -x
./mkboot $OUTDIR $PATCHEDBOOT
set +x

Set the execute permission

chmod +x patch.sh

Execute the script to patch the boot image

./patch.sh

You should now have a patched and repacked image:

new-boot.img

Install the new boot image using twrp:

- press install

- press "Install Image"

- select new-boot.img

- Select the partition "boot"

Apparently there is a need to also explicitly disable selinux on startup as well.

For this, yet another script must be used:

vi /system/etc/init.d/08customscript

Paste the following:

#!/system/bin/sh
mount -o remount,rw /system
/system/xbin/su 0 setenforce 0
echo "0" > /sys/fs/selinux/enforce
mount -o remount,ro /system

Set the appropriate permissions

chmod u=rwx,go=r /system/etc/init.d/08customscript