[Magisk] agentdr8:
[MENTION=4470081]topjohnwu[/MENTION] here's a logcat dump from my Nexus 5x running the latest Chroma rom, from the moment I hit the "Disable Root" button in the new Magisk Manager

08-09 09:34:51.652 19739 19739 D su : starting daemon client 10201 10201
08-09 09:34:51.663 19741 19741 D su : connecting client 19738
08-09 09:34:51.678 19743 19743 D su : remote pid: 19738
08-09 09:34:51.690 19744 19744 D su : remote pts_slave:
08-09 09:34:51.703 19745 19745 D su : remote uid: 10201
08-09 09:34:51.714 19746 19746 D su : remote req pid: 18133
08-09 09:34:51.721 19747 19747 D su : remote args: 1
08-09 09:34:51.728 19751 19751 D su : su invoked.
08-09 09:34:51.733 19749 19749 D su : waiting for child exit
08-09 09:34:51.739 19752 19752 W su : hacks: Testing (com.keramidas.TitaniumBackup:0:10054)
08-09 09:34:51.764 19753 19753 D su : db allowed
08-09 09:34:51.776 19754 19754 W su : hacks: Testing (com.keramidas.TitaniumBackup:10201), 44451
08-09 09:34:51.792 19756 19756 D su : 10201 /magisk/phh/su executing 0 /system/bin/sh using binary /system/bin/sh : sh
08-09 09:34:51.822 19759 19759 I init : type=1400 audit(0.0:6447): avc: denied { execute_no_trans } for path="/sbin/magic_mask.sh" dev="rootfs" ino=9569 scontext=u:r:init:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1
08-09 09:34:51.832 19759 19759 I magic_mask.sh: type=1400 audit(0.0:6448): avc: denied { setenforce } for scontext=u:r:init:s0 tcontext=u:object_r:kernel:s0 tclass=security permissive=1
08-09 09:34:51.832 352 352 W auditd : type=1404 audit(0.0:6449): enforcing=0 old_enforcing=1 auid=4294967295 ses=4294967295
08-09 09:34:51.838 19760 19760 E su : unable to read int: 0
08-09 09:34:51.839 19761 19761 E su : unable to read int: 0
08-09 09:34:51.835 19762 19762 I getprop : type=1400 audit(0.0:6450): avc: denied { write } for path="pipe:[178468]" dev="pipefs" ino=178468 scontext=u:r:toolbox:s0 tcontext=u:r:init:s0 tclass=fifo_file permissive=1
08-09 09:34:51.842 19762 19762 I getprop : type=1400 audit(0.0:6451): avc: denied { getattr } for path="pipe:[178468]" dev="pipefs" ino=178468 scontext=u:r:toolbox:s0 tcontext=u:r:init:s0 tclass=fifo_file permissive=1
08-09 09:34:51.845 19759 19759 I magic_mask.sh: type=1400 audit(0.0:6452): avc: denied { append } for name="magisk.log" dev="mmcblk0p40" ino=15 scontext=u:r:init:s0 tcontext=u:object_r:cache_file:s0 tclass=file permissive=1
08-09 09:34:51.860 19763 19763 I Magisk : Temp unroot for 60 seconds
08-09 09:34:51.858 19759 19759 I magic_mask.sh: type=1400 audit(0.0:6453): avc: denied { execute } for name="busybox" dev="mmcblk0p45" ino=212578 scontext=u:r:init:s0 tcontext=u:object_r:system_data_file:s0 tclass=file permissive=1
08-09 09:34:51.858 19764 19764 I magic_mask.sh: type=1400 audit(0.0:6454): avc: denied { execute_no_trans } for path="/data/busybox/busybox" dev="mmcblk0p45" ino=212578 scontext=u:r:init:s0 tcontext=u:object_r:system_data_file:s0 tclass=file permissive=1
08-09 09:34:51.902 19764 19764 I killall : type=1400 audit(0.0:6455): avc: denied { signal } for scontext=u:r:init:s0 tcontext=u:r:su_daemon:s0 tclass=process permissive=1
08-09 09:34:52.227 479 479 I SELinux : SELinux: Loaded service_contexts from /service_contexts.
08-09 09:34:52.229 479 479 I SELinux : avc: received setenforce notice (enforcing=0)
08-09 09:34:52.232 479 479 I SELinux : avc: received setenforce notice (enforcing=1)

Like the PN users above, it results in a half-unrooted state; apps like Titanium Backup can't obtain root, but the superuser daemons are still running:

root@bullhead:/ # getprop | grep magis
[init.svc.magisk_pfs]: [stopped]
[init.svc.magisk_pfsd]: [stopped]
[init.svc.magisk_service]: [stopped]
[magisk.phhsu]: [0]
[magisk.post-fs-data]: [1]
[magisk.timeout]: [60]

root@bullhead:/ # ps | grep phh
u0_a112 17151 540 1477496 43768 SyS_epoll_ 7fa11841b4 S me.phh.superuser

root@bullhead:/ # which su
/system/xbin/su