[OnePlus 3 ROMs, Kernels, Recoveries, & Other Devel] peshellas:
This is the release notes from Magisk v11,so as we can see the problem was indeed the se inject, and now is fixed by magisksu( Magisk new root solution). So now we can have the system boot in permissive properly. Still the bug of overheat when selinux is enforcing os not fixed, but for that, I think our unstable audio mods are responsible, if jamal could create a 3rd version of the rom with all add-ons except the audio mods, we could test it out.

"2017.2.6 Magisk v11.0

Came back from Chinese New Year holiday with some significant updates!

Introducing MagiskSU

Magisk officially becomes its own rooting solution!

Initially I just want to add root management features into Magisk Manager, but ended up updating lots of code.

Since the changes are quite significant, and no longer compatible with older versions, I'll just name it MagiskSU instead of phh Superuser.

The code is based on phh's approach to update the CM Superuser. I spent quite some effort to achieve SuperSU standards, so far the functionality should be nearly equivalent, my only concern now is compatibility, which is what I will focus on in future releases.

Please note, Magisk is still fully compatible and functional with the latest SuperSU (tested against v2.79-SR3)

The Fully Re-factored sepolicy-inject tool

To accompany with the fresh new MagiskSU, I also spent a ton of effort re-factoring the tool sepolicy-inject.

The tool now accepts policy statements, you can get more info about it from from this section of [MENTION=631273]Chainfire[/MENTION] 's wonderful How-To SU documentation.

Basically I aimed to follow the same syntax as SuperSU's supolicy tool, as it is straight forward and same as the .te policy sources. I added a few additional features in sepolicy-inject, you can directly execute the binary with no options to refer to the help info.

See all changes in the changelog

(I named it "sepolicy-inject" instead of "supolicy", since it still differs in many ways (e.g the built-in rules) even though the syntax is now nearly identical. Root app developers might want to handle this difference when live patching sepolicies)

Pseudo SELinux Enforce Mode

Thanks to the new sepolicy-tool, pseudo enforced mode is now possible (the status shows enforced, but actually is permissive).

In some versions of Google Play Services, setting SELinux to permissive causes Safety Net to fail; however some custom ROMs require the system to be in permissive to be fully functional (although it should be considered as a bad practice). This shall be the perfect solution.

This will not be as a switchable option within Magisk Manager, since Google has a history of pulling apps from the Play Store when related to SELinux (see the tragic example of developer [MENTION=4684315]flar2[/MENTION] 's awesome app, and there are still more incidents).

MagiskHide binary is now updated to detect the permissive state, patch the current sepolicy to pseudo enforced mode, then switch back to enforced.

ROM developers don't have to change anything, just simply set to permissive on boot with a bundled app or a boot script as usual. If a user decided to enable MagiskHide, it will handle everything itself.

General Purpose Boot Scripts

I removed this feature in Magisk v4 and favored the per-module scripts. Now I decided to bring it back again.

The scripts should be placed in /magisk/.core/post-fs-data.d and /magisk/.core/service.d. The directory name should be self-explanatory.

If you have no idea which to choose, the post-fs-data.d will be a nice bet.

So Magisk will now execute script named post-fs-data.sh in each module, and all files within post-fs-data.d. The same applies to service.

Future

Thank you for everyone providing translations to Magisk Manager, and huge thanks to all donated.

I appreciate all the support, and that is my motivation to continue pumping stuffs out!

I will be maintaining MagiskSU continually; support won't end, at least in the near future.

Magic Mount features and better Magisk Module support are also on my list.

I spent zero time on adding more support to devices in v11, all the effort were put in MagiskSU and MagiskManager and major bug fixes.

The whole project is now in the state I consider "feature-packed" enough, most users/developers haven't used the full potential of the features.

I'll stop adding major new features and instead focusing on bringing Magisk to more devices that currently isn't supported.

And yes, that means I will postpone the long planned but never worked on Multi-ROM feature (I barely spent time on it after the POC video)

Hope you all will enjoy the update :)

(P.S. It's 9 AM here and I haven't slept. I'll update documentations after some sleep)"