[Xperia Z4/Z3+ Original Android Development] DiscMan55:
[MENTION=513620]Quarx[/MENTION] [MENTION=4329876]Olivier[/MENTION] [MENTION=6979267]nailyk[/MENTION]

Hello,

I'm using quarx device tree as a basis for experimenting on getting full stock-compatible qseecomd encryption support for this device. I built using latest LineageOS tree with my fork here: https://github.com/rwasef1830/android_device_sony_ivy/tree/cm-14.1-twrp (single tree for lineage and twrp). I already succeeded on my TWRP build on getting it working.

I had previously encrypted /data with sony stock rom, then mounted encrypted in twrp with my recovery build and did factory reset and then installed LineageOS. It asked for PIN and when entered it hung on Checking and then gave decryption failed.

I rebuilt again but modified sony kitakami-common BoardConfigCommon.mk to change selinux mode to permissive and it successfully booted but I got no signal in SIM (probably unrelated problem) even though I entered by SIM unlock code correctly (i'll check logcat and look dor problems related to rild).

Anyway I checked dmesg and found selinux denials:

type=1400 audit(9939907.599:3): avc: denied { dac_override } for pid=351 comm="logd" capability=1 scontext=u:r:logd:s0 tcontext=u:r:logd:s0 tclass=capability permissive=1
type=1400 audit(9939908.989:4): avc: denied { dac_override } for pid=421 comm="init.qcom.power" capability=1 scontext=u:r:init-power-sh:s0 tcontext=u:r:init-power-sh:s0 tclass=capability permissive=1
type=1400 audit(9939931.099:5): avc: denied { sys_nice } for pid=2024 comm="main" capability=23 scontext=u:r:zygote:s0 tcontext=u:r:zygote:s0 tclass=capability permissive=1
type=1400 audit(9939968.119:6): avc: denied { read } for pid=368 comm="vold" name="u:object_r:tee_prop:s0" dev="tmpfs" ino=12491 scontext=u:r:vold:s0 tcontext=u:object_r:tee_prop:s0 tclass=file permissive=1
type=1400 audit(9939968.119:7): avc: denied { open } for pid=368 comm="vold" path="/dev/__properties__/u:object_r:tee_prop:s0" dev="tmpfs" ino=12491 scontext=u:r:vold:s0 tcontext=u:object_r:tee_prop:s0 tclass=file permissive=1
type=1400 audit(9939968.119:8): avc: denied { getattr } for pid=368 comm="vold" path="/dev/__properties__/u:object_r:tee_prop:s0" dev="tmpfs" ino=12491 scontext=u:r:vold:s0 tcontext=u:object_r:tee_prop:s0 tclass=file permissive=1
type=1400 audit(9940045.119:9): avc: denied { sys_nice } for pid=4866 comm="main" capability=23 scontext=u:r:zygote:s0 tcontext=u:r:zygote:s0 tclass=capability permissive=1
type=1400 audit(1489523532.594:10): avc: denied { read } for pid=7925 comm="Binder:7873_3" name="/" dev="tmpfs" ino=11012 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:device:s0 tclass=dir permissive=1
type=1400 audit(1489523532.594:11): avc: denied { open } for pid=7925 comm="Binder:7873_3" path="/dev" dev="tmpfs" ino=11012 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:device:s0 tclass=dir permissive=1
type=1400 audit(1489523541.234:12): avc: denied { read } for pid=7925 comm="Binder:7873_3" name="/" dev="tmpfs" ino=11012 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:device:s0 tclass=dir permissive=1
type=1400 audit(1489523541.234:13): avc: denied { open } for pid=7925 comm="Binder:7873_3" path="/dev" dev="tmpfs" ino=11012 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:device:s0 tclass=dir permissive=1
type=1400 audit(1489523550.464:14): avc: denied { read } for pid=7925 comm="Binder:7873_3" name="/" dev="tmpfs" ino=11012 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:device:s0 tclass=dir permissive=1
type=1400 audit(1489523550.464:15): avc: denied { open } for pid=7925 comm="Binder:7873_3" path="/dev" dev="tmpfs" ino=11012 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:device:s0 tclass=dir permissive=1
type=1400 audit(1489523611.414:16): avc: denied { read } for pid=7886 comm="Binder:7873_2" name="/" dev="tmpfs" ino=11012 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:device:s0 tclass=dir permissive=1
type=1400 audit(1489523611.414:17): avc: denied { open } for pid=7886 comm="Binder:7873_2" path="/dev" dev="tmpfs" ino=11012 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:device:s0 tclass=dir permissive=1

I was not able to access adb on the PIN request screen but after it worked i grabbed dmesg from adb shell of running Lineage ROM after running in permissive mode and successfully unlocking /data with PIN.

Are these denials related to encryption (the vold one looks suspicious) ? Also, how do I convert these to selinux contexts and where to put them (I'm an selinux noob), any pointer to right direction to look ? I'm using TheMuppets repo for blobs and before flashing my build I upgraded to Sony Nougat using flashtool and booted with it once correctly (and it decrypted my /data just fine).

EDIT: Attached full dmesg and logcat. Hope anyone can give any pointers or help. Thanks a lot in advance.