[LineageOS Questions & Answers] bytes85:
Hi,

I'm running LineageOS 15 (Android 8) on S5 mini. Everything is fine except one banking app that I really need. They validate on startup, whether the phone is rooted.

They in fact check if SE Linux is in enforcement mode. Here is the log snippet:

11-23 18:44:54.894 2259 2521 I ActivityManager: START u0 {act=android.intent.action.MAIN cat=[android.intent.category.LAUNCHER] flg=0x10200000 cmp=com.fidor.fsw/com.gft.fidor.views.splash.SplashScreenActivity bnds=[350,815][506,994] (has extras)} from uid 10036
11-23 18:44:54.935 2084 2084 I display : [DYNAMIC_RECOMP] HWC_2_GLES by low FPS(0)
11-23 18:44:54.969 2259 4027 I ActivityManager: Start proc 20526:com.fidor.fsw/u0a119 for activity com.fidor.fsw/com.gft.fidor.views.splash.SplashScreenActivity
11-23 18:44:55.190 2084 2084 I display : [DYNAMIC_RECOMP] GLES_2_HWC by high FPS(39)
11-23 18:44:55.229 20526 20540 I vndksupport: sphal namespace is not configured for this process. Loading /system/lib/egl/libEGL_mali.so from the current namespace instead.
11-23 18:44:55.326 20526 20540 D libEGL : loaded /system/lib/egl/libEGL_mali.so
11-23 18:44:55.339 2084 2133 W GrallocMapperPassthrough: buffer descriptor with invalid usage bits 0x400
11-23 18:44:55.356 20526 20540 I vndksupport: sphal namespace is not configured for this process. Loading /system/lib/egl/libGLESv1_CM_mali.so from the current namespace instead.
11-23 18:44:55.362 20526 20540 D libEGL : loaded /system/lib/egl/libGLESv1_CM_mali.so
11-23 18:44:55.586 20526 20540 I vndksupport: sphal namespace is not configured for this process. Loading /system/lib/egl/libGLESv2_mali.so from the current namespace instead.
11-23 18:44:55.588 20526 20540 D libEGL : loaded /system/lib/egl/libGLESv2_mali.so
11-23 18:44:56.455 20526 20526 I putmethod.latin: type=1400 audit(0.0:774): avc: denied { read } for name="/" dev="tmpfs" ino=3689 scontext=u:r:untrusted_app_25:s0:c512,c768 tcontext=u:object_r:rootfs:s0 tclass=dir permissive=1
11-23 18:44:56.455 20526 20526 W putmethod.latin: type=1300 audit(0.0:774): arch=40000028 syscall=334 per=800008 success=yes exit=0 a0=ffffff9c a1=898ca354 a2=4 a3=0 items=1 ppid=2066 auid=4294967295 uid=10119 gid=10119 euid=10119 suid=10119 fsuid=10119 egid=10119 sgid=10119 fsgid=10119 tty=(none) ses=4294967295 exe="/system/bin/app_process32" subj=u:r:untrusted_app_25:s0:c512,c768 key=(null)
11-23 18:44:56.455 1978 1978 W auditd : type=1307 audit(0.0:774): cwd="/"
11-23 18:44:56.455 1978 1978 W auditd : type=1302 audit(0.0:774): item=0 name="/sbin" inode=3689 dev=00:12 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=u:object_r:rootfs:s0
11-23 18:44:56.455 1978 1978 W auditd : type=1327 audit(0.0:774): proctitle="com.google.android.inputmethod.latin"
11-23 18:44:56.455 1978 1978 W auditd : type=1320 audit(0.0:774):
11-23 18:44:56.527 2259 3192 W ActivityManager: Force finishing activity com.fidor.fsw/com.gft.fidor.views.splash.SplashScreenActivity

Since LineageOS sets SELinux by default into permissive, this check fails and the app crashes. I'm able to set it to enforced with "SE Linux mode changer" or any other app of that kind, but immediately after the change the phone starts eating 100% cpu and modem (neither internet, nor SMS/phone calls) aren't working, which makes me think LineageOS doesn't work really well in enforcement mode of SE Linux. But the app itself launches just fine with SELinux in enforced.

I'm not an expert in Android and SELinux, but would like to know if there is a way:

to workaround the check we see in the logs and work with the app in permissive mode

to make LineageOS work correctly under enforced

PS. It doesn't matter which way to set the SELinux mode. Whatever is done - through kernel, in init.d or in adb shell, the symptoms are exactly the same after the change.

Thanks