[Miscellaneous Android Development] Matty1993:
Thought id post today on how to set your SELinux to permissive on boot within your boot.img along with some other mods aswell

DISCLAIMER

Make sure you have at least basic knowledge decompiling boot.img & basic understanding of the files contained within, I will not be held responsible if you mess this up, following my instructions to the tee you will have no problems though,

PRE REQUISTES

* MTK extractor or similar program to decompile the boot.img

* Notepad ++

* A copy of your devices boot.img or BOOTIMG.file

* SP flash tool to flash boot.img to device

"alternatively you can add to a flashable zip if you have a custom recovery available for your device using android script generator here on xda-developers"

GUIDE

1. If your boot file is named BOOTIMG.file rename it to boot.img

2. Copy the boot.img to the program folder youll be using to decompile for this guide ill be using MTK extractor as it has a simple gui interface for all the newbs

3. MTK EXTRACTOR ONLY

Open mtk extractor application select the BOOT option from the left, in the bottom left you will see an off switch toggle it to ON

Click start at the top under unpack boot, in the mtk extractor folder will be your boot.img files

4. SETTING THE KERNEL TO PERMISSIVE

( PART 1 )

NOTE

Not all mtk devices are the same some can be set to permissive without the need for all the files using only some and some require all the files it depends on the kernel the device uses the extra files wont make a difference if anything will enforce the state even more

In this tutorial you will be using all the files to set the SELinux contexts to permissive to ensure it is enforced.

PART 1 - STEP 1.

open the INITRD folder then open your default.prop using notepad++

Set the following :

ro.secure=1 >

ro.secure=0

(This renders the boot.img insecure)

ro.selinux=0 >

ro.selinux=1

(NOTE) UBIFS MTK does not have this option

ro.security.perf_harden=1 > ro.security.perf_harden=0

(If you also want insecure adb)

ro.adb.secure=1 >

ro.adb.secure=0

(only newer mtk devices use this ro. Code )

ro.storage_manager.enabled=1 >

ro.storage_manager.enabled=0

Additionally if your device also has a low ram size you should add this to the default prop also to reduce the amount of ram usage while enabling high-end gfx also

# begin ram properties

# for low ram device to return true

ro.config.low_ram=true

# force high-end graphics in low ram mode

persist.sys.force_highendgfx=true

# ram inhaler

ro.HOME_APP_ADJ=1

# end ram properties

Now save and exit the default.prop

PART 1 - STEP 2.

Open your init.rc & init.charging.rc file with notepad++ scroll to the very bottom of the init.rc ( if you have init.target.rc add to this also)

Place this code exactly as shown

# SELinux

on property:/system/bin/setenforce $permissive u:r:kernel:s0

on property:selinux.echo $permissive > /sys/fs/selinux/enforce u:r:kernel:s0

on property:selinux.reload_policy=0

restart ueventd

restart installd

on property:selinux.setsebool debugfs 0

setenforce 0

setprop selinux.reload_policy 0

seclabel u:r:kernel:s0

Now save & exit the init.rc

PART 1 - STEP 3.

Open your fstab/s

To remove DM-Verity if present in your fstab look for the /system line & change to the following

/system ro wait,verify >

/system ro wait

Now look for /data then remove the force encryption of meta-data on data it will look something like this for exapmle

/dev/block/mmcblk0p2 /data ext4 nosuid,nodev,wait,forceencrypt=/dev/block/mmcblk0p3 ext4 /metadata >

/dev/block/mmcblk0p2 /data ext4 nosuid,nodev,wait

To remove encrypted footers from devices which use this instead of DM-Verity, change as follows using the example below,

/emmc@usrdata /data ext4 noatime,nosuid wait,check,encryptable=footer >

/emmc@usrdata /data ext4 noatime,nosuid, wait (check is optional & can be removed also if wanted)

PART 2 - STEP 1

( if you have init.target.rc already no need for this step)

open a new blank page in notepad++

On the first line add

On init

Space out 1 line so your now on line 3

Copy the #SELinux code we placed from init.rc to the new blank page, now save as init.target.rc

Do the above again but this time name it as init.kernel.rc

Now copy theese files to your INITRD folder

PART 2 - STEP 2.

open your init.rc & init.charging.rc once again

Add the following to the import section at the very top of the page,

import /init.kernel.rc

Import/init.target.rc

Save & exit now, your probably wondering why youve added so many files with the same code, on some devices it is necessary as i have found especially on NAND + UBIFS or JFFS2 devices.

PART 2 - STEP 3.

exit the INITRD Folder now open up the bootinfo.txt file

Change from the following

cmdline: >

cmdline: bootopt= androidboot.selinux=permissive

NOTE

FOR MT67**** 32 BIT DEVICES CHANGE FROM

cmdline: bootopt=64S3,32N2,32N2 >

TO

cmdline: bootopt=64S3,32N2,32N2 androidboot.selinux=permissive

FOR MT67**** 64 BIT DEVICES CHANGE FROM

cmdline: bootopt=64S3,32N2,64S3 >

TO

cmdline: bootopt=64S3,32N2,64S3 androidboot.selinux=permissive

Now save & exit the bootinfo.txt

PART 2 - STEP 4

open the cpiolist

Add the following at the bottom or add wherever dosent matter as long as its there

file init.kernel.rc initrd/init.kernel.rc 0750

file init.target.rc initrd/init.target.rc 0750

(Add this option only if you origninally didnt have the init.target.rc file)

Save & exit the cpiolist.

PART 2 - STEP 5

Recompile & flash if you did everything right youve now got an insecure boot.img without dm-verity encryption or data footer enceyption, with insecure adb & SElinux set as permissive,

To make sure its permissive go into settings and about device then scroll to bottom you should now see it,

If you found this useful you know where the thanks button is.