[Xiaomi Mi Max ROMs, Kernels, Recoveries, & Other D] quakze:
You have already explained the whole theory about selinux implementation :)

Tried to change this in boot.img-cmdline and the ROM won't boot, because of denials from Selinux enforcing.

So one can't switch the mode of selinux, It has to be done by kernel debugging and permitting the processes required for functional ROM.

---------- Post added at 02:54 AM ---------- Previous post was at 02:50 AM ----------

Its common for custom ROMs, better use Kernel Auditor to cut CPUs online. Shutdown some cores will not hinder performance but definitely improve SOT.

And Greenify to hibernate background apps.

---------- Post added at 03:23 AM ---------- Previous post was at 02:54 AM ----------

Writing SELinux Policy

The Android Open Source Project (AOSP) provides a solid base policy for the applications and services that are common across all Android devices. Contributors to AOSP regularly refine this policy. The core policy is expected to make up about 90–95% of the final on-device policy with device-specific customizations making up the remaining 5–10%. This article focuses on these device-specific customizations, how to write device-specific policy, and some of the pitfalls to avoid along the way.

While writing device-specific policy, follow these steps.

Run in permissive mode

When a device is in permissive mode, denials are logged but not enforced. Permissive mode is important for two reasons:

Permissive mode ensures that policy bringup does not delay other early device bringup tasks.

An enforced denial may mask other denials. For example, file access typically entails a directory search, file open, then file read. In enforcing mode, only the directory search denial would occur. Permissive mode ensures all denials are seen.

The simplest way to put a device into permissive mode is using the kernel command line. This can be added to the device’s BoardConfig.mk file: platform/device/<vendor>/<target>/BoardConfig.mk. After modifying the command line, perform make clean, then make bootimage, and flash the new boot image.

Run the following command from the host, with adb enabled:

$ adb pull /data/misc/audit/audit.log

Address denials of core services

Denials generated by core services are typically addressed by file labeling. For example:

avc: denied { open } for pid=1003 comm=”mediaserver” path="/dev/kgsl-3d0”
dev="tmpfs" scontext=u:r:mediaserver:s0 tcontext=u:object_r:device:s0
tclass=chr_file permissive=1
avc: denied { read write } for pid=1003 name="kgsl-3d0" dev="tmpfs"
scontext=u:r:mediaserver:s0
tcontext=u:object_r:device:s0 tclass=chr_file permissive=1

device-specific files that should be labeled with types predefined in core policy:

block devices

audio devices

video devices

sensors

nfc

gps_device

files in /sys

files in /proc

Label new services and address denials

Init-launched services are required to run in their own SELinux domains. The following example puts service “foo” into its own SELinux domain and grants it permissions.

The service is launched in our device’s init.device.rc file as:

service foo /system/bin/foo
class core

1. Create a new domain "foo"

Create the file device/manufacturer/device-name/sepolicy/foo.te with the following contents:

# foo service
type foo, domain;
type foo_exec, exec_type, file_type;

init_daemon_domain(foo)

This is the initial template for the foo SELinux domain, to which you can add rules based on the specific operations performed by that executable.

2. Label /system/bin/foo

Add the following to device/manufacturer/device-name/sepolicy/file_contexts:

/system/bin/foo u:object_r:foo_exec:s0

This makes sure the executable is properly labeled so SELinux runs the service in the proper domain.

3. Build and flash the boot and system images.

4. Refine the SELinux rules for the domain.

Use denials to determine the required permissions. The audit2allow tool provides good guidelines, but only use it to inform policy writing. Do not just copy the output.
​

Switch back to enforcing mode

It’s fine to troubleshoot in permissive mode, but switch back to enforcing mode as early as possible and try to remain there.