[LG V30 Guides, News, & Discussion] svg1234:
I very recently decided to mod my wonderful, but neglected, LG V30. H933. By following the various guides, I unlocked the bootloader, installed twrp, rooted with magisk. Then using this thread https://xdaforums.com/lg-v30/how-to/canadian-h933-compatibility-h930-roms-t3897586 prepared it for a Pie custom ROM (a tedious process, but it works just fine). I then installed LOS16 H930, no gapps. Using opencamera instead of gcam. All went well, but the camera/flashlight and a few of my user apps wouldn't work.

As many of you know, you can get the camera/flashlight working by setting selinux permissive. However, you need the permissions enabled at the boot/startup level. Executing setenforce 0 as root won't get the camera working in this situation. However, patching the kernel command line, which is what Kernel-Sepolicy-Patcher.zip does will do the trick. Unfortunately, this situation presents us with a dilemma. Running your device in selinux permissive full-time is a security risk one should not take. But having to boot into recovery, run a patcher, then reboot when you want to take a photo...and then repeating the process to go back to enforcing mode, is too tedious.

After spending days deep diving into the seemingly bottomless pit of android camera (a terrific learning experience), running through all the init scripts, services, selinux stuff, etc., etc. For a number of reasons, I never really found the exact solution I was looking for. Finally, I decided upon the following method to deal with the issue. Keep in mind that this still opens up security a little bit, but it's a helluva lot better than running SELinux *permissive* (i.e. no SElinux security at all). I performed most of the work on my arch linux system, but alternatively you can do this using an adb shell or a terminal app on the device.

WARNING / DISCLAIMER: If you mess up or brick your phone, it's on you. It's YOUR responsibility - not mine.

Directions:

1) Obtain a copy of your current boot partition:

dd if=/dev/block/bootdevice/by-name/boot of=/sdcard/boot.img

2) Copy boot.img to the PC's current directory:

adb pull /sdcard/boot.img

3) Use magisk's magiskboot utility to unpack boot.img (kernel, ramdisk, kernel dtb, etc):

./magiskboot unpack boot.img

4) Extract the sepolicy file from ramdisk.cpio:

./magiskboot cpio ramdisk.cpio "extract sepolicy sepolicy"

The quotes are necessary. You can also just use xarchiver or anything that can handle cpio. Don't copy from /sepolicy or /sys/fs/selinux/policy from the live device because they contain a large number of magisk rules (assuming you're rooted). Copy it from the current boot partition.

5) Add/modify selinux rules in the sepolicy file. I used setools-android https://github.com/xmikos/setools-android It built fine on arch linux, I believe dependencies are built in, but YMMV. The sepolicy-inject command is used to add/modify rules. Use logcat and dmesg (save the output to examine it more easily with an editor). See what caused your avc denied entries. Correct some or all of them by adding permissions to existing entries or adding new entries to the policy file.

Update: The only rule change you need to get the camera working is:

sepolicy-inject -s sensors -t sensors -c capability -p dac_override -P sepolicy

However, you might want to change other rules that are generating avc denieds (audio, battery health, ...). You can also use magiskpolicy or other tools for this. You can either add permissions to an existing rule, or add a new rule.

6) Replace the original sepolicy file in ramdisk.cpio with the modified one:

./magiskboot cpio ramdisk.cpio "add 644 sepolicy sepolicy"

7) Repack the boot image:

./magiskboot repack boot.img

magiskboot reads the original unpacked boot.img to get certain info for the repack, and then creates by default a new-boot.img image file.

8) Copy new-boot.img from to your device if it's not already there:

adb push new-boot.img /sdcard

9) Write the new boot image to the device:

dd if=/sdcard/new-boot.img of=/dev/block/bootdevice/by-name/boot

10) Boot. Voila!