Database Info

[APP][Root][4.2+]SELinuxModeChanger v10.0 :: [24.07.2017]

Now opensourced under gplv3! GITHUB
Get it in f-droid F-DROID page (v10 probably won't be there until release of stable gradle 4.0 and buildtools 26)
Now available on the XDA Labs! XDA Labs page (UPD: somebody released a fork without changing packagename so you can't get it there yet -_-)
Apk from github app-release-v10.apk - (as that's the only way to distribute it until I get control of my packagename on xda labs)
There are lots of folks around who already has KitKat on their devices. But kitkat comes with new secutity enhancement, SELinux, put into "enforcing mode". Maybe This thing is good from the point of security, but it breaks some Root Apps, like my Ultimate Dynamic Navbar, so I created this app.
What does it do? This app can change modes of SELinux:
Run app, give root access, select the mode you want SELinux to be in(permissive or enforcing) and that's all. Every time you reboot your device app will execute the script to change SELinux to the mode you've selected. Simple and stupid.
know issues:
- [THEORETICALLY] doesn't work with Samsung KNOX.
XDA:DevDB Information
SELinuxModeChanger, App for the Android General
Contributors
MrBIMC
Version Information
Status: Stable
Current Stable Version: 10.0
Stable Release Date: 2017-07-24
Created 2013-11-13
Last Updated 2017-07-24

With all the hype over SELinux Permissive and Enforcing, Ill be glad to test this out

WEM97 said:
With all the hype over SELinux Permissive and Enforcing, Ill be glad to test this out
Click to expand...
Click to collapse
Post your results once you've tested. Cuz I'm on custom kernel now that has SELinux completely disabled and didn't really tested this app

Does not work on my N9005 stock, i open the app, grant it root access, click on passive and hust to make sure i rebooted, still when i goto settings/about i get enforcing written...

Ather said:
Does not work on my N9005 stock, i open the app, grant it root access, click on passive and hust to make sure i rebooted, still when i goto settings/about i get enforcing written...
Click to expand...
Click to collapse
I don't sure the string there will actually change. Better test by executing this in some terminal emulator:
Code:
su
/system/bin/getenforce

MrBIMC said:
I don't sure the string there will actually change. Better test by executing this in some terminal emulator:
Code:
su
/system/bin/getenforce
Click to expand...
Click to collapse
Outputs: Enforcing

MrBIMC said:
Post your results once you've tested. Cuz I'm on custom kernel now that has SELinux completely disabled and didn't really tested this app
Click to expand...
Click to collapse
Same as the other guy. Passive to Passive. Post reboot of course.

WEM97 said:
Same as the other guy. Passive to Passive. Post reboot of course.
Click to expand...
Click to collapse
Just flashed stock kernel. Indeed. Works only untill reboot. After that - no Will work on a fix now!
UPD: Switched few times into different states - it works. Works when device is booted, works after reboot(wait till notification appear - go to "about phone".). Rebooted ~10 times to check it out - everything works fine for me(galaxy nexus, android 4.4)!
Dunno, guys. Maybe that's root denial in your case or something like this?
Waiting for more replies.

MrBIMC said:
Just flashed stock kernel. Indeed. Works only untill reboot. After that - no Will work on a fix now!
UPD: Switched few times into different states - it works. Works when device is booted, works after reboot(wait till notification appear - go to "about phone".). Rebooted ~10 times to check it out - everything works fine for me(galaxy nexus, android 4.4)!
Dunno, guys. Maybe that's root denial in your case or something like this?
Waiting for more replies.
Click to expand...
Click to collapse
Could be the knox not letting it set?

Ather said:
Could be the knox not letting it set?
Click to expand...
Click to collapse
Don't know. Will look to it tommorow. It's almost 4 am here, so I'm going to sleep now.

Ok, guys. Checked on few different devices. Can finally say that this thin works for every 4.3++ device, except Samsung KNOX-enabled ones.
Looking for knox fix now

Just a question: why not make it set the mode on boot the init.d way, cause I want to have less apps running at boot, anyway this is cool for those too lazy to use the setenforce command in terminal (and make a script)?

Ranomez said:
Just a question: why not make it set the mode on boot the init.d way, cause I want to have less apps running at boot, anyway this is cool for those too lazy to use the setenforce command in terminal (and make a script)?
Click to expand...
Click to collapse
init.d script could be added as an option, but not as #1 variant because this app is mainly targeted to stock users, and usually(always?) stock kernels don't support init.d scripts.
Also you shouldn't care about consumption of background process, cuz it doesn't start any service. After every reboot app starts only for ~1 second to execute few commands, and closes right after.

Works on note3 vzw,. Great app

nutpn said:
Works on note3 vzw,. Great app
Click to expand...
Click to collapse
Wow. Do you have KNOX in your rom? What was the default state for SELinux for you(Does note 3 has "enforcing" mode on 4.3 by default)?

MrBIMC said:
Wow. Do you have KNOX in your rom? What was the default state for SELinux for you(Does note 3 has "enforcing" mode on 4.3 by default)?
Click to expand...
Click to collapse
VZW Note 3 is SElinux permissive by default.

MrBIMC said:
Wow. Do you have KNOX in your rom? What was the default state for SELinux for you(Does note 3 has "enforcing" mode on 4.3 by default)?
Click to expand...
Click to collapse
All my knox stuff is deleted and vzw is permissive, I checked to see if it would work and it changed to enforce then I toggled back to permissive so it worked on my note 3 thanks Im putting this one in my later folder in case anything ever happens it may work out for us.

Thanks for this useful app.
Just tried it on my Xperia mini pro running 4.3.1,unofficial CM10.2.
But after clicking the "Enforcing" button and rebooting a couple of times,my SELinux status still shows Permissive.
Am I still missing something?

Confirming that it doesn't work on my Samsung galaxy note 3 even after freezing all knox stuff. Didn't expect it to work but just so other people don't try lol
Sent from my SAMSUNG-SM-N900A using xda app-developers app

tried. on note 2 leaked 4.3 MJ5.
was permissive but tried and changed to enforcing.
now cant get back.
P.S. : we dont have knox implemented as in s4 or note 3.
and also removed all knox related things.
see pic :http://i44.tinypic.com/azjas.png

Selinux permissive

Hey xda I'm looking for a kernel for PAC Man ROM that is selinux permissive to enable touch screen compatibility with my appradio 3. I've tried the selinux mode changer but it doesn't seem to do any thing except set a notification that it set selinux to permissive.
Abby suggestions it there?
Sent from my SCH-I535 using XDA Premium 4 mobile app

JakaraRuus said:
Hey xda I'm looking for a kernel for PAC Man ROM that is selinux permissive to enable touch screen compatibility with my appradio 3. I've tried the selinux mode changer but it doesn't seem to do any thing except set a notification that it set selinux to permissive.
Abby suggestions it there?
Sent from my SCH-I535 using XDA Premium 4 mobile app
Click to expand...
Click to collapse
Have you made sure that it doesn't change anything, you can check the selinux status under Settings>About Phone. I personally have never had this problem. also can you tell me why you need to change it to permissive.

SeLinux Permissive
Mtsprite said:
Have you made sure that it doesn't change anything, you can check the selinux status under Settings>About Phone. I personally have never had this problem. also can you tell me why you need to change it to permissive.
Click to expand...
Click to collapse
Thanks for your reply. What I mean about nothing changes is when I check the status in settings>about phone after setting permissive mode with the selinux mode changer app and rebooting like it requests it still says enforceing. as to why I want to change it, I said before I am trying to get the touch interface to work on my pioneer appradio 3 head unit. I can mirror but touch doesn't work on the head unit. I have read in the appradio forum that you have to set SeLinux to permissive in order to accomplish this. I was hoping that some one with knowledge of custom kernels would be able to shed some light on this since it seems that Pac Man is set to enforcing by default. Also I have read that other kernels for other devices had the permissive mode set. I am so close to having this functionality it is getting frustrating, but I like the features that pac man brings to the table so I don't really want to switch. at this point.

JakaraRuus said:
Thanks for your reply. What I mean about nothing changes is when I check the status in settings>about phone after setting permissive mode with the selinux mode changer app and rebooting like it requests it still says enforceing. as to why I want to change it, I said before I am trying to get the touch interface to work on my pioneer appradio 3 head unit. I can mirror but touch doesn't work on the head unit. I have read in the appradio forum that you have to set SeLinux to permissive in order to accomplish this. I was hoping that some one with knowledge of custom kernels would be able to shed some light on this since it seems that Pac Man is set to enforcing by default. Also I have read that other kernels for other devices had the permissive mode set. I am so close to having this functionality it is getting frustrating, but I like the features that pac man brings to the table so I don't really want to switch. at this point.
Click to expand...
Click to collapse
Ok well when i needed to do this i would always use the app described here. also its not that PAC ROM does this intentionally, in fact it was google who made 4.4.2 selinux set to enforcing, and its because of this that most if not all kernels for 4.4.2 have selinux set to enforcing.

SElinux permissive

I wanna know that can we make selinux mod to permissive for specific app through terminal or my using any other method I read about selinux in wiki but didn't got much details to do some tweaks and I am also not developer so that I don't know all codes used for this and that processes also I wanna set that specific permissive mod for "viper4android" app I want to use that app and also don't want to break out all doors of security by setting mod on permissive for all apps can anyone help me here plz !?

ChintanVyas said:
I wanna know that can we make selinux mod to permissive for specific app through terminal or my using any other method I read about selinux in wiki but didn't got much details to do some tweaks and I am also not developer so that I don't know all codes used for this and that processes also I wanna set that specific permissive mod for "viper4android" app
Click to expand...
Click to collapse
Sorry, you cannot do it for specific app..
SE Linux Enforcement has to be disabled universally throughout the system..
ChintanVyas said:
I want to use that app and also I don't want to break out all doors of security by setting mod on permissive for all apps can anyone help me here plz !?
Click to expand...
Click to collapse
Once your phone is rooted, it means it is vulnerable to all risks..
It just takes a single command (setenforce 0) for a malware app to set SE Linux to 'Permissive' if granted root permission.
So, it's just in your hands to select the right trustable apps.
Go ahead, and set it to 'Permissive'.
Nothing will happen..

What is SELinux and how do I know whether it is enabled on my custom ROM?

Dear XDA Community,
Sorry, this is a newbie question, but when I was asking for suggestions for a custom and also secure ROM, I was suggested Pixel Experience and I have also been told to set SELinux to permissive. What is the purpose of SELinux? Is there a guide on how to adjust it to the appropriate settings? Does it not come enabled as default? Thank you in advance.

jason.mix said:
Dear XDA Community,
Sorry, this is a newbie question, but when I was asking for suggestions for a custom and also secure ROM, I was suggested Pixel Experience and I have also been told to set SELinux to permissive. What is the purpose of SELinux? Is there a guide on how to adjust it to the appropriate settings? Does it not come enabled as default? Thank you in advance.
Click to expand...
Click to collapse
SELinux policy is a security feature built into your kernel. Android is set to "enforcing" by default, you have to manually switch to permissive. A lot of custom mods and root enabled apps require your device to be in permissive mode in order to work. A classic example that I've used many times is a mod called Viper4Android, it requires permissive mode in order for it to function. This is not the only example, there are many other apps and mods that require permissive mode. Your device must be rooted in order to use permissive mode.
There is nothing special about enabling this, you just need to look for a custom kernel for your specific model number that has permissive mode built into the kernel then install the kernel or you can find an app such as SELinux Switch/SELinux Toggle, but, I'm not sure if that app is supported any more, the developer that built it hasn't been active here in quite some time.
Sent from my SM-S767VL using Tapatalk

Droidriven said:
SELinux policy is a security feature built into your kernel. Android is set to "enforcing" by default, you have to manually switch to permissive.
Click to expand...
Click to collapse
Thank you for your response. Just to clarify, should I just leave it as it comes or should I always double check after flashing the custom ROM? And is there a guide on how to adjust this option appropriately or does it depend on the ROM? I came across this thread and it states that Pixel Experience is set to permissive automatically. What should I do? And do you have any other advice for what other precautions I should take in order to have that extra security when using a custom ROM? Once again, thank you.

jason.mix said:
Thank you for your response. Just to clarify, should I just leave it as it comes or should I always double check after flashing the custom ROM? And is there a guide on how to adjust this option appropriately or does it depend on the ROM? I came across this thread and it states that Pixel Experience is set to permissive automatically. What should I do? And do you have any other advice for what other precautions I should take in order to have that extra security when using a custom ROM? Once again, thank you.
Click to expand...
Click to collapse
If you are concerned with being secure, you need to leave the device in enforcing mode, not permissive. I'm not sure exactly how you would switch the Pixel ROM from permissive to enforcing, the ROM may have a setting or you may have to use the Kernel Auditor app to switch to enforcing mode.
If you are not going to be doing any kind of modification to the system partition, you won't need to worry with permissive mode.
If the Pixel ROM is permissive by default, you won't need to change anything.
I'm not sure you understand exactly how the "switch" between enforcing/permissive is achieved. It not simply a "setting" that you enable/disable.
Here are a few ways to enable permissive mode that I know of:
1) if your stock kernel does not support permissive mode, you have to flash a kernel that has permissive support.
2) if your stock kernel does support permissive mode but doesn't have permissive mode enabled, you have to use something like the "SELinux Switch" or "SELinux Toggle" apps, these apps force the stock kernel into permissive mode and can be set to automatically enable permissive mode whenever the device boots and persist from one reboot to the next.
3) it can be enabled via adb commands or adb shell commands via PC or, if you are rooted, you can use a terminal emulator app or the terminal emulator that is built into TWRP to issue commands to enable enforcing/permissive, whichever you need.
Sent from my SM-S767VL using Tapatalk

Droidriven said:
If you are concerned with being secure, you need to leave the device in enforcing mode, not permissive. I'm not sure exactly how you would switch the Pixel ROM from permissive to enforcing, the ROM may have a setting or you may have to use the Kernel Auditor app to switch to enforcing mode.
Click to expand...
Click to collapse
I am not planning on rooting or modifying my system in any way, but is there a way to check whether I am running in enforcing mode? I am still running MIUI for now and if it helps, my kernel version is 4.9 186-perf-g1e22c7b and if you need any more details then just let me know. Thank you for helping me out.

jason.mix said:
I am not planning on rooting or modifying my system in any way, but is there a way to check whether I am running in enforcing mode? I am still running MIUI for now and if it helps, my kernel version is 4.9 186-perf-g1e22c7b and if you need any more details then just let me know. Thank you for helping me out.
Click to expand...
Click to collapse
To check whether your device is set to enforcing/permissive, you should be able to look in system settings>about phone>SELinux Status
Or
system settings>about phone>software info>SELinux Status
Or something similar, the exact location of the info is different for different devices/android versions.
Sent from my SM-S767VL using Tapatalk

Risk of running SELinux Permissive on daily basis?

Hello, I've been looking to flash a custom rom on my phone, but all the roms available are on SELinux Permissive.
From what I do understand, running permissive allows any apps to obtain root - without asking for your permission.
In theory, that sounds pretty dangerous. But how does it works in practice? Is it as dangerous as it sounds?
Should I continue to avoid these permissive roms due to the theortical security risk or just go for it?

Setting Android's SELinux mode to permissive by default is the most idiotic action you can perform on Android devices, IMO

its fine as long as you use the phone only for rooting and gaming

Guan Yu said:
its fine as long as you use the phone only for rooting and gaming
Click to expand...
Click to collapse
in what scenarios would it be considered not safe to leave it on permissive?

xXx yYy said:
Setting Android's SELinux mode to permissive by default is the most idiotic action you can perform on Android devices, IMO
Click to expand...
Click to collapse
I had that assumption too, but I think that I don't know enough to make that judgement