Android 各版本关闭 Selinux 的方法

运行时调试开关 Selinux

 

Cmd	Discription	Other
adb shell getenforce	查看当前 Selinux 功能是 permissive(关闭)还是 enforce(打开)的
adb shell setenforce 0	开Selinux：设置成模式permissive
adb shell setenforce 1	关Selinux：设置成模式enforce

说明：setenforce 修改的状态在设备重启后会失效，需要重新执行命令重新设置。

 

修改源码永久开关 Selinux

---

Android 默认是打开 Selinux 功能的，我们可以按如下方法修改代码强制关闭 Selinux，方便代码功能层面的调试，记得功能调试ok后，把 Selinux 功能恢复，再补充 selinux sepolicy 方面的修改。

关键字：return false; //add to close selinux

Android 10

bool IsEnforcing() {
    {
        int fd(open("/mboot/selinux", O_RDONLY | O_CLOEXEC | O_BINARY));
        if (fd != -1) {
            char v = 0xff;
            if (read(fd, &v, 1) < 0)
                PLOG(ERROR) << "Failed to read /mboot/selinux";
            close(fd);
            LOG(WARNING) << "/mboot/selinux is " << v;
            return v == '1';
        }
    }
    + return false; //add to close selinux
    if (ALLOW_PERMISSIVE_SELINUX) {
        return StatusFromCmdline() == SELINUX_ENFORCING;
    }
    return true;
}

Android 9.0

/system/core/init/selinux.cpp

bool IsEnforcing() {
+ return false; //add to close selinux
  if (ALLOW_PERMISSIVE_SELINUX) {
    return StatusFromCmdline() == SELINUX_ENFORCING;
   }
  return true;
}

Android 8.1

/system/core/init/init.cpp

static bool selinux_is_enforcing(void)
{
+  return false; //add to close selinux
   if (ALLOW_PERMISSIVE_SELINUX) {
     return selinux_status_from_cmdline() == SELINUX_ENFORCING;
}

Andorid 4.4

/system/core/init/init.c

static bool selinux_is_enforcing(void)
{
    char tmp[PROP_VALUE_MAX];
​
+   return false;//add to close selinux
    if (property_get("ro.boot.selinux", tmp) == 0) {
        /* Property is not set.  Assume enforcing */
        return true;
    }
​
    if (strcmp(tmp, "permissive") == 0) {
        /* SELinux is in the kernel, but we've been told to go into permissive mode */
        return false;
    }
​
    if (strcmp(tmp, "enforcing") != 0) {
        ERROR("SELinux: Unknown value of ro.boot.selinux. Got: \"%s\". Assuming enforcing.\n", tmp);
    }
​
    return true;
}