SELinux / SEAndroid Exceptions for System Services

When attempting to add System Services for Android 4.4.4, permission may be denied due to the Security Enhanced (SE) Linux Mechanism. Below is a console log output from Android 4.4.4's boot process whilst trying to add a user defined service named 'foo'. Line 3 shows permission denied by SELinux for an 'add' operation.

	11-04 14:40:39.271 312 312 I SystemServer: Foo Service
	11-04 14:40:39.273 312 312 I FooService: Spawned worker thread
	11-04 14:40:39.275 51 51 E SELinux : avc: denied { add } for service=foo scontext=u:r:system_server:s0 tcontext=u:object_r:default_android_service:s0 tclass=service_manager
	11-04 14:40:39.276 51 51 E ServiceManager: add_service('foo',48) uid=1000 - PERMISSION DENIED
	11-04 14:40:39.278 312 312 E SystemServer: Failure starting FooService Service
	11-04 14:40:39.278 312 312 E SystemServer: java.lang.SecurityException
	11-04 14:40:39.278 312 312 E SystemServer: at android.os.BinderProxy.transact(Native Method)
	11-04 14:40:39.278 312 312 E SystemServer: at android.os.ServiceManagerProxy.addService(ServiceManagerNative.java:150)
	11-04 14:40:39.278 312 312 E SystemServer: at android.os.ServiceManager.addService(ServiceManager.java:72)
	11-04 14:40:39.278 312 312 E SystemServer: at com.android.server.ServerThread.initAndLoop(SystemServer.java:834)
	11-04 14:40:39.278 312 312 E SystemServer: at com.android.server.SystemServer.main(SystemServer.java:1217)
	11-04 14:40:39.278 312 312 E SystemServer: at java.lang.reflect.Method.invoke(Native Method)
	11-04 14:40:39.278 312 312 E SystemServer: at java.lang.reflect.Method.invoke(Method.java:372)
	11-04 14:40:39.278 312 312 E SystemServer: at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:772)
	11-04 14:40:39.278 312 312 E SystemServer: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:585)

view raw gistfile1.sh hosted with ❤ by GitHub

For security, SELinux operates on a whitelist policy where services must be forward declared in an exceptions list in order to be granted permission to run. The intention is to prohibit any unwanted services granted themselves potentially dangerous permissions hence 'enhancing' the overall security and integrity of the operating system. Read more about SELinux here.

There are 2 methods to allow user defined system services

1. Add exceptions entries the the SELinux service list (recommended)

Android's SELinux service list is stored in file:

/external/sepolicy/service_contexts

'foo' can be added to the list as a system service as shown in the snippet below.

	/*
	*
	*/
	drm.drmManager u:object_r:drmserver_service:s0
	dropbox u:object_r:system_server_service:s0
	entropy u:object_r:system_server_service:s0
	ethernet u:object_r:system_server_service:s0
	foo u:object_r:system_server_service:s0
	gfxinfo u:object_r:system_server_service:s0
	hardware u:object_r:system_server_service:s0
	hdmi_control u:object_r:system_server_service:s0
	inputflinger u:object_r:inputflinger_service:s0
	input_method u:object_r:system_server_service:s0
	/*
	*
	*/

view raw gistfile1.txt hosted with ❤ by GitHub

2. Disable the SELinux Mechanism

The SELinux mechanism can be disabled altogether by altering Linux's initialization process. The init.rc found in

/system/core/rootdir/init.rc

must be modified to include setenforce 0. Alternatively, setenforce 1 or removing the command would re-enable SElinux. The command has been included in init.rc under on init in the snippet below.

	#
	# early init commands
	#
	on init
	# disable Security Enhanced Linux
	setenforce 0
	sysclktz 0
	loglevel 3
	#
	# other on init commands
	#

view raw gistfile1.txt hosted with ❤ by GitHub