SELinux / SEAndroid Exceptions for System Services

When attempting to add System Services for Android 4.4.4, permission may be denied due to the Security Enhanced (SE) Linux Mechanism. Below is a console log output from Android 4.4.4's boot process whilst trying to add a user defined service named 'foo'. Line 3 shows permission denied by SELinux for an 'add' operation.

For security, SELinux operates on a whitelist policy where services must be forward declared in an exceptions list in order to be granted permission to run. The intention is to prohibit any unwanted services granted themselves potentially dangerous permissions hence 'enhancing' the overall security and integrity of the operating system. Read more about SELinux here.

There are 2 methods to allow user defined system services

1. Add exceptions entries the the SELinux service list (recommended)

Android's SELinux service list is stored in file:

/external/sepolicy/service_contexts

'foo' can be added to the list as a system service as shown in the snippet below.

2. Disable the SELinux Mechanism

The SELinux mechanism can be disabled altogether by altering Linux's initialization process. The init.rc found in

/system/core/rootdir/init.rc

must be modified to include setenforce 0. Alternatively, setenforce 1 or removing the command would re-enable SElinux. The command has been included in init.rc under on init in the snippet below.

Dealing with System Service Dependencies

As an example of a case where a system service depends on another, below is the constructor for a 'test' service which when constructed, initializes a location manager.


The 'test' service requires that the 'LocationManagerService' is running before 'test' is created so that it can successfully initialize  a location manager.

When Android is started, 'init' is a component of the bootloader sequence which initializes a number of daemons which run continuously whilst the operating system is running.

One of those daemons 'Zygote' is the process responsible for starting system services. It does this by executing the initAndLoop() function of the SystemServer Class.

SystemServer located in frameworks/base/services/java/com/android/server/SystemServer.java

In order to ensure 'LocationManagerService' is running before 'test' service, place the 'test' service's addService code anywhere below that of the 'LocationManagerService'.