{"action":"created","issue":{"url":"https://api.github.com/repos/EthACKdotOrg/orWall/issues/79","labels_url":"https://api.github.com/repos/EthACKdotOrg/orWall/issues/79/labels{/name}","comments_url":"https://api.github.com/repos/EthACKdotOrg/orWall/issues/79/comments","events_url":"https://api.github.com/repos/EthACKdotOrg/orWall/issues/79/events","html_url":"https://github.com/EthACKdotOrg/orWall/issues/79","id":64543800,"number":79,"title":"SELinux context for init-script","user":{"login":"cjeanneret","id":82490,"avatar_url":"https://avatars.githubusercontent.com/u/82490?v=3","gravatar_id":"","url":"https://api.github.com/users/cjeanneret","html_url":"https://github.com/cjeanneret","followers_url":"https://api.github.com/users/cjeanneret/followers","following_url":"https://api.github.com/users/cjeanneret/following{/other_user}","gists_url":"https://api.github.com/users/cjeanneret/gists{/gist_id}","starred_url":"https://api.github.com/users/cjeanneret/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cjeanneret/subscriptions","organizations_url":"https://api.github.com/users/cjeanneret/orgs","repos_url":"https://api.github.com/users/cjeanneret/repos","events_url":"https://api.github.com/users/cjeanneret/events{/privacy}","received_events_url":"https://api.github.com/users/cjeanneret/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-03-26T14:44:51Z","updated_at":"2015-07-07T21:22:30Z","closed_at":null,"body":"After many tests, it seems the init-script issue is due to SELinux context, NOT path as mentioned in #69.\r\n\r\nIn order to follow it, a new issue is created.\r\n\r\nHere are the steps we tested on our own in order to debug this:\r\n* Set init-script context to u:object_r:userinit_exec:s0 doesn't help (script doesn't even seem to be called)\r\n* Set init-script context to u:r:init:s0 doesn't help (here again, script doesn't even seem to be called)\r\n* \"su\" binary on CM12 comes from Superuser.apk, which doesn't support \"--context\" option\r\n* Script doesn't find \"su\" binary at startup, even with an enforced PATH value\r\n* We're able to run `setenforce 0` on CM12 with default \"su\" binary\r\n* We might want to push a custom SELinux policy in order to allow the init-script to run iptables commands\r\n* Apparently, iptables should be run in \"u:r:init:s0\" context, as tested by @ahf \r\n* this documentation might provide some hints: https://source.android.com/devices/tech/security/selinux/customize.html\r\n\r\nWhat should the policy allow:\r\n* run \"iptables\" binary in the \"u:r:sysinit:s0\" context\r\nThis is apparently the only authorization we might need — unsure about that."},"comment":{"url":"https://api.github.com/repos/EthACKdotOrg/orWall/issues/comments/119346314","html_url":"https://github.com/EthACKdotOrg/orWall/issues/79#issuecomment-119346314","issue_url":"https://api.github.com/repos/EthACKdotOrg/orWall/issues/79","id":119346314,"user":{"login":"zerokes","id":5183075,"avatar_url":"https://avatars.githubusercontent.com/u/5183075?v=3","gravatar_id":"","url":"https://api.github.com/users/zerokes","html_url":"https://github.com/zerokes","followers_url":"https://api.github.com/users/zerokes/followers","following_url":"https://api.github.com/users/zerokes/following{/other_user}","gists_url":"https://api.github.com/users/zerokes/gists{/gist_id}","starred_url":"https://api.github.com/users/zerokes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zerokes/subscriptions","organizations_url":"https://api.github.com/users/zerokes/orgs","repos_url":"https://api.github.com/users/zerokes/repos","events_url":"https://api.github.com/users/zerokes/events{/privacy}","received_events_url":"https://api.github.com/users/zerokes/received_events","type":"User","site_admin":false},"created_at":"2015-07-07T21:22:30Z","updated_at":"2015-07-07T21:22:30Z","body":"Deleted previous posts for a better solution. Using https://github.com/xmikos/setools-android/tree/master/jni/sepolicy-inject one can chang u:r:sysinit:s0 to permissive mode using command: \r\nsepolicy-inject -Z sysinit -P /sepolicy -o /data/tmp/sepolicy. Rules can be updated by copying selinux_version file, sepolicy, *_contexts and /system/etc/security/mac_permissions.xml to /data/security/current/ folder and setting setprop selinux.reload_policy 1."}}