SELinux permissive for debugging

Warning

Permissive SELinux turns off a core part of Android's security model. Use it only to collect logs for a bug report, then flash your original boot image back.

You only need this if an issue can't be reproduced or logged with SELinux enforcing. If your device boots, get logs as described in Reporting issues and logs first. In a custom recovery, dmesg and pstore logs are available without this.

Requirements

• A debug build of RestlessOS from https://build.chrisaw.io. Release builds ignore the permissive flag and stay enforcing.
• A backup of the boot image you are going to patch, see Backing up your device.
• magiskboot for your PC:
  • Linux: https://github.com/Uevo001/magiskboot-linux
  • Windows (unofficial port): https://github.com/svoboda18/magiskboot

Samsung kernels ignore this flag. On Samsung, a permissive kernel build is needed instead.

Patch the boot image

Use vendor_boot.img if your device has a vendor_boot partition, otherwise boot.img. The examples use vendor_boot.img.

1. Unpack it:

   chmod +x magiskboot                       # Linux only
   ./magiskboot unpack -h vendor_boot.img

2. Open the extracted header file in a text editor and add androidboot.selinux=permissive to the end of the cmdline= line, separated by a space.

3. Repack:

   ./magiskboot repack vendor_boot.img vendor_boot_permissive.img

4. Flash it to the same partition:

   adb reboot bootloader
   fastboot flash vendor_boot vendor_boot_permissive.img
   fastboot reboot

On Windows, use magiskboot.exe instead of ./magiskboot.

Collect logs

Check that SELinux is permissive and get the denials:

adb shell getenforce
adb logcat -b all -d | grep avc > avc.txt

Collect the other logs from Reporting issues and logs, attach everything to your issue, then flash your original vendor_boot.img / boot.img back.