SELinux Permission Denied for a new framework service in android

android selinux
Jamsheed Kamarudeen picture Jamsheed Kamarudeen · May 11, 2015 · Viewed 13.9k times · Source

I have added a new System Service into Android Framework in earlier versions (4.4) following this tutorial from Texas Instruments

But when I try to do a similar thing in Android Lollipop, the SELinux policy denies me to do so. This is the output from logcat. 

05-11 15:49:51.362   248   248 I SystemServer: Test Service Starting
05-11 15:49:51.364   248   248 I TestManagerService: Started Test Manager Service
05-11 15:49:51.370    54    54 E SELinux : avc:  denied  { add } for service=TestManagerService scontext=u:r:system_server:s0 tcontext=u:object_r:default_android_service:s0 tclass=service_manager
05-11 15:49:51.371    54    54 E ServiceManager: add_service('TestManagerService',28) uid=1000 - PERMISSION DENIED
05-11 15:49:51.378   248   248 E SystemServer: Failure starting TestManagerService
05-11 15:49:51.378   248   248 E SystemServer: java.lang.SecurityException
05-11 15:49:51.378   248   248 E SystemServer:  at android.os.BinderProxy.transactNative(Native Method)
05-11 15:49:51.378   248   248 E SystemServer:  at android.os.BinderProxy.transact(Binder.java:496)
05-11 15:49:51.378   248   248 E SystemServer:  at android.os.ServiceManagerProxy.addService(ServiceManagerNative.java:150)
05-11 15:49:51.378   248   248 E SystemServer:  at android.os.ServiceManager.addService(ServiceManager.java:72)
05-11 15:49:51.378   248   248 E SystemServer:  at com.android.server.SystemServer.startOtherServices(SystemServer.java:551)
05-11 15:49:51.378   248   248 E SystemServer:  at com.android.server.SystemServer.run(SystemServer.java:257)
05-11 15:49:51.378   248   248 E SystemServer:  at com.android.server.SystemServer.main(SystemServer.java:171)
05-11 15:49:51.378   248   248 E SystemServer:  at java.lang.reflect.Method.invoke(Native Method)
05-11 15:49:51.378   248   248 E SystemServer:  at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:723)
05-11 15:49:51.378   248   248 E SystemServer:  at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:613)

I do not want to disable SELinux policy. I just want the policy to allow my new service too. What should I do?

Answer

Asad Ali picture Asad Ali · May 25, 2015

Check this link: http://androidosp.blogspot.com.tr/2014/11/selinux-seandroid-exceptions-for-system.html

You can simply goto: /external/sepolicy/service_contexts

and add your new service there. Thats it!

Related questions

How to set SELinux to 0 or permissive mode in android 4.4.4 and above?

I want to set the SELinux (Security Enhanced Linux) mode to Permissive or (0) on android 4.4.4 (and above if possible). I use the following command: setenforce 0, setenforce permissive and setenforce Permissive under root (my device is rooted). But the output of …

Read More
set_metadata_recursive failing on Android install

I'm trying to bring up a 4.4 android build for my droid razr HD. It compiles cleanly, but when I try to install it fails with the following error in the recovery log: ApplyParsedPerms: removexattr of /system/xbin/zipalign to 0 failed: …

Read More
Temporary disable or modify SELinux on Android

I'm the developer on a root-app for Android. Sadly now on some devices/ROMs there is SELinux in enforce-mode and prevents some actions of my app. Because this is a root-app, the users are granting me root-access! Now, SELinux is …

Read More