Description
This is unofficial port of setools to Android with additional sepolicy-inject utility by Joshua Brindle
Ported:
- seinfo
- sesearch
These tools allow to analyze SELinux/SEAndroid policy on an Android device.
Included:
- sepolicy-inject
This tool injects allow rules into binary SELinux kernel policies.
Building for Android
Ensure that you have installed android-ndk properly. Then run:
ndk-build
Building for Linux
setools-android can be built for *nix platform as stand-alone binaries without external dependencies. This build simplifies analysis of Android's sepolicy after dumping it from a device.
autoreconf -i
./configure
make
sudo cp ./seinfo ./sesearch ./sepolicy-inject /usr/local/bin # optional
Usage
sepolicy-inject -s <source type> -t <target type> -c <class> -p <perm>[,<perm2>,<perm3>,...] [-P <policy file>] [-o <output file>] [-l|--load]
sepolicy-inject -Z type_to_make_permissive [-P <policy file>] [-o <output file>] [-l|--load]
sepolicy-inject -z type_to_make_nonpermissive [-P <policy file>] [-o <output file>] [-l|--load]
For example if you want to allow vdc to write to pseudo-terminal (so you can see replies from vdc command):
sepolicy-inject -s vdc -t devpts -c chr_file -p read,write -l
Third-party code
This repository contains other opensource code:
- regex (from OpenBSD)
- bzip2
- libsepol
Based on pasis/setools-android by Dmitry Podgorny (pasis) and xmikos/setools-android by Michal Krenek (Mikos)