To change SELinux in build time

...
project-celadon: default
sepolicy: permissive
graphics: project-celadon(gen9+=true,hwc2=true,vulkan=false,drmhwc=false,minigbm
...

To change SELinux mode at runtime

$ adb shell
celadon:/ $ getenforce
Permissive

$ adb shell
celadon:/ $ su
celadon:/ # setenforce 0
celadon:/ # getenforce
Permissive

celadon:/ # setenforce 1
celadon:/ # getenforce
Enforcing

Add the initial sepolicy rules

1. Create a sub-folder ‘rfkill‘ under the device/intel/project-celadon/sepolicy directory to host the sepolicy rules files.

2. Introduce the previous folder to the sepolicy compiler by adding the following line to the board configuration overlay file ‘device/intel/mixins/groups/rfkill/true/BoardConfig.mk‘.

   BOARD_SEPOLICY_DIRS += $(INTEL_PATH_SEPOLICY)/rfkill
   

3. Inside the sepolicy rules folder, create an initial file named ‘file_contexts‘ with the following content. This assigns a file label for the rfkill executable file:

   /vendor/bin/rfkill-init.sh      u:object_r:rfkill_exec:s0
   

4. Create a SELinux type enforcement file ‘rfkill.te‘ fo define the policy type and access control for the rfkill module:

   # Define a domain that the rfkill process runs in
   type rfkill, domain;
   # Define a file type for the rfkill executable file and assign this file type
   type rfkill_exec, exec_type, file_type, vendor_file_type;
   # Grant the permission to init process so that the init process starts the rfkill service
   # from init.rc and transition to rfkill domain
   init_daemon_domain(rfkill)
   

Add the additional sepolicy rules

5. You seldom add only initial sepolicy rules to make a module work properly. Reboot the device and search any AVC errors related to the rfkill module in the system dmesg or logcat output. AVC errors are associated with avc: or permissive= keywords as shown in the following example:

   

6. In the previous output, the key ‘scontext‘ indicates which module generates the AVC error and the cause. You then write sepolicy rules to the ‘.te‘ file associated with that module, according to the relevant AVC error as shown in the previous example.