To change SELinux in build time

For CiV scenario:

...
project-celadon: default
sepolicy: permissive
graphics: project-celadon(gen9+=true,hwc2=true,vulkan=false,drmhwc=false,minigbm
...

For CiC scenario:

...
GRUB_CMDLINE_LINUX_DEFAULT="androidboot.selinux=permissive"
...

$ sudo update-grub && reboot

To change SELinux mode at runtime

$ adb shell
celadon:/ $ getenforce
Permissive

$ adb shell
celadon:/ $ su
celadon:/ # setenforce 0
celadon:/ # getenforce
Permissive

celadon:/ # setenforce 1
celadon:/ # getenforce
Enforcing

Add the initial sepolicy rules

1. For CiV scenario, create a sub-folder rfkill under the device/intel/project-celadon/sepolicy/ directory to host the sepolicy rules files. For CiC scenario, the rfkill folder should be created in device/intel/cic/common/sepolicy directory.

2. Introduce the previous folder to the sepolicy compiler by adding the following line to the board configuration overlay file. For CiV scenario, edit the file device/intel/mixins/groups/rfkill/true/BoardConfig.mk:

   BOARD_SEPOLICY_DIRS += $(INTEL_PATH_SEPOLICY)/rfkill
   

   Or, for CiC scenario, edit the file device/intel/cic/common/BoardConfig.mk:

   BOARD_SEPOLICY_DIRS += device/intel/cic/common/sepolicy/rfkill
   

3. Inside the sepolicy rules folder, create an initial file named ‘file_contexts’ with the following content. This assigns a file label for the rfkill executable file:

   /vendor/bin/rfkill-init.sh      u:object_r:rfkill_exec:s0
   

4. Create a SELinux type enforcement file rfkill.te to define the policy type and access control for the rfkill module:

   # Define a domain that the rfkill process runs in
   type rfkill, domain;
   # Define a file type for the rfkill executable file and assign this file type
   type rfkill_exec, exec_type, file_type, vendor_file_type;
   # Grant the permission to init process so that the init process starts the rfkill service
   # from init.rc and transition to rfkill domain
   init_daemon_domain(rfkill)
   

Add the additional sepolicy rules

5. You seldom add only initial sepolicy rules to make a module work properly. Reboot the device and search any AVC errors related to the rfkill module in the system dmesg or logcat output. AVC errors are associated with avc: or permissive= keywords as shown in the following example:

   

6. In the previous output, the key ‘scontext’ indicates which module generates the AVC error and the cause. You then write sepolicy rules to the ‘.te’ file associated with that module, according to the relevant AVC error as shown in the previous example.