在system/core/init/selinux.cpp中
oid SelinuxInitialize() {
LOG(INFO) << "Loading SELinux policy";
if (!LoadPolicy()) {
LOG(FATAL) << "Unable to load SELinux policy";
}
bool kernel_enforcing = (security_getenforce() == 1);
bool is_enforcing = IsEnforcing();
if (kernel_enforcing != is_enforcing) { 判断条件1
if (security_setenforce(is_enforcing)) { 判断条件2
PLOG(FATAL) << "security_setenforce(" << (is_enforcing ? "true" : "false")
<< ") failed";
}
}
if (auto result = WriteFile("/sys/fs/selinux/checkreqprot", "0"); !result.ok()) {
LOG(FATAL) << "Unable to write to /sys/fs/selinux/checkreqprot: " << result.error();
}
}
上面两条件判断
可以通过直接返回false方式关闭
bool IsEnforcing() {
// if (ALLOW_PERMISSIVE_SELINUX) {
// return StatusFromCmdline() == SELINUX_ENFORCING;
// }
// return true;
return false;
}
最后重新编译boot.img,烧入固件这样重新启。启动完成后调用getenforce命令可以看到已经特地关闭SELinux了