What is the meaning of "avc: denied { read } for name..." line in logcat?

Question

I am wondering about avc: denied messages in my logcat.

W/RenderThread: type=1400 audit(0.0:631436): avc: denied { read } for name="perf_ioctl" dev="proc" ino=4026533695 scontext=u:r:untrusted_app_25:s0:c512,c768 tcontext=u:object_r:proc:s0 tclass=file permissive=0

What is the meaning of this?

Solution

It's depends of SELinux restrictions. You cannot do so much to avpoid it.

In easy words: it means that there is "someone" that has tried to "{read}" something but SELinux stops it because that App wasn't found in the "trusted" list of SELinux. Usually some specific and dangerous locations of the System are restricted from installed Apps, so SELinux stops to read/wrote/execute things in/from that locations.

(1) An Enforcing SELinux writes that Log AND denied the access. (2) A Permissive SELinux writes that Log BUT allow the access. (3) A Disabled SELinux do NOT writes the log AND allow the access.

To avoid it you should rebuild the ROM after changed specific files about SELinux where you have to add your App in the "trusted zone".

You can install a different Kernel with a different SELinux settings.

Comments

[Yvain]

the is an apk on xda named selinux switcher forum.xda-developers.com/t/… it lets you managed it from android; other wise there is a command native to phones that you can run in terminal but I don't remember the path and name; and it might not ship with all vendors. In both cases you need a rooted device..