This guide will show you how to Change your Android SELinux mode to permissive on an Android phone, helping you better run various apps to their fullest.
We are not responsible for any damages that occur through following this article. at the time of writing the steps worked fine for the test android phone we were using and we were able to change selinux successfully using a custom kernel.
As we have mentioned throughout this article custom kernels are not available for all versions of every Android phone ever made. however popular phones should be covered. Always take care and backup the device at all stages and correctly choose the kernel for the android model number of the phone you are working with.
Changing SELinux from enforced to permissive will Not Work on Samsung Android Phones with Samsung Knox enabled and it may also not work for other Android phones from other manufacturers depending on the Sndroid os version installed.
What is SELinux?
SELinux or ‘Security Enhanced Linux’ is an Android OS module that is designed to identify and address critical security gaps in the Android operating system. It is used to protect the Android operating software from malicious code or software being installed and causing damage to the phone.
Unfortunately those same ‘security gaps’ associated with malicious software also allow many apps at their root features to function properly. With SELinux in Permissive mode the security gaps in the Android operating system are not fixed and so the programs can use those to run properly.
With SELinux set to Enforced mode the security gaps are fixed, therefor the software cannot run all of its root features properly which results in Limited mode and reduced functionality.
How does SELinux affect applications?
When Samsung released Android OS 4.3 they changed the SELinux option from Permissive, which is what a lot of applications need, to Enforced which means that while most applications will work certain features will not.
For example, when you install FlexiSPY on a rooted phone, as part of the installation process, while it checks for root permissions within SuperSU (after you grant access) it also checks the SELinux status to see if it is set to Enforced – if it is then it will try to force the permission status to permissive.
If it is successful then the software runs in root mode with full access, whereas if it’s unsuccessful, then it will run in root mode with limited access.
How To Check Your SELinux Settings
On the phone, go to Settings > More > About Device and then scroll down to the bottom where you’ll see SE for Android Status
Easily Change Your Android SELinux Mode To Permissive
There is a program on the Play Store (link below) that can change the SELinux mode of non-Samsung Android phones and Samsung Android phones running OS 4.4.2 and below but anything above that and the software will not work – we mention about issues with OS 4.3 and above
All you need to do is download the application on to the Android phone, run it and tap the Permissive button but, if the Android phone is a Samsung Android phone with OS 4.3 or above installed which also has Knox running then it will no longer work.
- Download and install SELinux Mode Changer from the Play Store onto your phone.
- Run the application and set SELinux to Permissive
- Restart the phone
- Check the SELinux status in the About Device menu to see if it has changed.Note: This process will not only downgrade the OS version but it will also DELETE ALL DATA ON THE PHONE.
Didn’t work? | Install a Custom Kernel
One way to get around SELinux being set to Enforced is change the kernel to one which has been edited so that SELinux has been set to Permissive which should theoretically allow your apps, or FlexiSPY to run in Full mode.
These kernels though may not exist or may be hard to find for every Android phone.
Any Android phone, not just Samsung, whose SELinux status is set to Permissive can run FlexiSPY in FULL MODE.
First of all you need to find out if the Android phone you have has SELinux set to permissive or not which we have explained earlier.
SELinux cannot always be changed so easily depending on the make and mode of the Android phone.
And this is why we have to install a custom kernel if the SELinux Mode Changer application fails to fix the problem.
Please note that custom kernels with selinux set to permissive are not available for all android phones – regardless of whether they are made by samsung or not.
Where can you download a custom kernel?
The Android OS kernel is the most important part of the Android OS. It allows the phone software to interface with the hardware and the application that are installed on the phone, basically telling the phone how to run and what settings and configuration it has and then all this information is used for all installed programs on the Android phone.
The best place to look for custom kernels is the forum on XDA Developers.
How can I install a Custom Kernel which has SELinux set to permissive?
For this example we are using a Samsung Galaxy S4 so we go to XDA forums to get started.
The first thing to do is type in your Android phone model.
Make sure you choose the correct one from the list as many of the same Android phones have country variants with different model numbers.
You can find the model number to search for on the Android phone by going to the About Device (can also be called About Phone) menu and it will be listed.
For example the model number of our Samsung Galaxy S4 is GT-I9505 so that is what we need for our custom kernel.
Once you have entered the model number to search for you will get the main page for that Android phone.
We need a custom kernel so we click the Kernels tab.
You now need to simply browse through all the custom kernels until you have found one that says it has SELinux set to permissive.
For our version of the Samsung Galaxy S4 we found one pretty easily.
As you can see it matches the model number of our Samsung Galaxy S4 and has SELinux set to permissive and runs on Android OS 4.3.
Note: never install a custom kernel on to a phone whose model number does not match. doing so can make the phone inoperable.
Custom Kernel Installation Guide
The first thing to do is to backup the phone completely. This is vitally important. We explain how to backup an Android phone completely in this article.
Once you have backed up the phone completely download the ROM file from here.
Once you have downloaded the kernel file to your PC you need to install Clockworkmod recovery on to your Android phone. If you have already rooted the Android phone then you already have Clockworkmod installed – you can learn more about rooting and how to root popular Android phones here.
Now that you have backed up the Android phone and rooted it to install Clockworkmod recovery it is time to install the customized kernel.
First you need to connect the Android phone to your PC.
Once it is connected it will appear as a device. Simply copy the kernel zip file to the Downloads folder of the phone, once you have done that we can boot in to ClockworkMod recovery and flash the kernel.
- Make sure the Android phone is turned off completely.
- Hold down the Volume Up, Home button and power together until the model number appears.
- Let go of the key combination and Clockworkmod recovery should load.
- From the list of options choose Install zip from Sdcard
- Browse to the kernel zip file you copied to the phone and select it.
- Install the kernel and wait for it to complete.
- Choose ‘Reboot System Now’ to reboot the phone.
Now that you have flashed the custom kernel and rebooted the phone it is time to check the SELinux status.
Using the above screenshot as an example you would need to check the SELinux status which is highlighted and the Kernel version should also have been updated to reflect the custom kernel that you just installed.
Providing everything was done correctly and SELinux was successfully changed to Permissive you can now install FlexiSPY (or deactivate and uninstall and reinstall to get full mode) and start taking advantage of the great features that FlexiSPY offers on a rooted phone.