SELinux (Security-Enhanced Linux) is a mandatory security component in modern versions Androidthat controls application access to system resources. However, many users are faced with a situation where SELinux is disabled after rooting, custom firmware or update failure. Turning it back on is not a trivial task, especially on devices with a locked bootloader or non-standard kernels.

In this article you will find step-by-step guide for different scenarios: from checking the current status to forced activation via ADB or TWRP. We will also look at why it may not turn on, how to fix the error, and what to do if the system goes into a bootlap after changing the mode. The material is relevant for SELinux may not turn on, how to fix the error avc: denied, and what to do if the system goes into bootlap after changing the mode. The material is relevant for Android 10–14 on devices Samsung, Xiaomi, Google Pixel, OnePlus and other popular brands.

We warn you right away: manipulations with SELinux require superuser rights (root) and can lead to data loss or device inoperability. If you are not sure of your actions, it is better to contact a specialist.

1. What is SELinux and why enable it?

SELinux (Security-Enhanced Linux) is a forced access control mechanism (Mandatory Access Control, MAC), integrated into the kernel Android starting with version 4.3 Jelly Bean. Unlike traditional permissions (Discretionary Access Control, DAC), where the application itself decides which files to read, SELinux strictly limits access at the kernel level, even for the rootuser.

The main reasons why you should enable SELinux:

  • 🛡️ Protection against malware: even if there is a virus received root access, he will not be able to modify critical system files.
  • 🔒 Application control: restricting access to personal data (contacts, SMS, geolocation) at the kernel level.
  • 📱 Compatibility with banking applications: many financial services (for example, Sberbank Online, Tinkoff) require active SELinux in mode enforcing.
  • 🔄 System stability: preventing accidental failures due to incorrect rights access.

However, there is a downside: some custom firmware (LineageOS, Pixel Experience) or modules Magisk may conflict with SELinux, causing errors in the logs (avc: denied). In such cases, you need manual configuration of policies.

📊 What is your experience with SELinux on Android?
I have never configured
I tried to enable it, but there were errors
I use it in permissive
Works in enforcing without problems

2. How to check the current status of SELinux

Before enabling SELinux, you need to find out its current state. There are several methods for this:

Method 1: Via ADB (without root)

Connect the device to the PC and run the command:

adb shell getenforce

Possible answers:

  • Enforcing — SELinux active and applies all rules.
  • Permissive — SELinux enabled, but does not block actions (only logs violations).
  • Disabled — SELinux completely disabled.

Method 2: through the app (with root)

Install from Google Play utility SELinux Checker or SELinux Mode Changer. They will show:

  • 📊 Current mode (enforcing/permissive).
  • 🔧 Policy status (loaded/failed).
  • 📝 Violation logs (avc: denied).
💡

If the command getenforce returns an error permission denied, it means the device does not have root access or is disabled adb root. Try first adb root, then repeat the request.

Method 3: View logs

To analyze errors SELinux use:

adb shell dmesg | grep -i selinux

adb shell logcat | grep -i avc

If there are a lot of entries like avc: denied { read } for pid=1234 ...in the logs, this means that SELinux blocks the actions of applications or services.

💡

Mode permissive useful for debugging, but does not provide protection. For complete security you need enforcing.

3. How to enable SELinux via ADB (without TWRP)

If SELinux is disabled (Disabled), you can try to activate it via ADBto custom recovery. This method works on most devices with unlocked bootloader and root access.

Step 1: Preparation

  • 🔌 Connect device to PC via USB (turn on USB debugging in Settings → For developers).
  • 🖥️ Install ADB Tools (download from official Android website).
  • 🔑 Get root access (via Magisk or su).

Step 2: Enabling SELinux

Run the commands in order:

adb shell

su


setenforce 1 # temporarily switches to enforcing (until reboot)


echo 1 > /sys/fs/selinux/enforce # alternative method

For changes to be saved after a reboot, you need to edit the file /data/property/persist.sys.selinux:

echo "persist.sys.selinux=1" >> /data/property/persist.sys.selinux

chmod 644 /data/property/persist.sys.selinux

Make sure what getenforce returns Enforcing

Reboot the device and repeat the check

Check the logs for errors (logcat | grep avc)

Install a monitoring application (for example, SELinux Checker)

-->

Step 3: Correction errors

If after switching on SELinux the system is unstable:

  • 🔄 Return to permissive command setenforce 0.
  • 📋 View the logs (logcat) and find records avc: denied.
  • 🛠️ Correct the policies using Audit2Allow (instructions in the next section).
What to do if setenforce 1 does not work?

If the command returns an error Operation not permitted, which means the kernel was built without support SELinux or incompatible firmware is used. In this case, only flashing the device with the correct kernel will help.

4. Enabling SELinux via TWRP (for custom firmware)

If SELinux is disabled at the kernel level (for example, after installing unofficial firmware), it can be activated via TWRPThis method is suitable for devices with unlocked. loader installed custom recovery.

Step 1: Downloading the necessary files

You will need:

  • 📄 File sepolicy for your version Android (can be extracted from the official firmware).
  • 🔧 SELinux Switcher (module for Magisk).

Step 2: Firmware via TWRP

  1. Boot into TWRP (hold Power + Volume Up when turning on).
  2. Go to Mount and activate System.
  3. Copy the file sepolicy to /system/etc/selinux/.
  4. Set permissions 644 for the file:
    5. chmod 644 /system/etc/selinux/sepolicy
  5. Flash the module SELinux Switcher via Install in TWRP.

Step 3: Setting up after flashing

After reboot:

  1. Open Terminal Emulator and do:
    2. su

    restorecon -R /system

  2. Check the status:
    3. getenforce
  3. If the status is Permissive, transfer to Enforcing:
    4. setenforce 1
💡

If the device does not boot after flashing the firmware, try flashing the original kernel (stock kernel) from the official firmware. Often the problem lies in the incompatibility of the custom kernel with SELinux.

5. Correcting "avc: denied" errors using Audit2Allow

If SELinux works in Enforcingmode, but errors appear in the logs avc: denied, this means that some applications or services violate security policies. To fix it, use a utility Audit2Allowthat generates rules based on logs.

Step 1: Installing Audit2Allow

On the device with root execute:

su

apt install auditd # for Termux


or


pkg install auditd

Step 2: Collecting logs

Run violation monitoring:

adb shell

su


logcat -b all | grep avc > /sdcard/avc_logs.txt

Repeat the actions that cause errors (for example, launching the problematic application).

Step 3: Generation rules

Download avc_logs.txt to a PC and process using Audit2Allow:

audit2allow -i avc_logs.txt -m mypolicy > mypolicy.te

checkmodule -M -m -o mypolicy.mod mypolicy.te


semodule_package -o mypolicy.pp -m mypolicy.mod


semodule -i mypolicy.pp

Step 4: Applying rules on the device

Copy the generated file mypolicy.pp to the device and download:

adb push mypolicy.pp /sdcard/

adb shell


su


semodule -i /sdcard/mypolicy.pp

What to do if semodule does not work?

Some firmware (for example MIUI) do not support dynamic loading of policies. In this case, you will have to edit sepolicy manually or look for ready-made patches for your model.

6. Frequent problems and their solutions

When working with SELinux users encounter typical errors. Let's look at the most common ones and how to fix them.

Problem Possible cause Solution
setenforce: Could not set enforce: Permission denied No root access or the kernel was built without support SELinux. Check su, flash the kernel with support SELinux.
The device goes into bootlap after turning on Enforcing. Policy conflict with custom firmware or modules Magisk. Boot into TWRP, remove problematic modules, return to Permissive.
Applications do not work in Enforcing. Policies mode SELinux block access to resources. Use Audit2Allow for generating exceptions.
avc: denied { bind } for pid=1234 ... The application is trying to bind to a prohibited port. Add a rule to allow bind on a specific port.
💡

If after enabling SELinux banking applications stop working, try add them to the white list via MagiskHide or SafetyNet Fix.

7. SELinux and SafetyNet: how to pass certification

Many applications (for example, Google Pay, Netflix, Pokémon GO) require successful verification SafetyNet. If SELinux works in Permissivemode, the test may fail with an error. CTS Profile Mismatch.

How to check SafetyNet

Install the application SafetyNet Test or run the command:

adb shell su -c "snet check"

Fixing methods

  • 🔄 Translate SELinux to Enforcing (see section 3).
  • 🛡️ Install the module MagiskHide Props Config and activate hiding root.
  • 📱 Flash the official kernel (if using a custom one).
  • 🔑 Use Universal SafetyNet Fix (module for Magisk).
💡

Even if SELinux in mode Enforcing, SafetyNet may not work due to other modifications (for example, an unlocked bootloader). In this case, only a complete return to the stock firmware will help.

8. Alternative methods: kernel and custom firmware

If standard methods do not help, there are two radical options:

  1. 🔧 Kernel firmware with SELinux support: download the official or custom kernel (for example, FrancoKernel, ElementalX) marked SELinux Enforcing.
  2. 📱 Installing stock firmware: some custom firmware (for example, Havoc-OS, CrDroid) may conflict c SELinux. In this case, only returning to the original firmware will help.

To flash the kernel via TWRP:

  1. Download the file .img with the kernel (for example, boot.img).
  2. Boot into TWRP and select Install → Install Image.
  3. Specify the path to boot.img and flash to the section Boot.
  4. Reboot the device.
Where to download kernels with SELinux support?

Official kernels can be extracted from the firmware on the manufacturers' websites:

- Samsung: samfw.com

- Xiaomi: xiaomifirmwareupdater.com

- Google Pixel: developers.google.com

Search for custom kernels on the forums XDA Developers or 4PDA (make sure they are compatible with your model!).

FAQ: Frequently asked questions about SELinux on Android

❓ Is it possible to enable SELinux without root?

No, to change the status SELinux (setenforce) or edit files in /system required root access. Without them, you can only check the current status with the command getenforce (on some devices).

❓ Why does Wi-Fi or the mobile network stop working after turning on SELinux?

This is a typical problem when policies SELinux block access to network interfaces. Solution:

  1. Return to Permissive (setenforce 0).
  2. View the logs (logcat | grep avc) and find entries related to wifi or netd.
  3. Generate a rule using Audit2Allow (see section 5).
❓ How to roll back changes if the device does not boot after enabling SELinux?

If the device goes into bootloop:

  1. Boot in TWRP.
  2. Delete files /data/property/persist.sys.selinux and /system/etc/selinux/sepolicy (if you changed them).
  3. Flash the original boot.img.
  4. Reset Dalvik/ART Cache in TWRP.

If this does not help, you will have to flash the full stock firmware via Odin (for Samsung) or Fastboot.

❓ Does SELinux work on devices with MediaTek?

Yes, SELinux is supported on chipsets MediaTek, but there are nuances:

  • On some budget models (Redmi, Realme), the core can be assembled without full support SELinux.
  • For MTK often required manual editing sepolicy, since standard tools (Audit2Allow) may not work.
  • Before experiments, check whether there are custom firmware for your model with corrected SELinux (for example, on 4PDA).
❓ Is it possible to permanently disable SELinux?

Technically yes, but is highly not recommended.. Disabling SELinux:

  • 🚫 It deprives the device of basic protection against malware.
  • 💳 Blocks banking applications and Google Pay.
  • 🔄 May lead to unstable system operation (random reboots, application errors).

If you need to disable SELinux temporarily (for example, for debugging), use:

setenforce 0

But remember: this opens critical security vulnerabilities!