SELinux Policy, AVC Denials & audit2allow in AOSP

How SELinux enforcement works in Android - from policy rules to AVC denials and using audit2allow to debug them

1 min read

SELinux Policy, AVC Denials & audit2allow in AOSP

What is SELinux Policy?

SELinux (Security-Enhanced Linux) enforces Mandatory Access Control (MAC) in Android. Every access between a process and a resource must be explicitly allowed by policy - anything not allowed is denied by default.

A policy rule defines: which process/domain can access, which object/type, and with what permissions.

allow system_server vendor_file:file { read open getattr }; Meaning: the "system_server" domain can read/open files of type "vendor_file".

What is an AVC Denial?

When a process attempts an operation not permitted by SELinux policy, the kernel blocks it and logs an AVC (Access Vector Cache) denial.

avc: denied { read open } scontext=u:r:hal_camera_default:s0 tcontext=u:object_r:vendor_file:s0 tclass=file

Key AVC Log Fields

▸scontext → source domain (the process being denied)
▸tcontext → target object type (what it tried to access)
▸tclass → object class (file, socket, dir, etc.)
▸permissions → the denied operations (read, open, write…)

What is audit2allow?

audit2allow is a helper tool that reads AVC denial logs and suggests SELinux allow rules to fix them.

AVC Logs → audit2allow → Suggested .te rules Example generated rule: allow hal_camera_default vendor_file:file { read open };

Where is audit2allow in Newer AOSP?

In newer Android branches, audit2allow is a Python-based SELinux userspace utility located at:

external/selinux/python/

How to Build audit2allow

Build Steps

source build/envsetup.sh
lunch aosp_x86_64-eng
m audit2allow

# Output binary:
out/host/linux-x86/bin/audit2allow

How to Feed AVC Logs to audit2allow

Step-by-step

# 1. Collect AVC denials from device
adb shell dmesg | grep -i avc > avc.log

# 2. Run audit2allow
out/host/linux-x86/bin/audit2allow -p <sepolicy path in out> -i avc.log

# 3. Review generated rules carefully
#    before adding them to .te policy files

Important Caveat

audit2allow is a debugging aid - not a policy generator. Blindly applying its suggestions can over-permission your system. Always understand why a denial is happening and whether the access is architecturally correct before adding a rule.