Modify the script to preserve selinux context about disable_dm-verity_forceencrypt

[Zackptg5]

Nope, no toybox needed. Toybox is included in all roms that it would be required in (oreo+) so we should be good to go. I'll drop the next test build on xda (same as the last one I posted here). Thanks a ton for all of the help and troubleshooting!

[Zackptg5]

Gotcha. Osm0sis is looking into it :)

[fawazahmed0]

@Zackptg5 This one works perfect. 👍

[Zackptg5]

Awesome, thanks for the testing!

[chankruze]

Good discussion !

[Zackptg5]

@fawazahmed0 Osm0sis pushed a complete rewrite of mounting and looks solid so I'm hoping this will do the trick regardless of how system_root is implemented in twrp. Can you give this one a go?
Disable_Dm-Verity_ForceEncrypt_08.18.2019.zip

[Zackptg5]

Hmm, context shouldn't have been changed but I'll look into it, thanks. Did you use stable or latest test build? https://forum.xda-developers.com/showpost.php?p=79919222&postcount=500

[fawazahmed0]

@Zackptg5 I have used this Disable_Dm-Verity_ForceEncrypt_05.21.2019.zip, I assume this is stable version

[fawazahmed0]

I see sed command is being used in the script to replace the strings, I have tested in my linux vm, sed does not preserve selinux context

[fawazahmed0]

I would use something like this to fetch selinux of a file and store in some variable
somevar=ls -Z filename | awk '{print $1}'
Later after doing the sed editing,
I will use something like this to set the selinux context back:
chcon $somevar filename

[fawazahmed0]

Test build https://forum.xda-developers.com/showpost.php?p=79919222&postcount=500 , does not work, it does not patch the fstab
Disabledmveritytestbuild.log

[Zackptg5]

That's a great idea! I'll use that for chcon of all of the fstabs
In your log, it looks like system didn't mount properly and that busted mounting of nvdata.

Can you try this test build? I don't expect the outcome to be any different but it should tell me what the actual error is with system mounting
Disable_Dm-Verity_ForceEncrypt_07.24.2019.zip

[fawazahmed0]

Here is the recovery log for stable build zip
disableveritystablebuild.log

Everything works perfectly in this except the selinux context gets changed, anyways I can manually edit it from twrp adb shell.
Just one more thing, after flash your stable build, it shows these lines in twrp adb shell:
WARNING: linker: Warning: couldn't read "/system/etc/ld.config.txt" for "/sbin/t
oybox" (using default configuration instead): error reading file "/system/etc/ld
.config.txt": Too many symbolic links encountered

Any time I enter any command in twrp adb shell, I get these lines, I am not sure what these lines means. Anyways thanks for your script

[fawazahmed0]

That's a great idea! I'll use that for chcon of all of the fstabs
In your log, it looks like system didn't mount properly and that busted mounting of nvdata.

Can you try this test build? I don't expect the outcome to be any different but it should tell me what the actual error is with system mounting
Disable_Dm-Verity_ForceEncrypt_07.24.2019.zip

Testing now,wait

[fawazahmed0]

@Zackptg5
07.24.2019testbuild.log
Here is the log for 07.24.2019 test build

[Zackptg5]

Hmm okay. I think I see the problem so hopefully this'll fix it. Try this zip and send me the log too (it has your file context fix in it btw)
Disable_Dm-Verity_ForceEncrypt_07.24.2019.zip

[fawazahmed0]

Hmm okay. I think I see the problem so hopefully this'll fix it. Try this zip and send me the log too (it has your file context fix in it btw)
Disable_Dm-Verity_ForceEncrypt_07.24.2019.zip

07.24.2019v2testbuild.log
This one works like stable build now, but the selinux context of fstab still got changed to u:object_r:unlabeled:s0, so network was not working

[fawazahmed0]

ok I see the problem in your script
it should be some thing like:
PERM="$(ls -Z $i | awk '{print $1}')"
and not
PERM="$(ls -z $i | awk '{print $1}')"

Z should be uppercase

wait I will test and see, if that works

[fawazahmed0]

ok, the problem is in busybox ls, which is stripped down version of ls, it does not support -Z (selinux) flag

[fawazahmed0]

@Zackptg5 This one works perfectly:
PERM="$(/sbin/ls -Z $i | awk '{print $1}')"

Kindly update the script :)

[fawazahmed0]

@Zackptg5 one more thing, awk '{print $1}' works only in my phone, other phones might have selinux context in other fields like awk '{print $3}' , you might have to use pattern matching or something else.
selinux context follows this pattern: :*:*:

[Zackptg5]

Thanks for the tip, I have to be specific with it though because TWRP includes different binaries on different devices. It looks like toybox ls has it and is probably what you have in your TWRP. Lots of older ones have busybox instead so I'll need to include it in the zip then.
What else would be outputted other than the security context and filename for toybox ls? It should be all that's outputted for toybox

[Zackptg5]

Okay, got toybox bundled in for it's ls applet so give this a try

Disable_Dm-Verity_ForceEncrypt_07.24.2019.zip

[fawazahmed0]

Okay, got toybox bundled in for it's ls applet so give this a try

Disable_Dm-Verity_ForceEncrypt_07.24.2019.zip

@Zackptg5
Great idea to use toybox, now ls output will be consistent across all the devices.
Coming to your new zip, log message showing many errors in it, I guess maybe just a syntax error in your script.It got stopped in middle with error 1
Also the selinux thing does not work in your new zip. selinux got changed to ? for fstab

07-24-19v3.txt

[fawazahmed0]

ok, the problem is in your compiled toybox, it prints ? instead of printing selinux context, don't know why that's happening, toybox in my twrp sbin print's selinux context properly

[Zackptg5]

Looks like syntax error and some more mounting problems :/
I grabbed those binaries from the official site too - I'll test them out more and figure something out

[fawazahmed0]

@Zackptg5 ok I have used your previous zip (as it gives no syntax error) and added twrp compiled toybox in the zip (copied from /sbin) and now everything works perfectly fine , i.e selinux context is preserved etc.

[Zackptg5]

Can you try this one (replace toybox with yours for now) and see if it all works as intended? Think I got the mounting stuff fixed here (and stupid syntax error)

Disable_Dm-Verity_ForceEncrypt_07.25.2019.zip

[fawazahmed0]

Can you try this one (replace toybox with yours for now) and see if it all works as intended? Think I got the mounting stuff fixed here (and stupid syntax error)

Disable_Dm-Verity_ForceEncrypt_07.25.2019.zip

yeah works perfectly fine, provided I copy my twrp toybox in it, maybe it will be better to compile toybox from android source

[fawazahmed0]

ok, wait, I will get the toybox for you

[fawazahmed0]

I tried fetching the toybox from arm gsi, but it does not work, I guess it depends on dynamic libraries to work

[Zackptg5]

Guess that makes sense. I looked into a different avenue and restorecon may do what we want. Give this a go and see if it works - no toybox required
Disable_Dm-Verity_ForceEncrypt_07.25.2019.zip

[Zackptg5]

Scratch that last one, restorecon didn't work initially and I then found that it was a part of toybox.
Then had the 'duh' moment - toybox is in /system/bin on every marshmallow and newer rom so I can just use it so this one may finally fit the bill.
Disable_Dm-Verity_ForceEncrypt_07.25.2019.zip

[fawazahmed0]

Scratch that last one, restorecon didn't work initially and I then found that it was a part of toybox.
Then had the 'duh' moment - toybox is in /system/bin on every marshmallow and newer rom so I can just use it so this one may finally fit the bill.
Disable_Dm-Verity_ForceEncrypt_07.25.2019.zip

@Zackptg5 I think that might not work, because binaries in /system/bin depends on dynamic libraries.
Before flashing the script, I tried mount the system and then tried executing '/system/bin/toybox ls -Z' using twrp adb shell and it didn't worked. Someone has to compile the toybox, I have complete Omni source at my vm, I would have done it, but I have many bad sectors in my harddisk, starting vm causes blue screen problem.

[fawazahmed0]

If I solve my blue screen problem, then I will compile the arm version

[Zackptg5]

It worked for me when I tested it, did you try it? Since system and vendor are mounted all of the dependencies should be there I would think.

I'd need arm and x86 builds if you're able to build

[fawazahmed0]

It worked for me when I tested it, did you try it? Since system and vendor are mounted all of the dependencies should be there I would think.

I'd need arm and x86 builds if you're able to build

Sorry, I thought it will not work , so didn't test it, because restoring things back to stock is a pain in this device as the twrp restore doesn't work and I have to use fastboot to restore.

Yeah, I just tested it now, it works perfectly. Do you still need toybox builds? I will do that when the pc gets working again. please confirm

[Zackptg5]

@fawazahmed0 osm0sis (developer of ak3) reworked some of the system_root mounting stuff and wanted to know if it works now so could you test this out when you get the chance? Thanks
Disable_Dm-Verity_ForceEncrypt_08.11.2019.zip

[fawazahmed0]

@Zackptg5 You asked at the right time.
I flashed the zip, and It did not work. Here is log

dmverity_08_11_2019.txt

I tried dmvertiy_08.02.2019.zip yesterday and that one worked for me.

[fawazahmed0]

@Zackptg5
It's trying to mount system from wrong location
It shouldn't be :
/dev/block/bootdevice/by-name/system

It should mount from:
/dev/block/by-name/system
or
/dev/block/platform/bootdevice/by-name/system

[Zackptg5]

/dev/block/bootdevice should symlink to proper path. Can you post recovery log after flashing this so I could forward it to osm0sis? Thanks

[fawazahmed0]

@Zackptg5 You asked at the right time.
I flashed the zip, and It did not work. Here is log

dmverity_08_11_2019.txt

I tried dmvertiy_08.02.2019.zip yesterday and that one worked for me.

@Zackptg5 Here is the log

[Zackptg5]

Thanks, I'll forward it on to him

[Zackptg5]

@fawazahmed0
Talked to osm0sis and I think he got a better solution worked out. How's this one work (log as before)
Disable_Dm-Verity_ForceEncrypt_08.11.2019.zip
Thanks!

[fawazahmed0]

@Zackptg5
This one worked, Here is the log:
dm_verity_v2_08_11_2019.txt

[fawazahmed0]

@Zackptg5 @osm0sis Today I flashed a new twrp build , with these new changes:
fawazahmed0/android_device_Realme3_RMX1821@b4aceb0

I then tried the dmverity.zip and it did not work, I guess the problem is in how the twrp mounts the partitions.

Previouly, my twrp mounted system partition at /system (wrong way to mount for system as root devices, but still many SAR devices uses this in their twrp fstab)
The zip works perfectly well in the above setup. Here is the log
dmverity_08_11_19_v2_no_systemroot.txt

In my newly build twrp, the system partition is mounted at /system_root (right way to mount for SAR devices, I can now execute /system/bin binaries through twrp shell, as everything is mounted properly)
The zip didn't work in the above setup. Here is the log:
dm_verity_08_11_19_v2_with_systemrootmount.txt

[osm0sis]

Your device TWRP maintainer needs to fix it so you have the correct links in /dev/block for a SAR device. Yours has /dev/block/platform/bootdevice for some reason where the correct symlink is /dev/block/bootdevice and always has been.

Your ongoing issues boil down to "broken TWRP is broken" so that's where the burden of resolving them should go.

Edit: Also I think you need to revert the fstab change in the commit you linked.

[fawazahmed0]

@osm0sis Thanks for pointing that, I have solved the bootdevice mount thing for now:
fawazahmed0/android_device_Realme3_RMX1821@1dd4bef

Coming to fstab change, I guess that is the right way to mount in SAR devices, for example see here:
TeamWin/android_device_realme_RMX1851@0d20a81

TeamWin/android_device_xiaomi_violet@581fb3d

TeamWin/android_device_xiaomi_perseus@8d2e63b

I will ask about this in slack, let's see what they reply

[Zackptg5]

Looks like the path is figured out :)
This this will be next release if it works for you:
Disable_Dm-Verity_ForceEncrypt_08.13.2019.zip

[fawazahmed0]

@Zackptg5 Doesn't seem to work
Here is the log:
dm_verity_08_13_2019.txt

[fawazahmed0]

@osm0sis @Zackptg5 I am not sure, how AK script works, but I was trying to understand how opengapps works in /system and /system_root mount without throwing any error.
This is what I got:

if [ -n "$(cat /proc/cmdline | grep slot_suffix)" ];
then
device_abpartition=true
SYSTEM_MOUNT=/system
SYSTEM=$SYSTEM_MOUNT/system
VENDOR=/vendor/vendor
elif [ -n "$(cat /etc/fstab | grep /system_root)" ];
then
device_abpartition=false
SYSTEM_MOUNT=/system_root
SYSTEM=$SYSTEM_MOUNT/system
VENDOR=/vendor
else
device_abpartition=false
SYSTEM_MOUNT=/system
SYSTEM=$SYSTEM_MOUNT
VENDOR=/vendor
fi

[Zackptg5]

Log is saying that system wasn't found in the fstab. Can you try this one and post log? I added some debug lines to it
Disable_Dm-Verity_ForceEncrypt_08.13.2019.zip

[fawazahmed0]

@Zackptg5 Here is the log: dmverity_08_13_19_v2.txt

[Zackptg5]

Looks like it's an issue with your twrp. /system isn't present in the fstab so it isn't getting mounted. Magisk installer and other zips will likely fail too

[fawazahmed0]

@Zackptg5 nope, magisk is working, tested it today

[Zackptg5]

Hmm, it uses a similar method. Here's the error:
/tmp/anykernel/tools/busybox mount -o rw -t auto /system mount: can't find /system in /etc/fstab

That command should work in twrp

[fawazahmed0]

Give me that magisk zip, with debugging enabled , I will post the log here

[Zackptg5]

Magisk-v19.3debugmount.zip

[fawazahmed0]

Magisklog.txt

[Zackptg5]

Looks like magisk does it differently. I'm not exactly sure what normal twrp setup is but it looks like you did remove system from the fstab here: https://github.com/fawazahmed0/android_device_realme_spartan/commit/99b158ac9edde8273ed69c58874210ab092b181e

@osm0sis Should both system and system_root be present in it?

[fawazahmed0]

@Zackptg5 see here: <Removed so noobs won't find it>