Real-Time SELinux Compiler

magiskpolicy CLI Reference Manual

Developer reference for magiskpolicy, the native Magisk utility that compiles, modifies, and injects live SELinux access vectors directly into the running Linux kernel, enabling root daemons to function in Enforcing mode without triggering audit denials.

Live SELinux Policy Patching Explained

Historically, rooting tools required setting SELinux to Permissive mode (disabling all security controls system-wide). magiskpolicy parses Android's compiled binary policy (/sys/fs/selinux/load) in kernel memory, adds targeted allow rules specifically for Magisk and module domains, and reloads the policy dynamically while keeping the system in secure Enforcing mode.

Command Modes & CLI Syntax

magiskpolicy Usage Syntax

# 1. Live In-Memory Injection (Directly affects running kernel): $magiskpolicy --live "<rules>" # 2. Offline Binary Policy Patching (Compile infile -> outfile): $magiskpolicy --load sepolicy_in --save sepolicy_out "<rules>" # 3. Apply built-in Magisk default ruleset: $magiskpolicy --magisk "<additional_rules>"

SEPolicy Rule Syntax Reference

magiskpolicy supports the full standard SELinux statement syntax:

Statement Syntax	Description	Example
`allow src tgt class perm`	Grants access permissions between domains	`allow magisk su_daemon process { fork signal }`
`permissive type`	Sets specific type/domain to permissive mode	`permissive custom_daemon_t`
`type type_name [attr]`	Declares a new SELinux type and optional attributes	`type my_service_t domain`
`attribute attr_name`	Declares a new SELinux attribute	`attribute my_domain_attr`
`typeattribute type attr`	Associates an existing type with an attribute	`typeattribute custom_t domain`