SELinux prevents my init.rc exec command to execute I've added a exec command at the end of init.rc file.

on property:dev.bootcomplete=1
    exec u:r:shell:s0 shell shell -- /system/bin/am start -n com.example.package/com.example.package.MainActivity


This exec runs in u:r:shell:s0 SELinux context, from user shell and in group shell. But SELinux still believes in access denial:

[28.918751] init: Starting service 'exec 3 (/system/bin/am)'...
[28.920227] init: cannot execve('/system/bin/am'): Permission denied
[28.920356] type=1400 audit(22128374.236:11): avc: denied { entrypoint } for pid=3887 comm="init" path="/system/bin/am" dev="dm-0" ino=292 scontext=u:r:shell:s0 tcontext=u:object_r:system_file:s0 tclass=file permissive=0
[28.921791] init: Service 'exec 3 (/system/bin/am)' (pid 3887) exited with status 127


That's wonderful when I issue the very same following command in adb shell and it runs successfully, having SELinux enabled.

/system/bin/am start -n com.example.package/com.example.package.MainActivity


This is id of adb shell:

uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats) context=u:r:shell:s0


So, why does my exec command fail even though it has exactly the same identity of adb shell?
I finally managed to solve the problem. There are two problems:


You're not using the "exactly the same identity of adb shell". There are a couple of groups to which adb shell belongs but they're not mentioned in that exec command.
/system/bin/am on its own is not executable, it's a shell script and should be passed to /system/bin/sh to be executed.


So, here's the final and working init.rc statements:

on property:dev.bootcomplete=1
    exec u:r:shell:s0 shell shell input log adb sdcard_rw sdcard_r net_bt_admin net_bt inet net_bw_stats -- /system/bin/sh /system/bin/am start -n com.example.package/com.example.package.MainActivity