How can I change SELinux from Enforcing to Permissive on Samsung Galaxy Note 3? My device is Samsung Galaxy Note 3 SM-N9005.

This phone comes with SELinux set to Enforcing by default.

I have been trying to change this to permissive but to no avail.

I built the kernel from source code following Samsung instructions, and added a line to init.rc file in the ramdisk: "setenforce 0" and this worked, however WiFi broke and I am not clued up on kernel development.

I have tried, as root, running "setenforce 0" in terminal and via adb. There is no error, however it stays Enforcing.

I am running out of options have looked through the init files in the Samsung source code and cannot find anywhere where Samsung set SELinux to be Enforcing.

Any help will be vastly appreciated!
If you're rooted, install Android Terminal Emulator from Play Store and open a root shell. Also make sure you use latest (>2.00) SuperSU to handle SELinux. Then type: su 0 setenforce 0 and see what happens. Check with id. If that doesn't work, also try with: su system setenforce 0. In AOS >4.3, it's not enough to just be "root" (uid=0), you also have to use the right context.

EDIT: 2015-11-06

Apparently, since AOS >4.4, Google started using a permanent enforcing mode which actually enforces the SELinux policy. These phones have disabled the Permissive option through the DCONFIG_ALWAYS_ENFORCE=true kernel config flag in their Kernels. You need to flash an insecure Kernel (e.g. CF_Root) or a brand new kernel where this flag has been disabled. 

Google writes here:


  In the Android 5.0 (L) release, Android moves to full enforcement of SELinux. This builds upon the permissive release of 4.3 and the partial enforcement of 4.4. In short, Android is shifting from enforcement on a limited set of crucial domains (installd, netd, vold and zygote) to everything (more than 60 domains). This means manufacturers will have to better understand and scale their SELinux implementations to provide compatible devices. Understand that:



Everything is in enforcing mode in the 5.0 release
No processes other than init should run in the init domain
Any generic denial (for a block_device, socket_device, default_service, etc.) indicates that device needs a special domain 


For more info how to recompile your Kernel, look here.