From 8130cd792b2e6db1f2ad9342374426090b5a3b2d Mon Sep 17 00:00:00 2001
From: Cuynu <cuynu@proton.me>
Date: Fri, 1 May 2026 17:28:17 +0700
Subject: [PATCH] feat: zdefend-fix(customize.sh): handle selinux permissive &
 move from vtapfix to afterinstall

reinstalling app itself when selinux is permissive, so the app can work without vtap 40202 error

check selinux status before get apk path, so it wont show duplicate apk path

vtapfix is deprecated, it is now afterinstall page.

Signed-off-by: Cuynu <cuynu@proton.me>
---
 module_new/zdefend-fix/customize.sh | 38 ++++++++++++++++++++++-------
 1 file changed, 29 insertions(+), 9 deletions(-)

diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh
index 43cdb5e..77a149b 100644
--- a/module_new/zdefend-fix/customize.sh
+++ b/module_new/zdefend-fix/customize.sh
@@ -6,13 +6,21 @@ ANDROIDSDK="$(getprop ro.build.version.sdk)"
 INSTALLVI="https://git.disroot.org/mbcp/info_vi/wiki/mbcpinstall"
 INSTALLEN="https://git.disroot.org/mbcp/info_en/wiki/mbcpinstall"
 
-# Get base.apk path 
-dumpsys package com.mbmobile | grep path: > /data/local/tmp/path.txt
-sed -i 's|    path: ||g' /data/local/tmp/path.txt
+SELINUXSTATUS="$(getenforce)"
 
-APKPATH="$(cat /data/local/tmp/path.txt)"
+echo "SELinux status : $SELINUXSTATUS"
 
-echo "APK Path: $APKPATH"
+getapkpath() {
+	dumpsys package com.mbmobile | grep path: > /data/local/tmp/path.txt
+	sed -i 's|    path: ||g' /data/local/tmp/path.txt
+	APKPATH="$(cat /data/local/tmp/path.txt)"
+	echo "APK Path: $APKPATH"
+}
+
+# get apk path first
+# only get apkpath if selinux is enforcing
+# if the selinux state is permissive, handle app installation first, then getapkpath after it
+[ $(getenforce | grep Enforcing) ] && getapkpath
 
 # Clear old iptables
 iptables -t nat -F
@@ -74,16 +82,16 @@ vtapfail() {
 vtapstillfail() {
 	iptables -t nat -F
 	echo "VTAP provision failed or triggering! Cannot continue!"
-	echo "Please follow vtapfix for fix steps."
+	echo "Please follow afterinstall for fix steps."
 	echo "In case if you already done :"
 	echo "Try to reinstall module again 3 more times."
 	sleep 3
 	if [ $SYSLANGVI ]; then
-	am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_vi/wiki/vtapfix >/dev/null 2>&1
+	am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_vi/wiki/afterinstall >/dev/null 2>&1
 	am force-stop com.mbmobile
 	exit 169
 else
-	am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_en/wiki/vtapfix >/dev/null 2>&1	
+	am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_en/wiki/afterinstall >/dev/null 2>&1	
 	exit 169
 fi 
 }
@@ -94,6 +102,17 @@ checkvtapagain() {
 
 }
 
+selinuxhandle() {
+	getapkpath > /dev/null 2&>1
+	echo "SELinux is Permissive! Enforcing is required!"
+	echo "Forcing SELinux state to Enforcing..."
+	setenforce enforcing
+	echo "Reinstalling app..."
+	pm install $APKPATH
+	echo "Getting new APK path..."
+	getapkpath
+}
+
 [[ -d /data/adb/modules/bindhosts ]] && bindhostfound
 
 [[ -d /data/data/com.tsng.hidemyapplist ]] && tsnghma 
@@ -103,7 +122,8 @@ checkvtapagain() {
 [[ -d /data/data/io.github.x0eg0.magisk ]] && nonfosskitsune
 
 # v6.4.80+ requires enforcing SELinux in order to prevent 40202 VTAP fail (Runtime Tampering) error
-setenforce enforcing
+[ $(getenforce | grep Permissive) ] && selinuxhandle
+
 
 # Check if MB is installed or nope
 # Remove this one can cause the module does not work properly!