и да, это selinux
05-30 21:49:15.971 4405-4405/? E/audit: type=1400 audit(1527706155.966:6382): avc: denied { execute } for pid=2054 comm="sh" name="
test.sh" dev="dm-3" ino=1507699 scontext=u:r:untrusted_app_25:s0:c512,c768 tcontext=u:object_r:shell_data_file:s0 tclass=file permissive=0 SEPF_SM-G960F_8.0.0_0001 audit_filtered
05-30 21:49:15.972 4422-25009/? V/APM_AudioPolicyManager: getOutput() device 2, stream 1, samplingRate 0, format 0, channelMask 3, flags 0
05-30 21:49:15.972 4405-4405/? E/audit: type=1300 audit(1527706155.966:6382): arch=c00000b7 syscall=48 per=8 success=no exit=-13 a0=ffffff9c a1=7d2ee2fbc8 a2=1 a3=0 items=0 ppid=1660 pid=2054 auid=4294967295 uid=10223 gid=10223 euid=10223 suid=10223 fsuid=10223 egid=10223 sgid=10223 fsgid=10223 tty=pts1 ses=4294967295 comm="sh" exe="/system/bin/sh" subj=u:r:untrusted_app_25:s0:c512,c768 key=(null)
type=1327 audit(1527706155.966:6382): proctitle=2F73797374656D2F62696E2F7368002D