11. Labeling Properties | Exploring SE for Android

Sign In Start Free Trial

Book Overview & Buying
Table Of Contents

Exploring SE for Android

By : Confer, Roberts

4 (3)

Exploring SE for Android

4 (3)

By: Confer, Roberts

Overview of this book

This book is intended for developers and engineers with some familiarity of operating system concepts as implemented by Linux. A basic background in C code would be helpful. Their positions range from hobbyists wanting to secure their Android powered creations to OEM engineers building handsets to engineers of emerging areas where Android is seeing growth.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. Linux Access Controls

1. Linux Access Controls

Changing permission bits

Changing owners and groups

The case for more

Capabilities model

Android's use of DAC

Glancing at Android vulnerabilities

Summary

2. Mandatory Access Controls and SELinux

2. Mandatory Access Controls and SELinux

Getting back to the basics

Labels

Access vectors

Multilevel security

Putting it together

Complexities and best practices

Summary

3. Android Is Weird

3. Android Is Weird

Android's security model

Binder

Zygote – application spawn

The property service

Summary

4. Installation on the UDOO

4. Installation on the UDOO

Retrieving the source

Flashing image on an SD card

UDOO serial and Android Debug Bridge

Flipping the switch

It's alive

Summary

5. Booting the System

5. Booting the System

Policy load

Fixing the policy version

Summary

6. Exploring SELinuxFS

6. Exploring SELinuxFS

Locating the filesystem

Interrogating the filesystem

Java SELinux API

Summary

7. Utilizing Audit Logs

7. Utilizing Audit Logs

Upgrades – patches galore

The audit system

Interpreting SELinux denial logs

Contexts

Summary

8. Applying Contexts to Files

8. Applying Contexts to Files

Labeling filesystems

Examples and tools

A side note on security

Summary

9. Adding Services to Domains

9. Adding Services to Domains

Init – the king of daemons

Dynamic domain transitions

Explicit contexts via seclabel

Relabeling processes

Limitations on app labeling

Summary

10. Placing Applications in Domains

10. Placing Applications in Domains

The case to secure the zygote

Fortifying the zygote

Summary

11. Labeling Properties

11. Labeling Properties

Labeling via property_contexts

Permissions on properties

Relabeling existing properties

Creating and labeling new properties

Special properties

Summary

12. Mastering the Tool Chain

12. Mastering the Tool Chain

Building subcomponents – targets and projects

Exploring sepolicy's Android.mk

Standalone tools

Summary

13. Getting to Enforcing Mode

13. Getting to Enforcing Mode

Updating to SEPolicy master

Purging the device

Setting up CTS

Running CTS

Gathering the results

Authoring device policy

Second policy pass

Field trials

Going enforcing

Summary

A. The Development Environment

A. The Development Environment

VirtualBox

Ubuntu Linux 12.04 (precise pangolin)

VirtualBox extension pack and guest additions

Save time with shared folders

The build environment

Oracle Java 6

Summary

Index

Index

Creating and labeling new properties

All properties are dynamically created in the system using setprop calls or function calls that do the equivalent from C (bionic/libc/include/sys/system_properties.h) and Java (android.os.SystemProperties). Note that the System.getProperty() and System.setProperty() Java calls work on application private property stores and are not tied into the global one.

For DAC controls, you need to modify property_perms[] as noted earlier to have permissions for non-root users to create or set the property. Note that root can always set and create, unless constrained by SELinux policy.

Suppose we want to create the udoo.name and udoo.owner properties; we only want the root user and shell domain to access them. We could create them like this:

root@udoo:/ # setprop udoo.name udoo
avc: denied { set } for property=udoo.name scontext=u:r:shell:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service
root@udoo:/ # setprop udoo.owner William

Notice the denial shows...

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Exploring SE for Android

Search

Your notes and bookmarks