13. Getting to Enforcing Mode | Exploring SE for Android

Sign In Start Free Trial

Book Overview & Buying
Table Of Contents

Exploring SE for Android

By : Confer, Roberts

4 (3)

Exploring SE for Android

4 (3)

By: Confer, Roberts

Overview of this book

This book is intended for developers and engineers with some familiarity of operating system concepts as implemented by Linux. A basic background in C code would be helpful. Their positions range from hobbyists wanting to secure their Android powered creations to OEM engineers building handsets to engineers of emerging areas where Android is seeing growth.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. Linux Access Controls

1. Linux Access Controls

Changing permission bits

Changing owners and groups

The case for more

Capabilities model

Android's use of DAC

Glancing at Android vulnerabilities

Summary

2. Mandatory Access Controls and SELinux

2. Mandatory Access Controls and SELinux

Getting back to the basics

Labels

Access vectors

Multilevel security

Putting it together

Complexities and best practices

Summary

3. Android Is Weird

3. Android Is Weird

Android's security model

Binder

Zygote – application spawn

The property service

Summary

4. Installation on the UDOO

4. Installation on the UDOO

Retrieving the source

Flashing image on an SD card

UDOO serial and Android Debug Bridge

Flipping the switch

It's alive

Summary

5. Booting the System

5. Booting the System

Policy load

Fixing the policy version

Summary

6. Exploring SELinuxFS

6. Exploring SELinuxFS

Locating the filesystem

Interrogating the filesystem

Java SELinux API

Summary

7. Utilizing Audit Logs

7. Utilizing Audit Logs

Upgrades – patches galore

The audit system

Interpreting SELinux denial logs

Contexts

Summary

8. Applying Contexts to Files

8. Applying Contexts to Files

Labeling filesystems

Examples and tools

A side note on security

Summary

9. Adding Services to Domains

9. Adding Services to Domains

Init – the king of daemons

Dynamic domain transitions

Explicit contexts via seclabel

Relabeling processes

Limitations on app labeling

Summary

10. Placing Applications in Domains

10. Placing Applications in Domains

The case to secure the zygote

Fortifying the zygote

Summary

11. Labeling Properties

11. Labeling Properties

Labeling via property_contexts

Permissions on properties

Relabeling existing properties

Creating and labeling new properties

Special properties

Summary

12. Mastering the Tool Chain

12. Mastering the Tool Chain

Building subcomponents – targets and projects

Exploring sepolicy's Android.mk

Standalone tools

Summary

13. Getting to Enforcing Mode

13. Getting to Enforcing Mode

Updating to SEPolicy master

Purging the device

Setting up CTS

Running CTS

Gathering the results

Authoring device policy

Second policy pass

Field trials

Going enforcing

Summary

A. The Development Environment

A. The Development Environment

VirtualBox

Ubuntu Linux 12.04 (precise pangolin)

VirtualBox extension pack and guest additions

Save time with shared folders

The build environment

Oracle Java 6

Summary

Index

Index

Authoring device policy

Run both audit.log and audit.old through audit2allow to see what's going on. The output of audit2allow is grouped by source domain. Rather than going through it all, we will highlight the unusual cases, starting with the interpreted results of audit2allow. Assuming you are in the audit log directory, perform cat audit.* | audit2allow | less. Any policy work will be done in the device-specific UDOO sepolicy directory.

adbd

The following are our adbd denials as filtered through audit2allow:

#============= adbd ==============
allow adbd ashmem_device:chr_file execute;
allow adbd dumpstate:unix_stream_socket connectto;
allow adbd dumpstate_socket:sock_file write;
allow adbd input_device:chr_file { write getattr open };
allow adbd log_device:chr_file { write read ioctl open };
allow adbd logcat_exec:file { read getattr open execute execute_no_trans };
allow adbd mediaserver:binder { transfer call };
allow adbd mediaserver:fd use;
allow adbd self:capability { net_raw dac_override...

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Exploring SE for Android

Search

Your notes and bookmarks