9. Adding Services to Domains | Exploring SE for Android

Sign In Start Free Trial

Book Overview & Buying
Table Of Contents

Exploring SE for Android

By : Confer, Roberts

4 (3)

Exploring SE for Android

4 (3)

By: Confer, Roberts

Overview of this book

This book is intended for developers and engineers with some familiarity of operating system concepts as implemented by Linux. A basic background in C code would be helpful. Their positions range from hobbyists wanting to secure their Android powered creations to OEM engineers building handsets to engineers of emerging areas where Android is seeing growth.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. Linux Access Controls

1. Linux Access Controls

Changing permission bits

Changing owners and groups

The case for more

Capabilities model

Android's use of DAC

Glancing at Android vulnerabilities

Summary

2. Mandatory Access Controls and SELinux

2. Mandatory Access Controls and SELinux

Getting back to the basics

Labels

Access vectors

Multilevel security

Putting it together

Complexities and best practices

Summary

3. Android Is Weird

3. Android Is Weird

Android's security model

Binder

Zygote – application spawn

The property service

Summary

4. Installation on the UDOO

4. Installation on the UDOO

Retrieving the source

Flashing image on an SD card

UDOO serial and Android Debug Bridge

Flipping the switch

It's alive

Summary

5. Booting the System

5. Booting the System

Policy load

Fixing the policy version

Summary

6. Exploring SELinuxFS

6. Exploring SELinuxFS

Locating the filesystem

Interrogating the filesystem

Java SELinux API

Summary

7. Utilizing Audit Logs

7. Utilizing Audit Logs

Upgrades – patches galore

The audit system

Interpreting SELinux denial logs

Contexts

Summary

8. Applying Contexts to Files

8. Applying Contexts to Files

Labeling filesystems

Examples and tools

A side note on security

Summary

9. Adding Services to Domains

9. Adding Services to Domains

Init – the king of daemons

Dynamic domain transitions

Explicit contexts via seclabel

Relabeling processes

Limitations on app labeling

Summary

10. Placing Applications in Domains

10. Placing Applications in Domains

The case to secure the zygote

Fortifying the zygote

Summary

11. Labeling Properties

11. Labeling Properties

Labeling via property_contexts

Permissions on properties

Relabeling existing properties

Creating and labeling new properties

Special properties

Summary

12. Mastering the Tool Chain

12. Mastering the Tool Chain

Building subcomponents – targets and projects

Exploring sepolicy's Android.mk

Standalone tools

Summary

13. Getting to Enforcing Mode

13. Getting to Enforcing Mode

Updating to SEPolicy master

Purging the device

Setting up CTS

Running CTS

Gathering the results

Authoring device policy

Second policy pass

Field trials

Going enforcing

Summary

A. The Development Environment

A. The Development Environment

VirtualBox

Ubuntu Linux 12.04 (precise pangolin)

VirtualBox extension pack and guest additions

Save time with shared folders

The build environment

Oracle Java 6

Summary

Index

Index

Dynamic domain transitions

We saw init computing of the contexts for the init sockets, but we never encountered it while setting the domains for child processes. In this section, we will dive into the two techniques to do so: explicit setting with an init script and sepolicy dynamic domain transitions.

The first way to the domains for child processes is with the seclabel statement in the init script service declaration. Within the child processes execution after fork(), we find this statement:

if (svc->seclabel) {
if (is_selinux_enabled() > 0 && setexeccon(svc->seclabel) < 0) {
ERROR("cannot setexeccon('%s'): %s\n", svc->seclabel, strerror(errno));
_exit(127);
}
}

To clarify, the svc variable is the structure that contains the service options and arguments, so svc->seclabel is seclabel. If it's set, it calls setexeccon(), which sets the process' execution context for anything it executes via exec(). Further down, we see that the exec() function calls are made. The...

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Exploring SE for Android

Search

Your notes and bookmarks