1 <html devsite> 2 <head> 3 <title>Security-Enhanced Linux in Android</title> 4 <meta name="project_path" value="/_project.yaml" /> 5 <meta name="book_path" value="/_book.yaml" /> 6 </head> 7 <body> 8 <!-- 9 Copyright 2017 The Android Open Source Project 10 11 Licensed under the Apache License, Version 2.0 (the "License"); 12 you may not use this file except in compliance with the License. 13 You may obtain a copy of the License at 14 15 http://www.apache.org/licenses/LICENSE-2.0 16 17 Unless required by applicable law or agreed to in writing, software 18 distributed under the License is distributed on an "AS IS" BASIS, 19 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 20 See the License for the specific language governing permissions and 21 limitations under the License. 22 --> 23 24 25 26 <h2 id=introduction>Introduction</h2> 27 28 <p>The Android security model is based in part on the concept of application 29 sandboxes. Each application runs in its own sandbox. Prior to Android 4.3, 30 these sandboxes were defined by the creation of a unique Linux UID for each 31 application at time of installation. Starting with Android 4.3, 32 Security-Enhanced Linux (SELinux) is used to further define the boundaries of 33 the Android application sandbox.</p> 34 35 <p>As part of the Android <a href="/security/index.html"> 36 security model</a>, Android uses SELinux to enforce mandatory access control 37 (MAC) over all processes, even processes running with root/superuser privileges 38 (a.k.a. Linux capabilities). SELinux enhances Android security by confining 39 privileged processes and automating security policy creation.</p> 40 41 <p>Contributions to it have been made by a number 42 of companies and organizations; all Android code 43 and contributors are publicly available for review on <a 44 href="https://android.googlesource.com/">android.googlesource.com</a>. With 45 SELinux, Android can better protect and confine system services, control 46 access to application data and system logs, reduce the effects of malicious 47 software, and protect users from potential flaws in code on mobile devices.</p> 48 49 <p>Android includes SELinux in enforcing mode and a 50 corresponding security policy that works by default across the <a 51 href="https://android.googlesource.com/">Android Open Source Project</a>. In 52 enforcing mode, illegitimate actions are prevented and all attempted violations 53 are logged by the kernel to <code>dmesg</code> and <code>logcat</code>. Android 54 device manufacturers should gather information about errors so they may 55 refine their software and SELinux policies before enforcing them.</p> 56 57 <h2 id=background>Background</h2> 58 59 <p>SELinux operates on the ethos of default denial. Anything that is not 60 explicitly allowed is denied. SELinux can operate in one of two global modes: 61 permissive mode, in which permission denials are logged but not enforced, and 62 enforcing mode, in which denials are both logged and enforced. SELinux also 63 supports a per-domain permissive mode in which specific domains (processes) can 64 be made permissive while placing the rest of the system in global enforcing 65 mode. A domain is simply a label identifying a process or set of processes in 66 the security policy, where all processes labeled with the same domain are 67 treated identically by the security policy. Per-domain permissive mode enables 68 incremental application of SELinux to an ever-increasing portion of the system. 69 Per-domain permissive mode also enables policy development for new services 70 while keeping the rest of the system enforcing.</p> 71 72 <p>In the Android 5.0 (L) release, Android moves to full enforcement of 73 SELinux. This builds upon the permissive release of 4.3 and the partial 74 enforcement of 4.4. In short, Android is shifting from enforcement on a 75 limited set of crucial domains (<code>installd</code>, <code>netd</code>, 76 <code>vold</code> and <code>zygote</code>) to everything (more than 60 77 domains). This means manufacturers will have to better understand and scale 78 their SELinux implementations to provide compatible devices. Understand 79 that:</p> 80 81 82 <ul> 83 <li>Everything is in enforcing mode in the 5.0 release</li> 84 <li> No processes other than <code>init</code> should run in the 85 <code>init</code> domain</li> 86 <li> Any generic denial (for a block_device, socket_device, default_service, 87 etc.) indicates that device needs a special domain</li> 88 </ul> 89 90 <h2 id=supporting_documentation>Supporting documentation</h2> 91 92 <p>See the documentation below for details on constructing useful policies:</p> 93 94 <p><a href="https://events.linuxfoundation.org/sites/events/files/slides/abs2014_seforandroid_smalley.pdf"> 95 https://events.linuxfoundation.org/sites/events/files/slides/ 96 abs2014_seforandroid_smalley.pdf</a></p> 97 98 <p><a href="https://www.internetsociety.org/sites/default/files/02_4.pdf"> 99 https://www.internetsociety.org/sites/default/files/02_4.pdf</a></p> 100 101 <p><a href="http://freecomputerbooks.com/books/The_SELinux_Notebook-4th_Edition.pdf"> 102 http://freecomputerbooks.com/books/The_SELinux_Notebook-4th_Edition.pdf</a></p> 103 104 <p><a href="http://selinuxproject.org/page/ObjectClassesPerms"> 105 http://selinuxproject.org/page/ObjectClassesPerms</a></p> 106 107 <p><a href="https://www.nsa.gov/resources/everyone/digital-media-center/publications/research-papers/assets/files/implementing-selinux-as-linux-security-module-report.pdf"> 108 https://www.nsa.gov/resources/everyone/digital-media-center/publications/ 109 research-papers/assets/files/ 110 implementing-selinux-as-linux-security-module-report.pdf</a></p> 111 112 <p><a href="https://www.nsa.gov/resources/everyone/digital-media-center/publications/research-papers/assets/files/configuring-selinux-policy-report.pdf"> 113 https://www.nsa.gov/resources/everyone/digital-media-center/publications/ 114 research-papers/assets/files/configuring-selinux-policy-report.pdf</a></p> 115 116 <p><a href="https://www.gnu.org/software/m4/manual/index.html"> 117 https://www.gnu.org/software/m4/manual/index.html</a></p> 118 119 </body> 120 </html> 121
