Introduction to Android’s SELinux Mandate

In the evolving landscape of mobile security, Android’s implementation of Security-Enhanced Linux (SELinux) stands as a cornerstone for Mandatory Access Control (MAC). Unlike traditional Discretionary Access Control (DAC) where resource owners dictate access, SELinux enforces a global, kernel-level policy that mediates all attempts to access system resources. For Android, this translates to a robust security model where even privileged processes cannot perform actions unless explicitly permitted by the SELinux policy, significantly mitigating the impact of security vulnerabilities.

This deep dive will explore the architecture of SELinux within Android, demystify the notorious Access Vector Cache (AVC) denials, and provide practical methodologies for debugging and hardening SELinux policies.

Understanding Android’s SELinux Architecture

Android integrates SELinux at the kernel level, enforcing policies compiled from a high-level language into binary policy files. These files dictate which subjects (processes) can access which objects (files, sockets, IPC, etc.) with what permissions. Key components include:

• Kernel-level Enforcement: The Linux Security Module (LSM) framework hooks into every system call, routing access requests through the SELinux policy engine.
• sepolicy: The core SELinux policy source, a collection of TE (Type Enforcement) files that define types, attributes, roles, and rules. In Android, this is compiled into a binary policy usually found at /sepolicy or within boot.img.
• file_contexts: A critical component that defines the SELinux context (user:role:type:level) for filesystems, directories, and specific files, ensuring they are labeled correctly at boot and during runtime.
• Permissive vs. Enforcing Mode: SELinux can operate in two primary modes. In Enforcing mode, all unauthorized access attempts are blocked and logged. In Permissive mode, unauthorized attempts are logged but allowed, often used for policy development and debugging. Production Android devices typically run in Enforcing mode.

You can check the current SELinux status on your device via adb shell:

adb shellgetenforce

This command will return either Enforcing or Permissive.

The Anatomy of an AVC Denial

An AVC denial is the kernel’s way of saying,