Introduction: The Unseen Guard – SELinux on Android

Security-Enhanced Linux (SELinux) is a mandatory access control (MAC) system integrated into the Android operating system. Far beyond traditional Discretionary Access Control (DAC), SELinux enforces fine-grained permissions on processes, files, and other resources, defining what an application or system service can do, not just what it owns. On Android, SELinux is pivotal, acting as the final line of defense against many vulnerabilities, containing exploits within their assigned domains and preventing lateral movement or privilege escalation. While kernel vulnerabilities often grab headlines, understanding and exploiting flaws in SELinux policy logic itself represents a sophisticated, often overlooked, avenue for privilege escalation.

This article delves into advanced techniques for identifying and exploiting misconfigurations or logical flaws within Android’s SELinux policy. We’ll move beyond simple `audit2allow` suggestions and explore methods for analyzing the policy to uncover opportunities for domain transition manipulation, type confusion, and subtle service manager interactions that can lead to elevated privileges.

Understanding Android SELinux Fundamentals

Before diving into exploitation, a quick recap of core SELinux concepts is essential:

• Subjects (Domains): Processes run within specific domains (e.g., `untrusted_app`, `system_app`, `init`).
• Objects (Types): Files, devices, sockets, IPC objects, and other resources are labeled with types (e.g., `system_data_file`, `app_data_file`, `ashmem_device`).
• Rules: Policies define `allow` rules, specifying which domain can perform which operation on which type (e.g., `allow untrusted_app app_data_file:file { read write open };`).
• Contexts: A combination of user, role, type, and sensitivity level (e.g., `u:object_r:system_data_file:s0`). In Android, `u` and `r` are typically fixed, with `type` being the primary focus.

The entire SELinux policy for an Android device is compiled into a binary format (`sepolicy`) and loaded during boot. Analyzing this policy is the first step in identifying potential weaknesses.

Advanced Policy Analysis and Tooling

Gaining access to the device’s `sepolicy` is crucial. You can often extract it from `/sys/fs/selinux/policy` on a rooted device, or from AOSP source code (`/external/sepolicy`). Tools like `sepolicy-analyze` (from AOSP or compiled) and `checkpolicy` (for compiling/disassembling) are invaluable for dissecting the policy.

First, disassemble the policy to a human-readable format (`.cil` – Common Intermediate Language) if possible:

# On an AOSP build environment, or with compiled tools from AOSP:checkpolicy -d /sys/fs/selinux/policy > policy.cil

Alternatively, you can inspect individual context files:

• file_contexts: Defines initial labels for filesystems and directories.
• genfs_contexts: Defines labels for pseudo-filesystems (e.g., `proc`, `sysfs`).
• service_contexts: Labels for Binder services.

Our goal is to identify `allow` rules that grant overly broad permissions, or `neverallow` rules that are not enforced, or `type` definitions that are too generic.

Exploitation Technique 1: Domain Transition Manipulation

Domain transition is a core SELinux mechanism where a process executing a specific file (an ‘entrypoint’) is allowed to transition from its current domain to a new, often more privileged, domain. For example, `init` might execute `/system/bin/surfaceflinger` and transition to the `surfaceflinger_domain`. Flaws arise when a less-privileged domain can trick a privileged domain into executing attacker-controlled code or an unintended entrypoint.

Scenario: Exploiting a Weak Entrypoint

Consider a scenario where a `untrusted_app` needs to interact with a system component, and the policy allows it to execute a binary that *should* only perform a specific, safe action, but instead leads to an unintended domain transition or allows for code injection.

Example Policy Snippet to Look For:

# Potentially problematic (simplified)allow untrusted_app system_app_exec:file { execute getattr read };allow system_app_domain untrusted_app_domain:process transition;allow system_app_domain system_app_exec:file entrypoint;

In this hypothetical scenario, `untrusted_app` can execute a `system_app_exec` file. If that `system_app_exec` (which runs in `system_app_domain`) itself has a vulnerability or if the `untrusted_app` can substitute the actual `system_app_exec` with its own malicious binary (due to weak file context or permissions), it could transition to `system_app_domain`.

Steps to Identify and Exploit:

1. Identify Target Domains: Look for processes with high privileges, especially those interacting with the kernel or critical system resources.
2. Analyze `domain_transition` Rules: Search `policy.cil` for `type_transition` or `domain_transition` rules:

   grep -r
   
           
           
           
   
               
   
                   
               
               
   
                   
   Android Mobile Specs & Compare Directory
                   
   Are you researching mobile hardware properties, processor SoCs, GPU chipsets, or RAM configurations? Access our complete specs catalog to compare up to 5 devices side-by-side!
                   Compare Devices Specs →