Introduction: The Battle Against Root on Android

Rooting an Android device grants privileged access to the operating system, bypassing security restrictions imposed by manufacturers and Google. While desirable for advanced users, it presents significant security challenges for applications, especially those handling sensitive data like banking apps or DRM-protected content. Consequently, robust root detection mechanisms are crucial. This guide delves into kernel-level root detection, exploring how Android leverages core kernel features like dm-verity and SELinux (sepolicy) to maintain system integrity and how these can be checked for signs of compromise.

Why Kernel-Level Detection Matters

Many root detection methods rely on user-space artifacts (e.g., checking for specific files like `su` or `MagiskHide` traces). However, sophisticated root solutions often hide these. Kernel-level detection aims to identify modifications at a deeper, more fundamental level, making it harder to bypass. It focuses on the integrity of the boot process and the kernel’s runtime behavior.

dm-verity: Ensuring System Partition Integrity

dm-verity (Device Mapper Verity) is a kernel feature that provides transparent integrity checking of block devices. It’s a cornerstone of Android’s Verified Boot process, ensuring that the system partition (/system) and other critical read-only partitions haven’t been tampered with. It operates by cryptographically verifying each block of data before it’s read.

How dm-verity Works

1. Hash Tree: A Merkle tree (hash tree) is built over the entire filesystem image. Each block’s hash is stored, then pairs of hashes are hashed together, and so on, until a single root hash is generated.
2. Root Hash Verification: This root hash is signed by the device manufacturer and stored in a trusted location (e.g., the boot partition, alongside the kernel).
3. Runtime Verification: During operation, whenever a block is read from a verity-protected partition, its hash is computed and compared against the corresponding hash in the hash tree. If they don’t match, dm-verity reports an I/O error, preventing access to the tampered data.

If any part of the verified partition is modified, dm-verity will detect it. If the device attempts to boot with a modified system, Verified Boot will typically show a warning (e.g.,