SE Linux Policy Information Thread

SELinux Labeling:
Each process and object is labeled with a security context.
–
A string of the form “user:role:type:level”.
–
Only the type field is used in AOSP presently.
•
Process types are also called domains.
•
Domains and types are security equivalence classes.
–
Identifiers for processes and objects in policy.
–
Same domain/type => same access.

SELinux Policy:

The security policy configuration defines:
–
how to label processes and objects with domains and types,
–
how domains can interact with each other (e.g. signals, IPC, ptrace), and how domains can access types.
•
No processes are exempt from the policy.
–
Not overridden by uid-0 or Linux capabilities.
–
Only notion of “unconfined” is policy-defined.

SELinux Possible States

Disabled=Not enabled in the kernel or disabled via kernel parameter.
•
Permissive=Just logs denials but does not enforce them.
•
Enforcing=Logs and enforces denials for all enforcing domains (processes).

Per-Domain Permissive
–
Permissive for specific domains (processes).
–
Specified in policy on a per-domain basis.
–
Enables incremental application of SELinux to an ever increasing portion of the system.
–
Enables policy development for new services and apps while keeping the rest of the system enforcing.

Click to expand...

Click to collapse

Android 4.2 or earlier: Disabled.
•
Android 4.3: Permissive.
–
With all domains permissive + unconfined.
•
Android 4.4: Enforcing. Enforcing for installd netd, vold, and zygote.

Permissive for app domains (logging denials).
Permissive + unconfined for all other domains.

Click to expand...

Click to collapse

First included in Galaxy S4 (4.2.2) but in permissive by default.
•
4.3 and later updates switched to enforcing mode.
•
No permissive domains (all enforcing).
•
Only kernel and init domains are unconfined.
•
Policy originally derived from our policy, but customized by Samsung

Click to expand...

Click to collapse