SELinux in Android Lollipop and M

More documents

Recommendations

Info

SELinux in Android vs Linux distributions• > 60% of active Android devices are running a version of Android that hasSELinux.– 4.3 Jelly Bean (4.7%), 4.4 KitKat (39.3%), 5.x Lollipop (18.1%)• In Android 4.4 and later, SELinux is always enabled and enforcing.• As of 5.0 and later, Android has a more secure default policy than Linuxdistributions.– Fully enforcing, only kernel and init “unconfined”, TCB protection goals.• Yet Android has a much smaller and simpler policy than Linux distributions.– Roughly 5% the number of rules, 10% the number of types.• Could a similar policy be developed for Linux distributions?22
Ongoing and Future Work• Enable apps to opt into stronger protections.– Sandboxing, isolation, file protection• Investigate new runtime permissions feature.– when Android M source is released• Improve SELinux tooling for Android.• Further userspace policy enforcement.• Kernel self-protection23
Page 1 and 2: SELinux in Android Lollipop and MSt
Page 3 and 4: CLASSIFICATION HEADERToday's Talk
Page 5 and 6: SELinux in Android 5.0 Lollipop•
Page 7 and 8: Service-specific Protection via SEL
Page 9 and 10: Lollipop Updates●●●5.0.1 thro
Page 11 and 12: SELinux in Android M●●●●●
Page 13 and 14: SELinux and Android Multi-User●
Page 15 and 16: The Chrome for Android sandbox●
Page 17 and 18: Locking down the Binder• Binder i
Page 19 and 20: Policy Hardening• Forced init to
Page 21: Android & Upstream SELinux• Andro

SELinux in Android Lollipop and M

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?