Android SELinux Internals Part IV Policy Analysis, Kernel Mi...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://8ksec.io/android-selinux-internals-part-iv
• Blog Title: Android SELinux Internals Part IV: Policy Analysis, Kernel Mitigations, and Android 16 Changes
• Suggested Section: Mobile Pentesting > Android Applications Pentesting > Android SELinux Policy Analysis and Kernel-Level Bypass

🎯 Content Summary

Scope and security impact

This post explains how to audit the SELinux policy actually enforced by an Android device, identify dangerous OEM/vendor permissions, and assess the mitigations that an exploit must defeat before performing a kernel-level SELinux bypass. It does not disclose a new CVE or provide a standalone exploit. Its offensive value lies in mapping reachable files, device nodes, IPC endpoints, capabilities, and domains, then identifying permissions that can turn code exec...

🔧 Technical Details

Audit the live merged policy rather than source fragments: Run setools-android as root against /sys/fs/selinux/policy. Query an attacker-controlled source domain with sesearch -A -s <domain>, then filter by file, chr_file, process, Binder, Unix sockets, and transition permissions. This reveals the exact policy enforced after platform, compatibility, vendor, ODM, and injected rules have been merged.

Turn SELinux rules into an attack-path graph: Begin with the initial domain and identify reachable files, character devices, Binder services, Unix sockets, and process domains. For every reachable service or HAL, inspect its own permissions for driver IOCTL access, sensitive files, executable writable locations, or capabilities such as sys_admin, sys_rawio, sys_ptrace, and sys_mod...

🤖 Agent Actions

Implemented the HackTricks update.

Changes

• Added android-selinux-policy-analysis.md covering:
  • Treble policy layout and live-policy extraction
  • seinfo/sesearch auditing workflow
  • Vendor-policy attack-path mapping
  • Runtime implications of neverallow
  • Android 16 genfs and sandbox changes
  • Kernel mitigation boundaries and data-only SELinux bypass considerations
• Added navigation links in:
  • src/mobile-pentesting/android-app-pentesting/README.md
  • src/SUMMARY.md
• Included numbered citations to AOSP, GKI, SETools, and the original 8kSec research.

Validation passed for formatting, references, code fences, forbidden sources, and git diff --check. mdbook was unavailable locally.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://8ksec.io/android-selinux-internals-part-iv

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting > Android Applications Pentesting > Android SELinux Policy Analysis and Kernel-Level Bypass".

Repository Maintenance:

• MD Files Formatting: 1030 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0