SELinux Wiki - Recent changes [en]

SEforAndroid

2013-05-16T17:51:23Z

Undo revision 1370 by StephenSmalley (Talk)

←Older revision		Revision as of 17:51, 16 May 2013
(5 intermediate revisions not shown.)
Line 7:		Line 7:
	== Papers and Presentations ==		== Papers and Presentations ==

-	* Linux Security Summit 2011, Sep 2011. [http://selinuxproject.org/~jmorris/lss2011_slides/caseforseandroid.pdf Slides]	+	* The Case for SE Android, Linux Security Summit 2011, Sep 2011. [http://selinuxproject.org/~jmorris/lss2011_slides/caseforseandroid.pdf Slides]
-	* Android Builders Summit 2012, Feb 2012. [https://events.linuxfoundation.org/images/stories/pdf/lf_abs12_smalley.pdf Slides] [http://video.linux.com/videos/the-case-for-security-enhanced-se-android Video]	+	* The Case for Security Enhanced (SE) Android, Android Builders Summit 2012, Feb 2012. [https://events.linuxfoundation.org/images/stories/pdf/lf_abs12_smalley.pdf Slides] [http://video.linux.com/videos/the-case-for-security-enhanced-se-android Video]
-	* 16th Semi-Annual Software Assurance Forum, Mar 2012. [https://buildsecurityin.us-cert.gov/swa/presentations_032612/SE%20Android%20(Panel%20on%20Securing%20Mobile%20Operatins%20Systems)%20-%20Stephen%20Smalley.pdf Slides]	+	* Security Enhanced (SE) Android, 16th Semi-Annual Software Assurance Forum, Mar 2012. [https://buildsecurityin.us-cert.gov/swa/presentations_032612/SE%20Android%20(Panel%20on%20Securing%20Mobile%20Operatins%20Systems)%20-%20Stephen%20Smalley.pdf Slides]
-	* LinuxCon North America 2012, Aug 2012. [https://events.linuxfoundation.org/images/stories/pdf/lcna_co2012_smalley.pdf Slides]	+	* Security Enhanced (SE) Android, LinuxCon North America 2012, Aug 2012. [https://events.linuxfoundation.org/images/stories/pdf/lcna_co2012_smalley.pdf Slides]
-	* Linux Security Summit 2012, Aug 2012. [http://kernsec.org/files/LSS2012-MiddlewareMAC.pdf Slides]	+	* Middleware MAC for Android, Linux Security Summit 2012, Aug 2012. [http://kernsec.org/files/LSS2012-MiddlewareMAC.pdf Slides]
-	* ~~Paper presentation~~, 20th Annual Network and Distributed System Security Symposium (NDSS '13), Feb 2013. [http://selinuxproject.org/~seandroid/papers/NDSS2013-SEAndroid-Paper.pdf Paper] [http://selinuxproject.org/~seandroid/slides/NDSS2013-SEAndroid-Presentation.pdf Slides]	+	* Security Enhanced (SE) Android: Bringing Flexible MAC to Android, 20th Annual Network and Distributed System Security Symposium (NDSS '13), Feb 2013. [http://selinuxproject.org/~seandroid/papers/NDSS2013-SEAndroid-Paper.pdf Paper] [http://selinuxproject.org/~seandroid/slides/NDSS2013-SEAndroid-Presentation.pdf Slides]
-	* ~~Keynote~~, 20th Annual Network and Distributed System Security Symposium (NDSS '13), Feb 2013. [http://selinuxproject.org/~seandroid/slides/NDSS2013-Keynote.pdf Slides]	+	* Laying a Secure Foundation for Mobile Devices, 20th Annual Network and Distributed System Security Symposium (NDSS '13), Feb 2013. [http://selinuxproject.org/~seandroid/slides/NDSS2013-Keynote.pdf Slides]

	== How do I get the code? ==		== How do I get the code? ==
Line 80:		Line 80:
	\| android-4.1.2_r1		\| android-4.1.2_r1
	\| seandroid-4.1.2		\| seandroid-4.1.2
-	\|-
-	\| android-4.0.4_r2.1
-	\| seandroid-4.0.4
	\|}		\|}

Line 115:		Line 112:
	</pre>		</pre>

-	The same instructions can be applied for other versions such as 4.1.2 ~~or 4.0.4~~.	+	The same instructions can be applied for other versions such as 4.1.2.

	== Git Trees and Branches ==		== Git Trees and Branches ==
Line 230:		Line 227:
	make ARCH=arm goldfish_armv7_defconfig		make ARCH=arm goldfish_armv7_defconfig
	make ARCH=arm CROSS_COMPILE=$PREFIX/prebuilts/gcc/linux-x86/arm/arm-eabi-4.6/bin/arm-eabi-		make ARCH=arm CROSS_COMPILE=$PREFIX/prebuilts/gcc/linux-x86/arm/arm-eabi-4.6/bin/arm-eabi-
-	</pre>
-
-	If building 4.0.4, the compiler toolchain has a different path,
-	<pre>
-	make ARCH=arm CROSS_COMPILE=$PREFIX/prebuilt/linux-x86/toolchain/arm-eabi-4.4.3/bin/arm-eabi-
	</pre>		</pre>

Line 319:		Line 311:
	<pre>		<pre>
	make ARCH=arm CROSS_COMPILE=$PREFIX/prebuilts/gcc/darwin-x86/arm/arm-eabi-4.6/bin/arm-eabi-		make ARCH=arm CROSS_COMPILE=$PREFIX/prebuilts/gcc/darwin-x86/arm/arm-eabi-4.6/bin/arm-eabi-
-	</pre>
-
-	If building 4.0.4, the compiler toolchain has a different path,
-	<pre>
-	make ARCH=arm CROSS_COMPILE=$PREFIX/prebuilt/linux-x86/toolchain/arm-eabi-4.4.3/bin/arm-eabi-
	</pre>		</pre>

Line 364:		Line 351:
	\| seandroid-omap-tuna-3.0-jb-mr1.1		\| seandroid-omap-tuna-3.0-jb-mr1.1
	\| tuna_defconfig		\| tuna_defconfig
-	\|-
-	\| 4.1.2
-	\| Nexus S
-	\| kernel/samsung
-	\| seandroid-samsung-3.0-jb-mr0
-	\| herring_defconfig
-	\|-
-	\| 4.1.2
-	\| Motorola Xoom
-	\| kernel/tegra
-	\| seandroid-tegra-moto-2.6.39-jb-mr0
-	\| stingray_defconfig
-	\|-
-	\| master
-	\| PandaBoard
-	\| kernel/omap
-	\| seandroid-omap-panda-3.0
-	\| panda_defconfig
	\|}		\|}

Main Page

2013-05-12T13:59:35Z

←Older revision		Revision as of 13:59, 12 May 2013
Line 31:		Line 31:

	[[:Category:UseCases \| Use cases]]		[[:Category:UseCases \| Use cases]]
-
-	[[Experimenters Corner]]

NB SEforAndroid 1

2013-05-12T13:46:50Z

←Older revision		Revision as of 13:46, 12 May 2013
Line 1:		Line 1:
	= SE for Android =		= SE for Android =
	== Introduction ==		== Introduction ==
-	This section gives an overview of the enhancements made to Android to produce Security Enhancements for Android™ (SE for Android) as it stood in April '13. As this project is continually being enhanced, it is recommended that the official project wiki is checked for the latest enhancements at [[SEforAndroid \| SEforAndroid]]	+	This section gives an overview of the enhancements made to Android to produce Security Enhancements for Android™ (SE for Android) as it stood in April '13. As this project is continually being enhanced, it is recommended that the official project wiki is checked for the latest enhancements at [[SEforAndroid \| SEforAndroid]].

	The following email is also useful regarding the merging of SE for Andriod: http://article.gmane.org/gmane.comp.security.seandroid/675/match=mainstreaming		The following email is also useful regarding the merging of SE for Andriod: http://article.gmane.org/gmane.comp.security.seandroid/675/match=mainstreaming
Line 8:		Line 8:

	The [[SEforAndroid \| SEforAndriod]] page will also describe how to obtain the code, install SE for Android and the features that have been implemented. It also has useful reference papers with [http://selinuxproject.org/~seandroid/papers/NDSS2013-SEAndroid-Paper.pdf Security Enhanced (SE) Android: Bringing Flexible MAC to Android] being a recommended read.		The [[SEforAndroid \| SEforAndriod]] page will also describe how to obtain the code, install SE for Android and the features that have been implemented. It also has useful reference papers with [http://selinuxproject.org/~seandroid/papers/NDSS2013-SEAndroid-Paper.pdf Security Enhanced (SE) Android: Bringing Flexible MAC to Android] being a recommended read.
		+
		+	The white paper [http://www.samsung.com/global/business/business-images/resource/white-paper/2013/05/Samsung_KNOX_whitepaper_April2013_v1.1-0.pdf "An Overview of Samsung KNOX"] also gives an overview of how SE for Android is being integrated with other security services (such as secure boot and integrity measurement) to help provide a more secure mobile platform.

	The http://en.wikipedia.org/wiki/Android_%28operating_system%29 site gives a good introduction to Android and http://source.android.com gives details on installation of the source.		The http://en.wikipedia.org/wiki/Android_%28operating_system%29 site gives a good introduction to Android and http://source.android.com gives details on installation of the source.
Line 158:		Line 160:
	: device		: device
	:: Details regarding supported devices can be found at [[SEforAndroid#Building_for_a_Device \| SEforAndroid - Building for a Device]]		:: Details regarding supported devices can be found at [[SEforAndroid#Building_for_a_Device \| SEforAndroid - Building for a Device]]
-	:: Device configurations can be modified to allow the policy to be tailored, see the [[#~~Policy Generation~~ \| Policy ~~Generation~~]] section.	+	:: Device configurations can be modified to allow the policy to be tailored, see the [[#Building_the_Policy \| Building the Policy]] section.


Line 184:		Line 186:
	\| Perform a binder IPC on behalf of another process (can A impersonate B on an IPC?).		\| Perform a binder IPC on behalf of another process (can A impersonate B on an IPC?).
	Not currently used in policy but kernel (<tt>selinux/hooks.c</tt>) checks permission in <tt>selinux_binder_transaction</tt> call.		Not currently used in policy but kernel (<tt>selinux/hooks.c</tt>) checks permission in <tt>selinux_binder_transaction</tt> call.
-	\|-
-	\| receive
-	\| Receive a binder reference from another process (can A receive a binder referenced owned by B?).
	\|-		\|-
	\| set_context_mgr		\| set_context_mgr
Line 193:		Line 192:
	\|-		\|-
	\| transfer		\| transfer
-	\| Transfer a binder reference to another process (can A transfer a binder reference ~~owned by~~ B?).	+	\| Transfer a binder reference to another process (can A transfer a binder reference to B?).
	\|}		\|}

Line 245:		Line 244:
	\|-		\|-
	\| <tt>chcon</tt>		\| <tt>chcon</tt>
-	\| Change security context of file. ~~Not as~~ <tt>chcon(1)</tt> as only supports <tt>context path</tt> parameters~~, therefore to change multiple files, need to list as pairs:~~	+	\| Change security context of file. As the first part of <tt>chcon(1)</tt> (only supports the <tt>context path</tt> parameters.

-	<tt>chcon context pathname ~~... ...~~</tt>	+	<tt>chcon context pathname</tt>

	\|-		\|-
Line 263:		Line 262:
	\|-		\|-
	\| <tt>id</tt>		\| <tt>id</tt>
-	\| ~~Supports -Z option to display~~ security context.	+	\| Does not take any options. If SELinux is enabled then the security context is automatically displayed.

	\|-		\|-
Line 378:		Line 377:
	\| <tt>'''String getPidContext(int pid)'''</tt>		\| <tt>'''String getPidContext(int pid)'''</tt>

-	Gets the security context of a given process id~~. Use of this function is discouraged for Binder transactions.~~	+	Gets the security context of a given process id.
-	~~Use <tt>Binder.getCallingSecctx()</tt> instead~~.	+

	<tt>pid</tt> an <tt>int</tt> representing the process id to check.		<tt>pid</tt> an <tt>int</tt> representing the process id to check.
Line 453:		Line 451:

	\|}		\|}
		+
		+

	== Android Init Language SELinux Extensions ==		== Android Init Language SELinux Extensions ==
Line 538:		Line 538:

	=== SELinux MAC Policy Files ===		=== SELinux MAC Policy Files ===
-	The MAC policy configuration files are contained in the <tt>external/sepolicy</tt> directory, however there may also be policy configuration files to enable specific device features under <tt><nowiki>device/<vendor></nowiki></tt> directories (see the [[#~~Policy Generation~~ \| Policy ~~Generation~~]] section). Once generated, the policy and its supporting configuration files are installed on the device as part of the build process.	+	The MAC policy configuration files are contained in the <tt>external/sepolicy</tt> directory, however there may also be policy configuration files to enable specific device features under <tt><nowiki>device/<vendor></nowiki></tt> directories (see the [[#Building_the_Policy \| Building the Policy]] section). Once generated, the policy and its supporting configuration files are installed on the device as part of the build process.

	The following files are used to build the kernel binary policy file that will be named <tt>sepolicy</tt> and installed by default in the root directory. An updated policy may be installed at <tt>/data/security/sepolicy</tt>. The initialisation or policy reload process will always check for a policy at <tt>/data/security/sepolicy</tt> first and then if not present at <tt>/sepolicy</tt>. The policy files consist of the following:		The following files are used to build the kernel binary policy file that will be named <tt>sepolicy</tt> and installed by default in the root directory. An updated policy may be installed at <tt>/data/security/sepolicy</tt>. The initialisation or policy reload process will always check for a policy at <tt>/data/security/sepolicy</tt> first and then if not present at <tt>/sepolicy</tt>. The policy files consist of the following:
Line 610:		Line 610:

	==== SELinux Policy Booleans ====		==== SELinux Policy Booleans ====
-	Table 4 describes the SELinux policy booleans and their default state. Their state can be changed permanently across reboots using the SEAdmin ~~app~~ (as ~~it calls~~ the <tt>setBooleanValue()</tt>) method, or temporarily using the <tt>adb shell setsebool</tt> command.	+	Table 4 describes the SELinux policy booleans and their default state. Their state can be changed permanently across reboots using the SEAdmin / SEManager apps (as they call the <tt>setBooleanValue()</tt> method), or temporarily using the <tt>adb shell setsebool</tt> command. They can also be made permanent by adding them to the init.rc or init.<board>.rc files (this is the only way to make them permanent on vanilla AOSP builds or if SEAdmin / SEManager are not installed).

	'''Table 4: SE for Android SELinux Policy Booleans'''		'''Table 4: SE for Android SELinux Policy Booleans'''
Line 674:		Line 674:

	==== Setting Permissive / Enforcing Mode ====		==== Setting Permissive / Enforcing Mode ====
-	There are ~~two~~ ways to set permissive or enforcing mode in SE for Android:	+	There are three ways to set permissive or enforcing mode in SE for Android:
	# Using the SEAdmin or SEManager apps.		# Using the SEAdmin or SEManager apps.
-	# ~~Using~~ the ~~conventional~~ <tt>setenforce</tt> command:	+	# Adding the <tt>setenforce</tt> command to the init.rc or init.<board>.rc files.
-	<~~pre~~>	+	# Using <tt>adb</tt> to run the <tt>setenforce</tt> command.
-	# ~~1 = enforcing 0 = permissive~~	+
-	adb ~~shell su 0~~ setenforce 1	+
-	</~~pre~~>	+


Line 791:		Line 788:

	=== Building the Policy ===		=== Building the Policy ===
-	Some of this section has been extracted from the <tt>external/sepolicy/README</tt> file that should be checked in case there have been updates. It describes how files in <tt>external/sepolicy</tt> can be manipulated during the build process to reflect requirements of different device vendors whose policy files would normally be located in the <tt><nowiki>device/<vendor></nowiki></tt> ~~directories~~.	+	Some of this section has been extracted from the <tt>external/sepolicy/README</tt> file that should be checked in case there have been updates. It describes how files in <tt>external/sepolicy</tt> can be manipulated during the build process to reflect requirements of different device vendors whose policy files would normally be located in the <tt><nowiki>device/<vendor>/<device>/sepolicy</nowiki></tt> directory.

	==== Build Tools ====		==== Build Tools ====
Line 875:		Line 872:

	Generally though, there are enough clues to find most errors, and be aware that events logged may change with each update.		Generally though, there are enough clues to find most errors, and be aware that events logged may change with each update.
		+

	=== auditd Daemon ===		=== auditd Daemon ===
	The majority of this text has been extracted from <tt>system/core/auditd/README</tt> that describes its configuration, however note that:		The majority of this text has been extracted from <tt>system/core/auditd/README</tt> that describes its configuration, however note that:
-	* Kernel auditing is ~~automatically enabled~~ when building the SE for Android supplied kernels (e.g. for goldfish kernel see the <tt>kernel/goldfish/arch/arm/configs/goldfish_arm7_defconfig</tt> file) and <tt>auditd</tt> daemon is also ~~built and installed~~ (see <tt>build/target/product/core.mk</tt> - under the SELinux packages).	+	* Kernel auditing is included by default when building the SE for Android supplied kernels (e.g. for goldfish kernel see the <tt>kernel/goldfish/arch/arm/configs/goldfish_arm7_defconfig</tt> file) and <tt>auditd</tt> daemon is also included by default (see <tt>build/target/product/core.mk</tt> - under the SELinux packages).
	* The audit daemon output is formatted so that <tt>'''ausearch'''(8)</tt> can be used to search for SELinux events.		* The audit daemon output is formatted so that <tt>'''ausearch'''(8)</tt> can be used to search for SELinux events.
		+	* AOSP has not yet merged auditd, therefore instructions to enable it are described below.
		+

	The audit daemon is a simplified version of its desktop counterpart designed to gather the audit logs from the audit kernel subsystem. The audit subsystem of the kernel includes Linux Security Modules (LSM) messages as well.		The audit daemon is a simplified version of its desktop counterpart designed to gather the audit logs from the audit kernel subsystem. The audit subsystem of the kernel includes Linux Security Modules (LSM) messages as well.
Line 893:		Line 893:
	The daemon maintains two log files <tt>audit.log</tt> and <tt>audit.old</tt> at <tt>/data/misc/audit/</tt>. On boot, if <tt>audit.log</tt> exists, and the size is greater than 0, <tt>audit.log</tt> is renamed to <tt>audit.old</tt>. The log file is also renamed, or rotated, when a threshold is hit. This threshold is hard-coded to 100KB but can be adjusted through the <tt>AUDITD_MAX_LOG_FILE_SIZEKB</tt> Makefile file variable that can be overridden in the <tt>device.mk</tt>. Note that the value is in kilobytes e.g. <tt>AUDITD_MAX_LOG_FILE_SIZEKB := 50</tt> will set the threshold to 50KB.		The daemon maintains two log files <tt>audit.log</tt> and <tt>audit.old</tt> at <tt>/data/misc/audit/</tt>. On boot, if <tt>audit.log</tt> exists, and the size is greater than 0, <tt>audit.log</tt> is renamed to <tt>audit.old</tt>. The log file is also renamed, or rotated, when a threshold is hit. This threshold is hard-coded to 100KB but can be adjusted through the <tt>AUDITD_MAX_LOG_FILE_SIZEKB</tt> Makefile file variable that can be overridden in the <tt>device.mk</tt>. Note that the value is in kilobytes e.g. <tt>AUDITD_MAX_LOG_FILE_SIZEKB := 50</tt> will set the threshold to 50KB.

-	The daemon is not included by default, and must explicitly be added to <tt>PRODUCT_PACKAGES</tt>. This could be set in the <tt>device.mk</tt> with an example configuration as follows:	+	The daemon is not yet included by default in AOSP builds, and must explicitly be added to <tt>PRODUCT_PACKAGES</tt>. This could be set in the <tt>device.mk</tt> with an example configuration as follows:
	<pre>		<pre>
	<nowiki># 1MB Log file threshold</nowiki>		<nowiki># 1MB Log file threshold</nowiki>