android for selinux

冷不防 2023-06-30 08:47 2阅读 0赞

# NB SEforAndroid 1 #

## Contents ##

\[[hide][]\]

*  [1 Security Enhancements for Android][]
    
     *  [1.1 Introduction][]
        
         *  [1.1.1 Terminology][]
         *  [1.1.2 Useful Links][]
         *  [1.1.3 Document Sections][]
     *  [1.2 SE for Android Project Updates][]
     *  [1.3 Kernel LSM / SELinux Support][1.3 Kernel LSM _ SELinux Support]
     *  [1.4 Android Classes and Permissions][]
     *  [1.5 SELinux Commands][]
     *  [1.6 SELinux Public Methods][]
     *  [1.7 Android Init Language SELinux Extensions][]
     *  [1.8 Device Policy File Locations][]
     *  [1.9 Building the Policy][]
        
         *  [1.9.1 SELinux Policy Files][]
            
             *  [1.9.1.1 Core Policy Files][]
             *  [1.9.1.2 Policy Configuration Files][]
         *  [1.9.2 Install/Run-time MMAC Policy][1.9.2 Install_Run-time MMAC Policy]
         *  [1.9.3 Device Specific Policy][]
            
             *  [1.9.3.1 Managing Device Policy Files][]
         *  [1.9.4 Build Tools][]
         *  [1.9.5 Miscellaneous Information][]
            
             *  [1.9.5.1 SELinux Policy Versions][]
             *  [1.9.5.2 SELinux Policy Booleans][]
             *  [1.9.5.3 Setting Permissive / Enforcing Mode][1.9.5.3 Setting Permissive _ Enforcing Mode]
             *  [1.9.5.4 Checking File Labels][]
     *  [1.10 Updating Policy Files][]
        
         *  [1.10.1 Local Policy Update][]
     *  [1.11 Logging and Auditing][]
 *  [2 Policy Configuration File Formats][]

# Security Enhancements for Android #

## Introduction ##

This section gives an overview of the enhancements made to Android to add SELinux services to Security Enhancements for Android™ (SE for Android).

The main objective of this document is to provide a reference for the tools, commands, policy building tools and file formats of SE for Android based on the 5.1 release. The builds discussed are from AOSP master and SEAndriod master repositories (as March '15).

The AOSP git repositories can be found at [https://android.googlesource.com][https_android.googlesource.com].

For up to date information on the status of SE for Android the following should be consulted: [http://selinuxproject.org/page/SEforAndroid][http_selinuxproject.org_page_SEforAndroid].

### Terminology ###

This section describes how the terms SE for Android, AOSP and SEAndroid are used in this document.

<table> 
 <tbody> 
  <tr> 
   <td><strong>SE for Android</strong></td> 
   <td>This is the overall programme by Google to improve security on Android. For this document, it is used to describe the implementation of SELinux (MAC) and Middleware MAC (MMAC) on Android.</td> 
  </tr> 
  <tr> 
   <td><strong>AOSP</strong></td> 
   <td>The Android code base distributed by Google (see&nbsp;<a href="http://source.android.com/source/downloading.html" rel="nofollow">http://source.android.com/source/downloading.html</a>). Release 5.1 contains SELinux support that is described at&nbsp;<a href="http://source.android.com/devices/tech/security/se-linux.html" rel="nofollow">http://source.android.com/devices/tech/security/se-linux.html</a>. <p>AOSP contains the core SELinux MAC functionality with a run-time MMAC framework to support specific labeling of apps as described in the&nbsp;<a href="http://selinuxproject.org/page/NB_SEforAndroid_1#Install.2FRun-time_MMAC_Policy" rel="nofollow">Install/Run-time MMAC Policy</a>&nbsp;section.</p> <p>AOSP also contains services to allow updating of Intent Firewall policies, however currently no files are installed (although SEAndroid supplies a sample and update tools).</p> </td> 
  </tr> 
  <tr> 
   <td><strong>SEAndroid</strong></td> 
   <td>The SEAndroid project enhancements are decreasing as more features move into AOSP (for example the MAC policy is now the same as AOSP). The additional SEAndroid features are: 
    <ol> 
     <li>Install time MMAC (an enhancement of the AOSP Run-time MMAC service)</li> 
     <li>Installation of Enterprise Operations (EOps) configuration files.</li> 
     <li>Sample EOps and Intent Firewall configuration files (the actual services are supplied by AOSP, replacing the SEAndroid Intent MMAC, Content Provider MMAC and Revoke Permissions services that are now obsolete).</li> 
     <li>Tools to manage bundles for policy, EOps and Intent Firewall updates.</li> 
    </ol><p>See the SE for Android project page for up-to-date details at&nbsp;<a href="http://selinuxproject.org/page/SEforAndroid" rel="nofollow">http://selinuxproject.org/page/SEforAndroid</a></p> </td> 
  </tr> 
 </tbody> 
</table>

### Useful Links ###

The following link describes how to validate SELinux in Android:

[http://source.android.com/devices/tech/security/se-linux.html][http_source.android.com_devices_tech_security_se-linux.html]

The [http://selinuxproject.org/page/SEforAndroid][http_selinuxproject.org_page_SEforAndroid] pages describe the current merge status with AOSP, how to obtain the code, install SEAndroid and the features that have been implemented. It also has useful reference papers with "Security Enhanced (SE) Android: Bringing Flexible MAC to Android" available at [http://www.internetsociety.org/sites/default/files/02\_4.pdf][http_www.internetsociety.org_sites_default_files_02_4.pdf] being a recommended read.

The white paper "[An Overview of Samsung KNOX][]" also gives an overview of how SE for Android is being integrated with other security services (such as secure boot and integrity measurement) to help provide a more secure mobile platform.

### Document Sections ###

The sections that follow cover:

*  Overview of Android package additions and updates to support MAC
 *  Additional kernel LSM / SELinux support
 *  Android Classes & Permissions
 *  SELinux commands and methods
 *  SELinux extensions for init
 *  Policy construction and build:
    
     *  Build file locations
     *  Policy files
     *  Build tools
 *  Logging and auditing
 *  Android libselinux additional functions
 *  Configuration file formats

## SE for Android Project Updates ##

This gives a high level view of the new and updated projects to support SE for Android services and covers AOSP with any additional SEAndroid functions noted. These are not a complete set of updates, but give some idea of the scope.

**external/libselinux**Provides the SELinux userspace function library that is installed on the device. It is based on the 2.1.0 Linux version but has additional functions to support Android as summarised in the external/libselinux/README.android. Some additional detail is as follows:**selinux\_android\_setcontext**

Sets the correct domain context when launching applications using **setcon**(3). Information contained in the seapp\_contexts file is used to compute the correct context.

It is called by frameworks/base/core/jni/com\_android\_internal\_os\_Zygote.cpp when forking a new process and the system/core/run-as/run-as.c utility for app debugging.

**selinux\_android\_setfilecon**

Sets the correct context on application directory / files using **setfilecon**(3). Information contained in the seapp\_contexts file is used to compute the correct context.

The function is used by the package installer within frameworks/native/cmds/installd/commands.c via the package install() and make\_user\_data() functions.

**selinux\_android\_restorecon**

**selinux\_android\_restorecon\_pkgdir**

Basically these functions are used to label files and directories based on entries from the file\_contexts and/or seapp\_contexts files. They call a common handler (selinux\_android\_restorecon\_common()) that will then relabel the requested directories and files. It will also handle recursive labeling of directories and files should a new app, file\_contexts or seapp\_contexts be installed (see the [Checking File Labels][1.9.5.4 Checking File Labels] section for further information).

The **selinux\_android\_restorecon** function is used by:

frameworks/native/cmds/installd/installd.c when installing a new app.

frameworks/base/core/jni/android\_os\_SELinux.cpp for the Java native\_restorecon method.

frameworks/native/cmds/dumpstate/utils.c when dumping Dalvik and stack traces to ensure correct label.

The **selinux\_android\_restorecon\_pkgdir** function is used by:

frameworks/native/cmds/installd/commands.c for the package restorecon\_data() and make\_user\_data() functions.

**selinux\_android\_seapp\_context\_reload**

Loads the seapp\_contexts file for frameworks/native/cmds/installd/installd.c when the package installer is loaded.

**selinux\_android\_load\_policy**

Mounts the SELinux filesystem if SELinux is enabled and then calls **selinux\_android\_reload\_policy** to load the policy into the kernel. Used by system/core/init/init.c to initialise SELinux.

**selinux\_android\_reload\_policy**

Reloads the policy into the kernel. Used by system/core/init/init.c selinux\_reload\_policy() to reload policy after setting the selinux.reload\_policy property.

**selinux\_android\_use\_data\_policy**

Used by system/core/init/init.c to decide which policy directory to load the property\_contexts file from.

There is also a new labeling service for **selabel\_lookup**(3) to query the Android property\_contexts and service\_contexts files.

Various Android services will also call (not a complete list):

**selinux\_status\_updated**(3), **is\_selinux\_enabled**(3), to check whether anything changed within the SELinux environment (e.g. updated configuration files).

**selinux\_check\_access**(3) to check if the source context has access permission for the class on the target context.

**selinux\_label\_open**(3), **selabel\_lookup**(3), **selinux\_android\_file\_context\_handle**, **selinux\_android\_prop\_context\_handle**, **setfilecon**(3), **setfscreatecon**(3) to manage file labeling.

**selinux\_lookup\_best\_match** called by system/core/init/devices.c when ueventd creates a device node as it may also create one or more symlinks (for block and PCI devices). Therefore a "best match" look-up for a device node is based on its real path, plus any links that may have been created (see commits [https://android.googlesource.com/platform/system/core/][https_android.googlesource.com_platform_system_core][\+/b0ab94b7d5a888f0b6920b156e5c6a075fa0741a][https_android.googlesource.com_platform_system_core], [https://android.googlesource.com/platform/system/core/][https_android.googlesource.com_platform_system_core 1][\+/b4c5200f51c3568f604a4557119ab545a6ddac94][https_android.googlesource.com_platform_system_core 1] and[https://android.googlesource.com/platform/external/libselinux/+/be7f5e8814c4954aca51d3f95455c5d9d527658c][https_android.googlesource.com_platform_external_libselinux_be7f5e8814c4954aca51d3f95455c5d9d527658c]).

**external/libsepol**

Provides the policy userspace library for building policy on the host and is not available on the device. There are no specific updates to support Android except an Android.mk file.

**external/checkpolicy**

Provides the policy build tool. Added support for MacOS X. Not available on the device as policy rebuilds are done in the development environment.

**external/sepolicy**

This is a policy specifically for the core components of Android that looks much like the reference policy, but is contained in one directory that has the policy modules (\*.te files), class / permission files etc.. The policy is built by the Android.mk file and the resulting policy is installed on the target device (as sepolicy) along with its supporting configuration files.

Device specific policy may be defined under the device directory as discussed in the [Processing Device Policy][] section.

The policy can be updated along with its configuration files as discussed in the [Updating Policy][] section.

The policy files are discussed in the [SELinux Policy Files][1.9.1 SELinux Policy Files] section and support tools in [Policy Build Tools][].

The Android specific object classes are described in the [Android Classes and Permissions][1.4 Android Classes and Permissions] section.

The directory also contains the MMAC configuration files.

**packages/apps/SEAdmin**

This is an example Android application to manage the SE for Android environment (such as loading a new policy). Only available on SEAndroid build.

**packages/apps/Settings**

SELinux settings for the settings manager application.

**bionic**

Bionic is the Android libc that is a derived from the BSD standard C library code. It contains enhancements to support security providers such as SELinux.

**bootable/recovery**

Changes to manage file labeling on recovery plus a recovery init.rc file in the etc directory.

**build**

Changes to build SE for Android and manage file labeling on images and OTA (over the air) target files.

**frameworks/base**

JNI - Add SELinux support functions such as isSELinuxEnabled and setFSCreateCon.

SELinux Java class and method definitions.

Checking Zygote connection contexts.

Managing file permissions for the package manager and wallpaper services.

SELinux additions to support run time MMAC and for SEAndroid the additional MMAC services.

**system/core**

SELinux support services for toolbox (e.g. load\_policy, runcon).

SELinux support for system initialisation (e.g. init, init.rc).

SELinux support for auditing avc's (auditd).

**system/extras**

SELinux support for the ext4 file system. Note that the make\_ext4fs utility is used to build these file systems and relies on the file\_contexts file having all the relevant entries, if not, it will be unable to set the security.selinux xattr on the inode and fail.

**kernel**

All Android kernels support the Linux Security Module (LSM) and SELinux services, however they are based on various versions (currently 3.4 for Goldfish used by the emulator), therefore the latest SELinux enhancements may not always be present. The [Kernel LSM / SELinux Support][1.3 Kernel LSM _ SELinux Support] section describes the Andriod kernel changes.

**device**Build information for each device, details regarding SEAndroid supported devices can be found at:

[http://seandroid.bitbucket.org/BuildingKernels.html\#9][http_seandroid.bitbucket.org_BuildingKernels.html_9]

Device specific policy can be added as discussed in the [Building the Policy][1.9 Building the Policy] and [Processing Device Policy][] sections.

## Kernel LSM / SELinux Support ##

The paper "Security Enhanced (SE) Android: Bringing Flexible MAC to Android" available at [http://www.internetsociety.org/sites/default/files/02\_4.pdf][http_www.internetsociety.org_sites_default_files_02_4.pdf] gives a good review of what did and didn't change in the kernel to support Android. This section briefly describes the only major change that was to support the Binder IPC service that consists of the following:

1.  LSM hooks in the binder code (drivers/staging/android/binder.c) and (include/linux/security.h)
2.  Default support for capabilities (security/capability.c) in case no other module is loaded.
3.  Hooks in the LSM security module (security/security.c).
4.  SELinux support for the binder object class and permissions (security/selinux/include/classmap.h) that are shown in the [Android Classes and Permissions][1.4 Android Classes and Permissions] section. Support for these permission checks are added to security/selinux/hooks.c.

## Android Classes and Permissions ##

Additional classes have been added to Android and are listed in the following tables with descriptions of their permissions. The policy files external/sepolicy/security\_classes and external/sepolicy/access\_vectors contain the complete list with descriptions available at: [http://selinuxproject.org/page/NB\_ObjectClassesPermissions][http_selinuxproject.org_page_NB_ObjectClassesPermissions]. However, note that while the security\_classes file contains many entries, not all are required for Android.

<table> 
 <tbody> 
  <tr> 
   <td colspan="2"><strong>binder</strong>&nbsp;class - This is a kernel object to manage the Binder IPC service.</td> 
  </tr> 
  <tr> 
   <td><strong>Permission</strong></td> 
   <td><strong>Description</strong>&nbsp;(4 unique permissions)</td> 
  </tr> 
  <tr> 
   <td>call</td> 
   <td>Perform a binder IPC to a given target process (can A call B?).</td> 
  </tr> 
  <tr> 
   <td>impersonate</td> 
   <td>Perform a binder IPC on behalf of another process (can A impersonate B on an IPC?). <p>Not currently used in policy but kernel (selinux/hooks.c) checks permission in&nbsp;selinux_binder_transaction&nbsp;call.</p> </td> 
  </tr> 
  <tr> 
   <td>set_context_mgr</td> 
   <td>Register self as the Binder Context Manager aka&nbsp;servicemanager&nbsp;(global name service). Can A set the context manager to B, where normally A == B. <p>See policy module&nbsp;servicemanager.te.</p> </td> 
  </tr> 
  <tr> 
   <td>transfer</td> 
   <td>Transfer a binder reference to another process (can A transfer a binder reference to B?).</td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td colspan="2"><strong>property_service</strong>&nbsp;class - This is a userspace object to manage the Android Property Service.&nbsp;See check_mac_perms()&nbsp;in&nbsp;system/core/init/property_service.c</td> 
  </tr> 
  <tr> 
   <td><strong>Permission</strong></td> 
   <td><strong>Description</strong>&nbsp;(1 unique permission)</td> 
  </tr> 
  <tr> 
   <td>set</td> 
   <td>Set a property.</td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td colspan="2"><strong>service_manager</strong>&nbsp;class - This is a userspace object to manage Android services. See&nbsp;check_mac_perms()&nbsp;in&nbsp;frameworks/native/cmds/servicemanager/service_manager.c</td> 
  </tr> 
  <tr> 
   <td><strong>Permission</strong></td> 
   <td><strong>Description</strong>&nbsp;(3 unique permission)</td> 
  </tr> 
  <tr> 
   <td>add</td> 
   <td>Add a service.</td> 
  </tr> 
  <tr> 
   <td>find</td> 
   <td>Find a service.</td> 
  </tr> 
  <tr> 
   <td>list</td> 
   <td>List services.</td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td colspan="2"><strong>keystore_key</strong>&nbsp;class - This is a userspace object to manage the Android keystore (see&nbsp;system/security/keystore/keystore.cpp).</td> 
  </tr> 
  <tr> 
   <td><strong>Permission</strong></td> 
   <td><strong>Description</strong>&nbsp;(16 unique permissions)</td> 
  </tr> 
  <tr> 
   <td>test</td> 
   <td>Test if keystore okay.</td> 
  </tr> 
  <tr> 
   <td>get</td> 
   <td>Get key.</td> 
  </tr> 
  <tr> 
   <td>insert</td> 
   <td>Insert/update key.</td> 
  </tr> 
  <tr> 
   <td>delete</td> 
   <td>Delete key.</td> 
  </tr> 
  <tr> 
   <td>exist</td> 
   <td>Check if key exists.</td> 
  </tr> 
  <tr> 
   <td>saw</td> 
   <td>Search for matching string.</td> 
  </tr> 
  <tr> 
   <td>reset</td> 
   <td>Reset keystore.</td> 
  </tr> 
  <tr> 
   <td>password</td> 
   <td>Generate new keystore password.</td> 
  </tr> 
  <tr> 
   <td>lock</td> 
   <td>Lock keystore.</td> 
  </tr> 
  <tr> 
   <td>unlock</td> 
   <td>Unlock keystore.</td> 
  </tr> 
  <tr> 
   <td>zero</td> 
   <td>Check if keystore empty.</td> 
  </tr> 
  <tr> 
   <td>sign</td> 
   <td>Sign data.</td> 
  </tr> 
  <tr> 
   <td>verify</td> 
   <td>Verify data.</td> 
  </tr> 
  <tr> 
   <td>grant</td> 
   <td>Add or remove access.</td> 
  </tr> 
  <tr> 
   <td>duplicate</td> 
   <td>Duplicate the key.</td> 
  </tr> 
  <tr> 
   <td>clear_uid</td> 
   <td>Clear keys for this uid.</td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td colspan="2"><strong>debuggerd</strong>&nbsp;class - This is a userspace object to allow file dumps (see&nbsp;system/core/debuggerd/debuggerd.cpp).</td> 
  </tr> 
  <tr> 
   <td><strong>Permission</strong></td> 
   <td><strong>Description</strong>&nbsp;(2 unique permissions)</td> 
  </tr> 
  <tr> 
   <td>dump_tombstone</td> 
   <td>Write tombstone file.</td> 
  </tr> 
  <tr> 
   <td>dump_backtrace</td> 
   <td>Write backtrace file.</td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
  <tr> 
   <td colspan="2"><strong>drmservice</strong>&nbsp;class - This is a userspace object to allow finer access control of the Digital Rights Management services (see&nbsp;frameworks/av/drm/drmserver/DrmManagerService.cpp).</td> 
  </tr> 
  <tr> 
   <td><strong>Permission</strong></td> 
   <td><strong>Description</strong>&nbsp;(8 unique permissions)</td> 
  </tr> 
  <tr> 
   <td>consumeRights</td> 
   <td>Consume rights for content.</td> 
  </tr> 
  <tr> 
   <td>setPlaybackStatus</td> 
   <td>Set the playback state.</td> 
  </tr> 
  <tr> 
   <td>openDecryptSession</td> 
   <td>Open the DRM session for the requested DRM plugin.</td> 
  </tr> 
  <tr> 
   <td>closeDecryptSession</td> 
   <td>Close DRM session.</td> 
  </tr> 
  <tr> 
   <td>initializeDecrypSession</td> 
   <td>Initialise the decrypt resources.</td> 
  </tr> 
  <tr> 
   <td>decrypt</td> 
   <td>Decrypt data stream.</td> 
  </tr> 
  <tr> 
   <td>finalizeDecryptUnit</td> 
   <td>Release DRM resources.</td> 
  </tr> 
  <tr> 
   <td>pread</td> 
   <td>Read the data stream.</td> 
  </tr> 
 </tbody> 
</table>

## SELinux Commands ##

A subset of the Linux SELinux commands have been implemented in Android and are listed in Table 1. Some are available as Toolbox commands (see system/core/toolbox) and can be run via adb shell, for example:

adb shell su 0 setenforce permissive

**Table 1: SELinux enabled commands**

<table> 
 <tbody> 
  <tr> 
   <td><strong>Command</strong></td> 
   <td><strong>Comment</strong></td> 
  </tr> 
  <tr> 
   <td>getenforce</td> 
   <td>Returns the current enforcing mode.</td> 
  </tr> 
  <tr> 
   <td>setenforce</td> 
   <td>Modify the SELinux enforcing mode: <pre>setenforce [enforcing|permissive|1|0]
</pre> </td> 
  </tr> 
  <tr> 
   <td>load_policy</td> 
   <td>Load new policy into kernel: <pre>load_policy policy-file
</pre> </td> 
  </tr> 
  <tr> 
   <td>ls</td> 
   <td>Supports&nbsp;-Z&nbsp;option to display security context.</td> 
  </tr> 
  <tr> 
   <td>ps</td> 
   <td>Supports&nbsp;-Z&nbsp;option to display security context.</td> 
  </tr> 
  <tr> 
   <td>restorecon</td> 
   <td>Restore file default security context as defined in the&nbsp;file_contexts&nbsp;or&nbsp;seapp_contexts&nbsp;files. The options are:&nbsp;D&nbsp;- data files,&nbsp;F&nbsp;- Force reset,&nbsp;n&nbsp;- do not change,&nbsp;R/r&nbsp;- Recursive change,&nbsp;v&nbsp;- Show changes. <pre>restorecon [-DFnrRv] pathname
</pre> </td> 
  </tr> 
  <tr> 
   <td>chcon</td> 
   <td>Change security context of file. The options are:&nbsp;h&nbsp;- Change symlinks,&nbsp;R&nbsp;- Recurse into subdirectories,&nbsp;v&nbsp;- Verbose output. <pre>chcon [-hRv] context file...
</pre> </td> 
  </tr> 
  <tr> 
   <td>runcon</td> 
   <td>Run command in specified security context: <pre>runcon context program args...
</pre> </td> 
  </tr> 
  <tr> 
   <td>id</td> 
   <td>If SELinux is enabled then the security context is automatically displayed.</td> 
  </tr> 
  <tr> 
   <td>getsebool</td> 
   <td>Deprecated as policy booleans no longer supported. <p>Returns SELinux boolean value(s):</p> <pre>getsebool [-a | boolean_name]
</pre> </td> 
  </tr> 
  <tr> 
   <td>setsebool</td> 
   <td>Deprecated as policy booleans no longer supported. <p>Set SELinux boolean to a value, does not set the boolean across reboots:</p> <pre>setsebool boolean_name [1|true|on|0|false|off]
</pre> </td> 
  </tr> 
 </tbody> 
</table>

## SELinux Public Methods ##

The public methods implemented are equivalent to libselinux functions and shown in Table 2. They have been taken from frameworks/base/core/java/android/os/SELinux.java.

The SELinux class and its methods are not available in the Android SDK, however if developing SELinux enabled apps within AOSP then Reflection would be used (see the proguard.flags and Android.mk files in packages/apps/SEAdmin).

**Table 2: SELinux class public methods**

<table> 
 <tbody> 
  <tr> 
   <td><strong>boolean isSELinuxEnabled()</strong> <pre>   Determine whether SELinux is enabled or disabled. 
   Return true if SELinux is enabled.
</pre> </td> 
  </tr> 
  <tr> 
   <td><strong>boolean isSELinuxEnforced()</strong> <pre>   Determine whether SELinux is permissive or enforcing.
   Returns true if SELinux is enforcing.
</pre> </td> 
  </tr> 
  <tr> 
   <td><strong>boolean setSELinuxEnforce(boolean value)</strong> <pre>   Set whether SELinux is in permissive or enforcing modes.
   value of true sets SELinux to enforcing mode.
   Returns true if the desired mode was set.
</pre> </td> 
  </tr> 
  <tr> 
   <td><strong>boolean setFSCreateContext(String context)</strong> <pre>   Sets the security context for newly created file objects.
   context is the security context to set.
   Returns true if the operation succeeded.
</pre> </td> 
  </tr> 
  <tr> 
   <td><strong>boolean setFileContext(String path, String context)</strong> <pre>   Change the security context of an existing file object.
   path represents the path of file object to relabel.
   context is the new security context to set .
   Returns true if the operation succeeded.
</pre> </td> 
  </tr> 
  <tr> 
   <td><strong>String getFileContext(String path)</strong> <pre>   Get the security context of a file object.
   path the pathname of the file object.
   Returns the requested security context or null.
</pre> </td> 
  </tr> 
  <tr> 
   <td><strong>String getPeerContext(FileDescriptor fd)</strong> <pre>   Get the security context of a peer socket.
   FileDescriptor is the file descriptor class of the peer socket.
   Returns the peer socket security context or null.
</pre> </td> 
  </tr> 
  <tr> 
   <td><strong>String getContext()</strong> <pre>   Gets the security context of the current process.
   Returns the current process security context or null.
</pre> </td> 
  </tr> 
  <tr> 
   <td><strong>String getPidContext(int pid)</strong> <pre>   Gets the security context of a given process id.
   pid an int representing the process id to check.
   Returns the security context of the given pid or null.
</pre> </td> 
  </tr> 
  <tr> 
   <td>Deprecated as policy booleans no longer supported. <p><strong>String[] getBooleanNames()</strong></p> <pre>   Gets a list of the SELinux boolean names.
   Return an array of strings containing the SELinux boolean names.
</pre> </td> 
  </tr> 
  <tr> 
   <td>Deprecated as policy booleans no longer supported. <p><strong>boolean getBooleanValue(String name)</strong></p> <pre>   Gets the value for the given SELinux boolean name.
   name is the name of the SELinux boolean.
   Returns true or false indicating whether the SELinux boolean is set or not.
</pre> </td> 
  </tr> 
  <tr> 
   <td>Deprecated as policy booleans no longer supported. <p><strong>boolean setBooleanValue(String name, boolean value)</strong></p> <pre>   Sets the value for the given SELinux boolean name. Note that this will be set the boolean permanently across reboots.
   name is the name of the SELinux boolean.
   value is the new value of the SELinux boolean.
   Returns true if the operation succeeded.
</pre> </td> 
  </tr> 
  <tr> 
   <td><strong>boolean checkSELinuxAccess(String scon, String tcon, String tclass, String perm)</strong> <pre>   Check permissions between two security contexts.
   scon is the source or subject security context.
   tcon is the target or object security context.
   tclass is the object security class name.
   perm is the permission name.
   Returns true if permission was granted.
</pre> </td> 
  </tr> 
  <tr> 
   <td><strong>boolean restorecon(String pathname)</strong> <pre>   Restores a file to its default SELinux security context. If the system is not compiled with SELinux, then true is automatically returned. If SELinux is compiled in, but disabled, then true is returned.
   pathname is the pathname of the file to be relabeled.
   Returns true if the relabeling succeeded.
   exception NullPointerException if the pathname is a null object.
</pre> </td> 
  </tr> 
  <tr> 
   <td><strong>boolean restorecon(File file)</strong> <pre>   Restores a file to its default SELinux security context. If the system is not compiled with SELinux, then true is automatically returned. If SELinux is compiled in, but disabled, then true is returned.
   file is the file object representing the path to be relabeled. 
   Returns true if the relabeling succeeded.
   exception NullPointerException if the file is a null object.
</pre> </td> 
  </tr> 
  <tr> 
   <td><strong>boolean restoreconRecursive(File file)</strong> <pre>   Recursively restores all files under the given path to their default SELinux security context. If the system is not compiled with SELinux, then true is automatically returned. If SELinux is compiled in, but disabled, then true is returned.
   pathname is the pathname of the file to be relabeled.
   Returns a boolean indicating whether the relabeling succeeded.
</pre> </td> 
  </tr> 
 </tbody> 
</table>

## Android Init Language SELinux Extensions ##

The Android init process language has been expanded to support SELinux as shown in Table 3. The complete Android init language description is available in the system/core/init/readme.txt file.

**Table 3: SELinux init extensions**

<table> 
 <tbody> 
  <tr> 
   <td><strong>seclabel &lt;securitycontext&gt;</strong> <p>service option: Change to security context before exec'ing this service. Primarily for use by services run from the rootfs, e.g.&nbsp;ueventd,&nbsp;adbd. Services on the system partition can instead use policy defined transitions based on their file security context. If not specified and no transition is defined in policy, defaults to the init context.</p> </td> 
  </tr> 
  <tr> 
   <td><strong>restorecon &lt;path&gt;</strong> <p>action command: Restore the file named by&nbsp;&lt;path&gt;&nbsp;to the security context specified in the&nbsp;file_contexts&nbsp;configuration. Not required for directories created by the&nbsp;init.rc&nbsp;as these are automatically labeled correctly by init.</p> </td> 
  </tr> 
  <tr> 
   <td><strong>restorecon_recursive &lt;path&gt; [ &lt;path&gt; ]*</strong> <p>action command: Recursively restore the directory tree named by&nbsp;&lt;path&gt;&nbsp;to the security context specified in the&nbsp;file_contexts&nbsp;configuration. Do NOT use this with paths leading to shell-writable or app-writable directories, e.g. /data/local/tmp, /data/data or any prefix thereof.</p> <p>See the&nbsp;<a href="http://selinuxproject.org/page/NB_SEforAndroid_1#Checking_File_Labels" rel="nofollow">Checking File Labels</a>&nbsp;section for further details.</p> </td> 
  </tr> 
  <tr> 
   <td><strong>setcon &lt;securitycontext&gt;</strong> <p>action command: Set the current process security context to the specified string. This is typically only used from&nbsp;early-init&nbsp;to set the init context before any other process is started (see&nbsp;init.rc&nbsp;example above).</p> </td> 
  </tr> 
  <tr> 
   <td><strong>setenforce 0|1</strong> <p>action command: Set the SELinux system-wide enforcing status. 0 is permissive (i.e. log but do not deny), 1 is enforcing.</p> </td> 
  </tr> 
  <tr> 
   <td><strong>setsebool &lt;name&gt; &lt;value&gt;</strong> <p>Deprecated as booleans no longer supported.</p> <p>action command: Set SELinux boolean&nbsp;&lt;name&gt;&nbsp;to&nbsp;&lt;value&gt;.</p> <p>&lt;value&gt;&nbsp;may be&nbsp;1|true|on&nbsp;or&nbsp;0|false|off</p> </td> 
  </tr> 
 </tbody> 
</table>

Examples of their usage are shown in the following init.rc file segments:

system/core/rootdir/init.rc
    ...
    
    on early-init
        ...
    
        # Set the security context for the init process.
        # This should occur before anything else (e.g. ueventd) is started.
        setcon u:r:init:s0
    
        # Set the security context of /adb_keys if present.
        restorecon /adb_keys
    
        start ueventd
        ...
    
    on post-fs-data
    ...
        # Reload policy from /data/security if present.
        setprop selinux.reload_policy 1
    
        # Set SELinux security contexts on upgrade or policy update.</nowiki>
        restorecon_recursive /data
        ...
    service ueventd /sbin/ueventd
        class core
        critical
        seclabel u:r:ueventd:s0

## Device Policy File Locations ##

Table 4 shows the Android policy files with their default location when the device is built, and their alternate locations when devices are updated by other methods (such as OTA or via adb). The alternate locations are always checked first as if present they override the default location as discussed in the comments section of Table 4.

The init process will initially load the SELinux set of policy files from root (/). Once the /data partition setup has been completed (see init.rc) a policy reload is performed. This will check whether there is a valid policy at /data/security/current and load that if valid.

If safe mode, then only the root policy files will be loaded. A factory reset will wipe /data and will therefore revert to the original root policy files.

**Table 4: Policy file locations**

<table> 
 <tbody> 
  <tr> 
   <td> <p><strong>Default Location</strong></p> </td> 
   <td> <p><strong>Alternate Location</strong></p> </td> 
   <td> <p><strong>Comments</strong></p> </td> 
  </tr> 
  <tr> 
   <td>/sepolicy <p>/file_contexts&nbsp;/seapp_contexts&nbsp;/property_contexts&nbsp;/service_contexts&nbsp;/selinux_version&nbsp;/mac_permissions.xml</p> </td> 
   <td>/data/security/current</td> 
   <td>Any or all these files may be in the alternate directory as each conponent that requires them will look in the alternate first and then the default, however: 
    <ol> 
     <li>During a policy reload, if there is an&nbsp;selinux_version&nbsp;file in the alternate location, then the default location will be over-ridden. If the policy has been updated via the&nbsp;buildsebundle&nbsp;/ SEAdmin app process then this would be the case.</li> 
     <li>The alternate directory may be a symbolic link to another directory. For example the&nbsp;buildsebundle&nbsp;/ SEAdmin app process adds a link to&nbsp;/data/security/context&nbsp;that holds the policy files</li> 
     <li>If the policy has been updated via the&nbsp;buildsebundle&nbsp;/ SEAdmin app process, then the following will also be present:</li> 
    </ol><p>/data/security/bundle&nbsp;will contain the&nbsp;sepolicy_bundle&nbsp;(the packed files) and a&nbsp;metadata&nbsp;directory containing a&nbsp;version&nbsp;file holding the last version number.</p> <p>There will be&nbsp;*_backup&nbsp;policy files of the previous version that could be restored if required.</p> <p>See the&nbsp;<a href="http://selinuxproject.org/page/NB_SEforAndroid_2#buildsebundle" rel="nofollow">Build Bundle Tools -&nbsp;</a><a href="http://selinuxproject.org/page/NB_SEforAndroid_2#buildsebundle" rel="nofollow">buildsebundle</a>&nbsp;section for a worked example.</p> </td> 
  </tr> 
  <tr> 
   <td>/system/etc/security/eops.xml</td> 
   <td>/data/security/eops</td> 
   <td>If the policy has been updated via the&nbsp;buildeopbundle&nbsp;/ SEAdmin app process, then the following will also be present in the alternative location: 
    <ul> 
     <li>/data/security/eops/eops_metadata/version&nbsp;file holding the last version number.</li> 
    </ul><p>See the&nbsp;<a href="http://selinuxproject.org/page/NB_SEforAndroid_2#buildeopbundle" rel="nofollow">Build Bundle Tools -&nbsp;</a><a href="http://selinuxproject.org/page/NB_SEforAndroid_2#buildeopbundle" rel="nofollow">buildeopbundle</a>&nbsp;section for a worked example.</p> </td> 
  </tr> 
  <tr> 
   <td>/data/system/ifw/ifw.xml</td> 
   <td>/data/secure/system/ifw <p>(default for encrypted systems)</p> </td> 
   <td>This file is not installed by default and note that the Intent Firewall service will read any file from&nbsp;/data/system/ifw/&nbsp;so long as it has an&nbsp;.xml&nbsp;extension. <p>If required would be built and delivered by the&nbsp;buildifwbundle&nbsp;/ SEAdmin app process, with the following also present in the default location:</p> 
    <ul> 
     <li>/data/system/ifw/metadata/gservices.version&nbsp;file holding the last version number.</li> 
    </ul><p>See the&nbsp;<a href="http://selinuxproject.org/page/NB_SEforAndroid_2#buildifwbundle" rel="nofollow">Build Bundle Tools -&nbsp;</a><a href="http://selinuxproject.org/page/NB_SEforAndroid_2#buildifwbundle" rel="nofollow">buildifwbundle</a>&nbsp;section for a worked example.</p> </td> 
  </tr> 
  <tr> 
   <td>/system/etc/sepolicy.recovery</td> 
   <td>none</td> 
   <td>Only used for recovery.</td> 
  </tr> 
 </tbody> 
</table>

## Building the Policy ##

This section covers building of SELinux MAC and Install-time MMAC policies. The file formats of Android specific configuration files are detailed in [Policy Configuration File Formats][] with examples.

### SELinux Policy Files ###

The core policy files are contained in external/sepolicy, with device specific policy in device/<vendor>/<device>/sepolicy[\[1\]][1] (see the [Processing Device Policy][] section). Once generated, the policy and its supporting configuration files will be installed on the device as part of the build process.

Core Policy Files

The following files (along with any device specific policy) are used to build the kernel binary policy file named <tt>sepolicy and installed by default in the root directory.

**access\_vectors**

**security\_classes**

These have been modified to support the new Android classes and permissions (although they still contain the unused Linux userspace items).

**initial\_sids**

**initial\_sids\_contexts**

Contains the system initialisation (before policy is loaded) and failsafe (for objects that would not otherwise have a valid label).

**fs\_use**

**genfs\_contexts**

**port\_contexts**

For flexibility of policy building, these files have been separated to allow additional policy files to be defined for specific devices as discussed below.

**users**

**roles**

These define the only user (u) and role (r) used by the policy.

**mls**

Contains the constraints to be applied to the defined classes and permissions.

**global\_macros**

**mls\_macro**

**te\_marcos**

These contain the m4 macros that expand the policy files to build a policy in the kernel policy language as described in [http://selinuxproject.org/page/PolicyLanguage][http_selinuxproject.org_page_PolicyLanguage]. The policy will then be compiled by **checkpolicy**(8).

**attributes**

Contains the attribute names (forming the [attribute][] statements) that will be used to group [type][] identifiers defined by the policy.

**policy\_capabilities**

Contains the policy capabilities enabled for the kernel policy (see [policycap][] statement).

**\*.te**

The \*.te files are the core policy module definition files. These are the same format as the standard reference policy and are expanded by the m4 macros. There is (generally) one .te file for each domain/service defined containing the policy rules.

Policy Configuration Files

These files (along with any device specific files) will be installed on the device and used to compute security contexts (see the [Checking File Labels][1.9.5.4 Checking File Labels] section for further information).

**file\_contexts**Contains default file contexts for setting the SELinux extended file attributes (**attr**(1)). The format of this file is defined in the [file\_contexts][file_contexts] section. The file is installed by default in the root directory. Android services (such as [restorecon][1.5 SELinux Commands]) will first check for this file at:

/data/security/current/file\_contexts