0

In the most recent versions of Android, SELinux enforcement is enabled in the kernel and is static, but how can this work before a policy has been loaded? Is the policy embedded in the kernel? If not, does that just mean the kernel always enforces whatever policy is loaded (so no policy means nothing to enforce)? If policy needs to be loaded from userspace, then what prevents the policy from being overwritten? Is there a one-way flag that locks the policy that gets set after the policy file has beeb loaded?

2
  • When a ROM is a built then the policy is automatically loaded on the build time
    – DevUt
    Jun 14, 2016 at 5:01
  • As for the enforcement, it depends on the kernel. You can always flash a so-called insecure kernel in order to have SELinux set to Permissive.
    – Grimoire
    Jun 14, 2016 at 12:34

0

You must log in to answer this question.

Browse other questions tagged .