Does Android's implementation of SELinux's MAC inhibit apps with root privileges from accessing other app's data?

Question

Starting with Android 4.4, SELinux's MAC is enforced. Does this mean that if an app somehow can get installed and exploit the kernel to get root privileges, that MAC will still prevent that app with root privileges from accessing private app data?

Android Documentation says,

SELinux can be used to label these devices so the process assigned the root privilege can write to only those specified in the associated policy. In this way, the process cannot overwrite data and system settings outside of the specific raw block device.

As a reference, I am implementing a Mobile Device Management system and in the process I have to determine how secure Android OS is itself. That is why I need to know how secure corporate data stored on a device is to rootkits, spyware, and other malware.

P.S. This was posted on the 'Unix & Linux' site but no one has been able to answer it, and I was suggested by one of their users to ask this community, any help is much appreciated. Thank you.

Answer 1

For future visitors' reference, it depends on the SELinux context of the root process. In DAC UID 0 is the super user which can access any resource on the device allowed by kernel. MAC (SELinux in our case) is denied by-default i.e. no process can access anything unless a policy rule is defined to allow the access.

So there is no super context in SELinux but it's possible to define one. That's what rooting apps do since Lollipop. Magisk, for instance, defines u:r:magisk:s0 with unrestricted access to any other context. Any process running with UID 0 and u:r:magisk:s0 would be able to access everything on device including other apps' data.

It depends on the exploit with what context it's able to run a process. With SELinux enforced, it's very hard to inject something to policy.

For details see:

• What sepolicy context will allow any other context to access it?
• How Magisk works?