4

For those of you who don't know, SELinux is a collection of administrative tools on Linux OS'. However, what is it for on android, and what does it do on android? After all, Android is not Linux.

SELinux contributes to part of the Android OS. Its two modes, 'Permissive' and 'enforcing' can have a huge impact on the versatility of Root usage.

7
  • Related: see my answer to How dangerous is the fact that SELinux is in “Permissive” mode? What should I be wary of?, I try to concretely explain there what is the role of SELinux. Aug 7, 2016 at 10:24
  • @DanBrown "After all, Android is not Linux" -> I thought Android uses the linux kernel Mar 6, 2017 at 14:39
  • @Abdul, trust me when I say it's an oh-so-small difference.
    – Dan Brown
    Mar 6, 2017 at 15:55
  • 1
    @Abdul Nope. Huhhhhh, how to word this..... Alright, so android is open-source, and you are right, it is based on good ol' Linux, but the amount of Closed-source crap Google (and the OEMs) load in to the OS, along with the recovery, the odd bootloader systems, and the active war against root, means that calling it Linux is like doing the same to Chromebooks: technically correct, but wouldn't call it Linux. Funnily enough, IOS is based off an abandoned Linux variant too. Do we call that Linux? Hell no!
    – Dan Brown
    Mar 6, 2017 at 20:25
  • 1
    @DanBrown Ah understood. Mar 6, 2017 at 20:27

1 Answer 1

2

The purpose of SElinux is for security and explained by the Android site:

As part of the Android security model, Android uses SELinux to enforce mandatory access control (MAC) over all processes, even processes running with root/superuser privileges (a.k.a. Linux capabilities). SELinux enhances Android security by confining privileged processes and automating security policy creation.

Then in the background section it goes on to explain the two modes permissive and enforcing are:

SELinux operates on the ethos of default denial. Anything that is not explicitly allowed is denied. SELinux can operate in one of two global modes: permissive mode, in which permission denials are logged but not enforced, and enforcing mode, in which denials are both logged and enforced. SELinux also supports a per-domain permissive mode in which specific domains (processes) can be made permissive while placing the rest of the system in global enforcing mode. A domain is simply a label identifying a process or set of processes in the security policy, where all processes labeled with the same domain are treated identically by the security policy. Per-domain permissive mode enables incremental application of SELinux to an ever-increasing portion of the system. Per-domain permissive mode also enables policy development for new services while keeping the rest of the system enforcing.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .