4

For those of you who don't know, SELinux is a collection of administrative tools on Linux OS'. However, what is it for on android, and what does it do on android? After all, Android is not Linux.

SELinux contributes to part of the Android OS. Its two modes, 'Permissive' and 'enforcing' can have a huge impact on the versatility of Root usage.

  • Related: see my answer to How dangerous is the fact that SELinux is in “Permissive” mode? What should I be wary of?, I try to concretely explain there what is the role of SELinux. – WhiteWinterWolf Aug 7 '16 at 10:24
  • @DanBrown "After all, Android is not Linux" -> I thought Android uses the linux kernel – Abdul Mar 6 '17 at 14:39
  • @Abdul, trust me when I say it's an oh-so-small difference. – Dan Brown Mar 6 '17 at 15:55
  • 1
    @Abdul Nope. Huhhhhh, how to word this..... Alright, so android is open-source, and you are right, it is based on good ol' Linux, but the amount of Closed-source crap Google (and the OEMs) load in to the OS, along with the recovery, the odd bootloader systems, and the active war against root, means that calling it Linux is like doing the same to Chromebooks: technically correct, but wouldn't call it Linux. Funnily enough, IOS is based off an abandoned Linux variant too. Do we call that Linux? Hell no! – Dan Brown Mar 6 '17 at 20:25
  • 1
    @DanBrown Ah understood. – Abdul Mar 6 '17 at 20:27
2

The purpose of SElinux is for security and explained by the Android site:

As part of the Android security model, Android uses SELinux to enforce mandatory access control (MAC) over all processes, even processes running with root/superuser privileges (a.k.a. Linux capabilities). SELinux enhances Android security by confining privileged processes and automating security policy creation.

Then in the background section it goes on to explain the two modes permissive and enforcing are:

SELinux operates on the ethos of default denial. Anything that is not explicitly allowed is denied. SELinux can operate in one of two global modes: permissive mode, in which permission denials are logged but not enforced, and enforcing mode, in which denials are both logged and enforced. SELinux also supports a per-domain permissive mode in which specific domains (processes) can be made permissive while placing the rest of the system in global enforcing mode. A domain is simply a label identifying a process or set of processes in the security policy, where all processes labeled with the same domain are treated identically by the security policy. Per-domain permissive mode enables incremental application of SELinux to an ever-increasing portion of the system. Per-domain permissive mode also enables policy development for new services while keeping the rest of the system enforcing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.