Starting with Android 4.4, SELinux's MAC is enforced. Does this mean that if an app somehow can get installed and exploit the kernel to get root privileges, that MAC will still prevent that app with root privileges from accessing private app data?

Android Documentation says,

SELinux can be used to label these devices so the process assigned the root privilege can write to only those specified in the associated policy. In this way, the process cannot overwrite data and system settings outside of the specific raw block device.

As a reference, I am implementing a Mobile Device Management system and in the process I have to determine how secure Android OS is itself. That is why I need to know how secure corporate data stored on a device is to rootkits, spyware, and other malware.

P.S. This was posted on the 'Unix & Linux' site but no one has been able to answer it, and I was suggested by one of their users to ask this community, any help is much appreciated. Thank you.

  • I can and probably it does in some way. It depends which SELinux domain the attacker has access to, and what's the SELinux policy for interfacing that (exploited) domain to target app domain.
    – domen
    Jul 16, 2014 at 13:25
  • Get /sepolicy (or /data/security/sepolicy) from the phone, and use sesearch (or some similar tool) to inspect the policy.
    – domen
    Jul 16, 2014 at 13:27

1 Answer 1


For future visitors' reference, it depends on the SELinux context of the root process. In DAC UID 0 is the super user which can access any resource on the device allowed by kernel. MAC (SELinux in our case) is denied by-default i.e. no process can access anything unless a policy rule is defined to allow the access.

So there is no super context in SELinux but it's possible to define one. That's what rooting apps do since Lollipop. Magisk, for instance, defines u:r:magisk:s0 with unrestricted access to any other context. Any process running with UID 0 and u:r:magisk:s0 would be able to access everything on device including other apps' data.

It depends on the exploit with what context it's able to run a process. With SELinux enforced, it's very hard to inject something to policy.

For details see:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .