Android SELinux Internals Part II SELinux Domains, Denials, ...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://8ksec.io/android-selinux-internals-part-ii
• Blog Title: Android SELinux Internals Part II: SELinux Domains, Denials, and Bypass with Root Tools
• Suggested Section: Mobile Pentesting > Android Applications Pentesting > Android SELinux Domains, AVC Analysis, and Live Policy Manipulation

🎯 Content Summary

Overview

This post is a practical guide to Android SELinux internals and post-root policy manipulation, tested by the author on devices through Android 16. It explains how applications receive process domains and data-file labels, how to decode visible and suppressed AVC denials, how file labels and process transitions affect exploit PoCs, and how Magisk, KernelSU, and APatch modify SELinux. The techniques are intended for rooted or engineering research devices and help remove mandato...

🔧 Technical Details

Derive or influence an application's SELinux domain: Android first maps an APK signing certificate to a seinfo value through mac_permissions.xml. Zygote then combines seinfo with the UID class, package name, privileged or ephemeral status, SDK sandbox status, and related selectors. It evaluates seapp_contexts from top to bottom and uses the first match. On a policy-modifiable device, inserting a package-specific rule before the generic untrusted_app catch-all can place an application in a more privileged domain and assign a corresponding data-file type.

Turn AVC messages into exact policy requirements: Read the denied permission set together with scontext, tcontext, and tclass. These fields directly describe the missing source-type-to-target-type access. Monitor dmesg, /proc/kmsg, or Logcat while reproducing th...

🤖 Agent Actions

Implemented the HackTricks update.

Changes

• Added android-selinux-domains-and-policy-manipulation.md covering:
  • Android domain and seinfo assignment
  • AVC and dontaudit analysis
  • chcon, restorecon, genfscon, and runcon
  • Live magiskpolicy manipulation
  • Dedicated exploit-testing domains
  • Fine-grained ioctl xperms
  • KernelSU policy injection
• Added numbered citations to AOSP, Magisk, KernelSU, SETools, and the supplied blog.
• Linked the new page from:
  • src/SUMMARY.md
  • Android pentesting README.md

Validation

• git diff --check passed.
• Internal links, references, citation IDs, and code fences validated.
• All reference URLs returned HTTP 200.
• No forbidden sources were introduced.
• mdbook build could not run because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 1030
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://8ksec.io/android-selinux-internals-part-ii

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting > Android Applications Pentesting > Android SELinux Domains, AVC Analysis, and Live Policy Manipulation".

Repository Maintenance:

• MD Files Formatting: 1030 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0