DOCSEARCHbyAlgolia
Submit Docs

Dirty Sepolicy

repository·master·Indexed 19 days ago

https://github.com/lsposed/dirtysepolicy

A method for detecting Android SELinux policy modifications (dirty rules) used by root and hooking solutions. It leverages the App Zygote process to perform checks via security:compute_av, security:check_context, and process:setcurrent to identify injected rules or domains that are otherwise restricted in standard user applications.

Tokens
588
Snippets
0
Records
3
Agent score
15%

What's inside dirtysepolicy

  1. How Dirty Sepolicy detection works

    master

    Dirty Sepolicy detection leverages the App Zygote process to identify Android SELinux access rules that have been modified (made "dirty") by root or hooking solutions.

    Because an App Zygote must transition into restricted contexts for isolated services, it inherently possesses the permission to query SELinux access rules via selinux_check_access. This allows the detection to bypass the constraints typically applied to untrusted user applications.

    Since App Zygote and the standard Zygote share code, SELinux permissions must be checked correctly; failing to do so causes the process to crash. This makes the detection extremely difficult to bypass in userspace, as the only way to circumvent it is by modifying the kernel itself.

  2. Troubleshooting App Zygote crashes and timeouts

    master

    If an application experiences crashes or service bind timeouts, it is likely a signal that the App Zygote has crashed because the SELinux check is being blocked by root.

    Android Version Specifics:

    • Before Android 13: selinux_check_access may create an SELinux netlink socket. This file descriptor (fd) will be rejected when forking a new app process, causing the App Zygote to crash.
    • Android 12 and later: App Zygote can mark FDs created during doPreload to prevent this.
    • Legacy Support: For Android versions older than 12, developers should manually close the SELinux netlink socket FD to prevent crashes.

  3. Methods for detecting SELinux policy modifications

    master

    The implementation uses three primary methods to detect the presence of specific SELinux rules or domains injected by root tools:

    1. security:compute_av: Uses the Java API SELinux.checkSELinuxAccess to compute an access vector for a given source, target, and class. This can detect the existence of specific allow rules.
    2. security:check_context: Determines if a context is valid. There is no direct Java API for this; you must manually write to /sys/fs/selinux/context. This detects the existence of specific types or domains.
    3. process:setcurrent: Attempts to set the current process context. There is no direct Java API; you must manually write to /proc/self/attr/current. This detects specific types or domains because the kernel returns EINVAL if the requested context is invalid.

    Note on Error Codes: A distinction is made between EINVAL (invalid context) and EPERM (valid context but process:dyntransition is not allowed).