Hacker News Reader

Comment by pjmlp | Hacker News Reader

Well, Android has it always turned on for several years now.

Mobile applications require various permissions which can be enforced via SELinux.

SELinux policy can also be written to mitigate many vulnerabilities and vulnerability classes/vectors. Over 40% [1] of Android users may no longer be receiving important security updates, potentially putting them at risk of malware, data loss and cyber attacks.

Seems to make sense to have it enabled on Android based on the above.

[1] https://www.which.co.uk/news/2020/03/more-than-one-billion-a...

Another reasons it is turned on, alongside seccomp, is to make sure app developers don't mistake Android for Linux, something that Termux guys aren't very found of.

https://android-developers.googleblog.com/2016/06/android-ch...

https://android-developers.googleblog.com/2017/07/seccomp-fi...

> Mobile applications require various permissions which can be enforced via SELinux.

What do you mean by this? SELinux can only deny things that would otherwise be allowed; it can never allow required permissions that would otherwise be denied.

Android's systems are developed alongside those policies, though. Things like lighttpd don't ship selinux policies, and bolting it on later is fragile.

Yep, building and investigating an AOSP firmware is the best way to learn how SELinux works and how it can be configured.

https://source.android.com/security/selinux/build

Reply on news.ycombinator.com