Android SELinux: binder & socket

Introduction of binder

Inter Process Communication (IPC) has been a part of Android since 1.0, and yet most of us take it for granted.

While processes cannot directly invoke operations (or read/write data) on other processes, the kernel can, so they make use of the Binder driver. Binder driver is exposed via /dev/binder and offers a relatively simple API based on open, release, poll,mmap, flush, and ioctl operations.

Security Mechanism of binder

Malicious applications can make use of binder mechanism to get unauthorized data, SEforAndroid implements security control to check the permissions. The details are as following:

1. Declare a class for kernel policy in external/sepolicy/access_vectors

class binder

{

    impersonate

    call

    set_context_mgr

    transfer

    receive

}

Impersonate：該 process 是否可以代表另一process使用binder.  kernel (selinux/hooks.c) checks permission in selinux_binder_transaction call.
Call：Perform a binder IPC to a given target process (can A call B?).
Set_context_mgr：是否可以将自己註册成Context Manager. Can A set the context manager to B, where normally A == B.See policy module servicemanager.te.
Transfer：是否可以傳遞某類型的binder引用到其他process. Transfer a binder reference to another process (can A transfer a binder reference to B?).
Receive：是否可以接收某類型binder引用.

2. TE中使用 macro 進行配置 binder_use、binder_call、binder_transfer、binder_service

Ex:

# binder_call(clientdomain, serverdomain)

# Allow clientdomain to perform binder IPC to serverdomain.

define(`binder_call', `

# First we receive a Binder ref to the server, then we call it.

allow $1 $2:binder { receive call };

# Receive and use open files from the server.

allow $1 $2:fd use;')

例如servicemanager：

allow servicemanager self:binder set_context_mgr;

allow servicemanager domain:binder { receive transfer };

配置表示了servicemanager可以将自己设置为context manager，并且它可以对所有domain执行receive和transfer的操作。

3. 於 source code中增加相關的操作函數

Ex. kernel/goldfish/security/selinux/hooks.c defines four functions

.binder_set_context_mgr =selinux_binder_set_context_mgr,

.binder_transaction =              selinux_binder_transaction,

.binder_transfer_binder =selinux_binder_transfer_binder,

.binder_transfer_file =            selinux_binder_transfer_file,

首先看一下第一个函数，其的实现原理就是去AVC中查询当前的sid是否设置了context_mgr的权限，如果未经授权，则禁止此次操作。

static int selinux_binder_set_context_mgr(struct task_struct *mgr)

{

         u32 mysid = current_sid();

         u32 mgrsid = task_sid(mgr);

         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER, BINDER__SET_CONTEXT_MGR, NULL);

}

对于transaction的控制也是类似，在binder_transaction中增加hook，用来检查本次调用的权限，其中也是同样在AVC中查询权限。

static void binder_transaction(struct binder_proc *proc,

                                 struct binder_thread *thread,

                                 struct binder_transaction_data *tr, int reply)

……

                 if (security_binder_transaction(proc->tsk, target_proc->tsk) < 0) {

                          return_error = BR_FAILED_REPLY;

                          goto err_invalid_target_handle;

                 }

……

static int selinux_binder_transaction(struct task_struct *from, struct task_struct *to)

{

         u32 mysid = current_sid();

         u32 fromsid = task_sid(from);

         u32 tosid = task_sid(to);

         int rc;

         if (mysid != fromsid) {

                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER, BINDER__IMPERSONATE, NULL);

                 if (rc)

                          return rc;

         }

         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL, NULL);

}

socket

在SEAndroid中service sockets的權限同樣受到管理。Init process 在創建service附属socket的同時，根據 file_contexts 查詢當前socket的權限，並將信息加入到socket的security context中，啟動後的權限如下所示：

srw------- system   system            u:object_r:installd_socket:s0 installd

srw-rw-rw- root     root              u:object_r:keystore_socket:s0 keystore

srw-rw---- root     system            u:object_r:netd_socket:s0 netd

srw-rw-rw- root     root              u:object_r:property_socket:s0 property_service

srw-rw---- root     radio             u:object_r:rild_socket:s0 rild

……

关于socket使用权限的配置可以简单的使用两个 macro 定義 unix_socket_connect、unix_socket_send，他们分别对应着 TCP 和 UDP 类型的socket访问。

# unix_socket_connect(clientdomain, socket, serverdomain)

# Allow a local socket connection from clientdomain via

# socket to serverdomain.

define(`unix_socket_connect', `

allow $1 $2_socket:sock_file write;

allow $1 $3:unix_stream_socket connectto;

')

对于规则的配置只需如下，他表示了adbd domain的subject可以通过vold_socket类型的socket访问vold的domain。

unix_socket_connect(adbd, vold, vold)

reference:

http://www.iteye.com/topic/1129994