Overhaul SELinux DirtySepolicy Probes and Strengthen Root Detection#7
Closed
juanma0511 wants to merge 5 commits into
Closed
Overhaul SELinux DirtySepolicy Probes and Strengthen Root Detection#7juanma0511 wants to merge 5 commits into
juanma0511 wants to merge 5 commits into
Conversation
…detection - Implemented AppZygote-based SELinux Carrier Service to reduce false positives by querying policy from a restricted context. - Ported expanded DirtySepolicy rules and active `/proc/self/attr/current` write probes from Duck-Detector-Refactoring. - Introduced dual-track validation (Native + Java) for SELinux access checks. - Strengthened KernelSU Next and APatch detections with new paths and magic probes. - Audited and fixed multiple memory/file-handle safety bugs in `native_root_checks.cpp`. - Fixed a conflicting declaration bug in `RootDetector.kt`. Co-authored-by: juanma0511 <121111348+juanma0511@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
…ives - Refined SELinux context existence checks in native code using /sys/fs/selinux/context and /proc/self/attr/current writes, following the LSPosed/DirtySepolicy methodology. - Implemented comprehensive dual-track (Native + Java) policy checks within the isolated AppZygote process to minimize false positives and bypass attempts. - Added sanity checks for 'setcurrent' and 'check_context' to ensure the oracle is reliable before reporting detections. - Ported the full suite of DirtySepolicy rules (Magisk, KernelSU, LSPosed, Xposed, adb_root, ZygiskNext). - Implemented FD leak prevention for Android 11 and below during AppZygote preload. - Audited native C++ code for safety, ensuring all 'read' system call returns are checked and file descriptors are closed correctly. - Enhanced RootDetector to separately surface high-severity DirtySepolicy warnings retrieved from the carrier service. Co-authored-by: juanma0511 <121111348+juanma0511@users.noreply.github.com>
- Fixed `contextExists` logic in `AppZygotePreload` to correctly identify privileged contexts when the kernel returns access-denied errors (non-EINVAL or EPERM). - Removed overly strict sanity checks that were causing early exits on some devices. - Improved AppZygote payload parsing in `RootDetector` to ensure granular native detections are always captured, even if the high-level status is OK. - Verified the build and internal logic consistency. Co-authored-by: juanma0511 <121111348+juanma0511@users.noreply.github.com>
…boration - Refined `contextExists` logic to be highly sensitive to root contexts by interpreting any non-EINVAL response (including EACCES and EPERM) as proof of existence. - Implemented KernelSU BitPair logic (Domain + File) for more granular detection reporting. - Added `checkDangerousAppsCorroboration` using `createPackageContext` and direct `ZipFile` inspection to find hidden root managers. - Expanded DirtySepolicy rule suite to include Magisk filesystem association and Kernel FIFO checks. - Loosened AppZygote sanity checks to ensure detections are not blocked on restrictive OEM builds. - Improved result parsing to ensure both high-level warnings and granular native signals are surfaced. - Added "Glow" kernel to custom kernel detection. - Increased AppZygote service timeout for better reliability on slow devices. Co-authored-by: juanma0511 <121111348+juanma0511@users.noreply.github.com>
- Fixed critical bug in context probing by removing null terminators from raw SELinux filesystem writes, ensuring correct kernel interpretation of privileged contexts. - Stabilized AppZygote by using full class names for preload registration and implementing a robust FD leak workaround for legacy Android versions. - Expanded detection suite with SUSFS context existence checks and additional Magisk/KSU interaction rules. - Improved diagnostic reporting by surfacing the SELinux oracle status and granular native detections in the main process. - Conducted C++ safety audit, fixing multiple resource management and string handling issues. Co-authored-by: juanma0511 <121111348+juanma0511@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR significantly improves the SELinux and root detection capabilities of the project by adopting a more robust, dual-track validation approach.
Key changes include:
AppZygotePreloadandSelinuxCarrierService, allowing the app to query SELinux policy from the highly restrictedapp_zygotecontext. This minimizes false positives caused by the main process's own context or runtime hooks.fsck_untrusted sys_admin,shell -> sutransition, and MSD daemon checks) based on recent developments in the security community (Duck-Detector-Refactoring)./proc/self/attr/currentto detect the materialization of privileged contexts in the live policy.RootDetector.kt.Verified the changes with a full project build and unit tests.
PR created automatically by Jules for task 604517642015077392 started by @juanma0511