The Android security model: sandbox, permissions, signing and SELinux
You learn, through a security person's eyes, how apps are kept apart, how permission protection levels and special access work, and how APK signing schemes, verified boot and encryption fit in.
Level 201 · 22 lessons · 18 practice labs
Lessons
Isolation
- One UID per app and file ownership
- SELinux on Android: domains and policy
- seccomp and isolated processes
- Multiple users and profiles: user 0, work profile, private space
- Short task: map two apps to their UID and data directory from the package list
The permission model
- Protection levels: normal, dangerous, signature and privileged
- Permission groups and AppOps
- Special access: accessibility, notification access, device admin, draw over apps
- Defining custom permissions and protecting them at signature level
- Scoped storage and media permissions
- Short task: list the apps with special access on the simulated device and mark the unneeded ones
Signing and the chain of trust
- APK signature schemes: v1, v2, v3 and v4
- Key rotation and store-side signing
- Verified boot and the bootloader lock
- File-based encryption and direct boot
- Android Keystore and hardware-backed keys
- Short task: verify an APK's signature scheme and certificate digest with apksigner
Protections added by recent versions
- targetSdk and behaviour changes: the risk of an old target
- Background starts, foreground service types and location limits
- Package visibility and the queries declaration
- Short task: extract the targetSdk of five APKs and flag the outdated ones
Capstone
- Capstone: write a report that documents a device's security posture layer by layer
Practice labs
- Map two apps to their UID and data directory: Find the UID and data directory ownership of two apps from the package list.
- Find the packages that share a UID: Find the packages using a shared UID on the simulated device and say what that means for isolation.
- Find the file with wrong permissions in a data directory: Find the world-readable file in an app's data directory listing and state the correct mode value.
- Read the SELinux domain of a process: Extract the SELinux label of three processes from the process list and say which one runs in an app domain.
- Interpret an SELinux denial in the log: Read the denial line in the given log and explain which domain could not do what to which resource.
- Report the SELinux mode and denial pattern: Confirm the device's SELinux mode, count the denials in an hour of logs by domain and flag the unusual one.
- Sort a permission list by protection level: Classify a ten-permission list into normal, dangerous and signature level.
- Find the weakly protected custom permission: Examine the protection level of the custom permissions in a manifest, find the one left at normal and fix it.
- Compare AppOps with the permission state: Compare an app's granted permissions with its AppOps records and explain the one granted yet blocked at operation level.
- Verify the signature scheme and certificate digest: Use apksigner to extract which schemes an APK is signed with and its certificate digest.
- Verify that an update is signed with the same key: Compare the signer of an app's old and new APKs and say whether the update can install.
- Read a key rotation record: Extract the key lineage from a v3-signed APK and document the chain between the old and new certificates.
- Read the verified boot state: Find the simulated device's boot state colour and bootloader lock from its properties.
- Compare the trust state of three devices: Compare three device exports on boot state, encryption and patch and flag the one unfit for company data.
- Report a device's security posture layer by layer: Audit the isolation, permission, signing, boot and encryption layers of a Yakamoz Telekom field phone and write a two-page report.
- Find an APK's target SDK value: Use aapt2 to extract an APK's target SDK and state which Android version it corresponds to.
- Flag the apps with an outdated target: Tabulate the target SDK of five APKs and flag those below the store threshold.
- List the protections an old target misses: Find which behaviour changes an app five versions behind is exempt from and write what upgrading requires.
About this course
You learn, through a security person's eyes, how apps are kept apart, how permission protection levels and special access work, and how APK signing schemes, verified boot and encryption fit in.
What you will learn
- Isolation
- The permission model
- Signing and the chain of trust
- Protections added by recent versions
- Capstone
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.