Damus
Open in Damus
GrapheneOS · 3w
Android splits SELinux into system and vendor policies. Both of these must conform to the extensive neverallow rules. The vendor policies are defined as part of implementing hardware support for a dev...
 GrapheneOS profile picture
GrapheneOS @GrapheneOS
Android extended SELinux with support for ioctl command allowlists to reduce kernel attack surface. These ioctl command allowlists are used for sockets and many other core kernel devices to limit attack surface. It's also used with drivers in the vendor policies such as GPU ioctl command allowlists.
1
GrapheneOS · 3w
The site for Copy Fail says it impacts every mainstream Linux distribution but that's not really the case. Mainstream mobile Linux is based on AOSP and doesn't have nearly as much kernel attack surface as desktop and server distributions combined with having much more hardening enabled. https://cop...