Linux Security Summit North America 2017

SELinux has provided Android with a mandatory access control (MAC) system that has enabled a centralized representation of Android's security model that covers every part of the system. In Android O, project treble (https://android-developers.googleblog.com/2017/05/here-comes-treble-modular-base-for.html) presented a fundamental re-architecting of Android by separating the ownership of the core Android framework from vendor hardware implementation to enable independent updates.

This talk discusses changes to Android's SELinux infrastructure and policy maintenance to allow for such policy modularization. This includes the creation of an SELinux API and versioning scheme, the incorporation of CIL, and move to on-device policy creation, in addition to policy changes for the release.