This post aims at giving an overview of what SELinux is, how it is implemented, and how to bypass it, from the point of view of Android kernel exploitation. Tests were performed on three devices: a Samsung Galaxy A34, a Huawei Mate 20 Pro, and a Xiaomi Redmi Note 12. We will focus mainly on the first two, because they have a hypervisor that will make privilege escalation and bypassing SELinux ...
Last month Blue Frost Security published two exploitation challenges for Ekoparty 2022. One of them was a Linux kernel challenge. I don’t have much experience with Linux kernel exploitation, so this was a good opportunity to practise. I also write this up as a reference for my future self. Let’s start! Setup We are given the source code of a Linux Kernel Module. We are told it’s an IPC driver...