Linux Kernel Defenses added to Nougat

Friday, July 29, 2016 @ 02:07 PM gHale


Android Nougat will include more security features from the Linux kernel, Google said.

While for some that may not sound correct, but in reality, the Android operating system is a modified version of the Linux kernel. It’s a stand-alone OS that emanates from the Linux kernel.

RELATED STORIES
Android FDE Vulnerability Patched
Google makes 108 Fixes for Android
Android Keyboard App Collects Info
Malware Strikes Android App

Android 7.0 Nougat introduces changes to the operating system and its development platform, including the ability to display multiple apps on-screen at once in a split-screen view, support for inline replies to notifications, as well as an OpenJDK-based Java environment and support for the Vulkan graphics rendering API, and “seamless” system updates on supported devices.

With the new release, there is no reason for Google engineers to ignore the work by thousands of coders into the Linux kernel’s security features, especially when Android has become a target for hackers and nation states alike.

The first security features that ended up in the Android OS ended up introduced in Android 4.3, via the SEAndroid (Security Enhancements for Android) component, a re-write of the SELinux project.

Google’s Android team added in security features to Android, inspired by similar work put into the Linux kernel project.

Part of the features added to boost memory protection, Google’s Jeff Vander Stoep discussed two new configuration options called CONFIG_DEBUG_RODATA and CONFIG_CPU_SW_DOMAIN_PAN.

The first can allow developers to control what memory segments are writeable and executable. By limiting how much of the memory apps and features can access and interact with, developers also limit the memory available to attackers when they manage to compromise that app or feature. This feature has been backported to Android 3.18 and will be available to older devices.

The second option limits if and how much of the userspace memory the kernel can access. Since exploits tend to leverage the userspace memory first and wait for functions with kernel level to access that space, this narrows down the attack surface and reduces the probability of malicious code reaching the kernel, leading to total device compromise. This feature too has been backported down to Android 4.1.

To reduce the overall Android kernel attack surface, Google engineers did three things.

First, they cut off default access to the kernel’s debug feature, then they made the seccomp component (sandboxing-related system) a requirement, and they also restricted app access to IOCTL commands.

Android 7.0 Nougat will release this fall. Google has made security hardening a priority for the Nougat release.