5

In UNIX's security model, you log in as a user, and then every process you start can access everything that belongs to your user account - that is, the trust is based on the user account, not on the particular executable.

But on my Android phone, it seems things are slightly different - every app seems to run under its own user account. Is that correct? Or is it that apps made by the same author run under the same user account? Does the author's private signing key give access to the user account?

Also, I read that the Linux kernel was modified to accommodate Android's security model:

In order to get a working Android system, you need the new lock type they have created, as well as hooks in the core system for their security model. In order to write a driver for hardware to work on Android, you need to properly integrate into this new lock, as well as sometimes the bizarre security model.

I'm particularly interested what these kernel changes were, and why are they bizarre?

1 Answer 1

5

Android essentially relies on the Linux Kernel's security theme's for its security model:

  1. User based permissions
  2. Process isolation
  3. Mechanisms for inter-process communication
  4. Modular kernel that can be customized (insecure modules removed/modified)

Bizarre seems like a strong word, but Android definitely went a little extreme by combining process isolation with user based permissions. You're absolutely right, for each app a user is created. It is independent of the author of the program. If there are multiple apps from the same author then each app gets a user created for it. The private data for each app is protected under this user's permissions, and so is the process space. In this way only the app can access its private data, and it's process space can only be accessed by the app.

Apps can talk to each other through IPC, and the main addition to the kernel in this respect is the Binder class. This addition allows a background service to interact with apps, and courier data between processes. When created in this manner it does not live on indefinitely in the background, but is created with a specific purpose and is killed once it's fulfilled.

For more detailed information I'd suggest reading Android Security Overview.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .