Skip to content

Collect full SELinux policies - #116

Open
besendorf wants to merge 1 commit into
mainfrom
feature/collect-selinux-policies
Open

Collect full SELinux policies#116
besendorf wants to merge 1 commit into
mainfrom
feature/collect-selinux-policies

Conversation

@besendorf

Copy link
Copy Markdown
Collaborator

Summary

  • collect the active SELinux policy and the ODM/vendor precompiled policy candidates
  • retrieve policy data through ADB's sync service so files exposed to adb pull do not depend on shell readability
  • preserve encrypted acquisition guarantees and avoid archiving partial transfers
  • continue collecting remaining SELinux artifacts when an individual status or policy operation fails

Context

Some implants modify the in-memory SELinux policy without disabling enforcement. Capturing both the active policy and the device-image policy candidates provides the artifacts needed to detect those changes in later analysis.

Closes #26

@besendorf
besendorf marked this pull request as ready for review July 26, 2026 16:30
@TheZ3ro

TheZ3ro commented Jul 27, 2026

Copy link
Copy Markdown

are this file readable without root?

I'm trying on an Android16 Emulator and those files have u:object_r:selinuxfs:s0 context and cannot be read from shell context.

@besendorf

Copy link
Copy Markdown
Collaborator Author

Can you try with adb pull instead? The corresponding issue mentioned its accessible with adb pull
#26

@TheZ3ro

TheZ3ro commented Jul 27, 2026

Copy link
Copy Markdown

yup, apparently it's readable through adb pull

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Collect full SELinux policy on Android

2 participants