SELINUX BYPASSES

Summary from the TLDR InfoSec newsletter

This in-depth guide to bypassing SELinux on Android devices begins with an overview of how SELinux works and breaks down the relevant sections of the implementation code. It then discusses some bypasses that don't work either for hypervisor blocks or read only memory such as disabling SELinux by setting the enforcing mode to permissive, overwriting the permissive map, AV Cache poisoning, and SELinux initialization overwriting. Two bypasses that do eventually work involve overwriting the SELinux hooks and overwriting the allow_unknown field in the selinux_state.