News for hackers. Stuff that matters.

A comment on Android libstagefright still exploitable. Parent comment

Re:Android libstagefright still exploitable by semenko on Thursday August 13, 2015 @02:25PM (#10056208)
The isolation seems mostly defined by this SELinux policy: https://github.com/android/platform_system_core/blob/lollipo...

   service media /system/bin/mediaserver
       class main
       user media
       group audio camera inet net_bt net_bt_admin net_bw_acct drmrpc mediadrm
       ioprio rt 4
You'd need another exploit to elevate from SELinux (and I think send MSSes for a self-propagating worm). Though given Android's abysmal patching, most Android kernels are also terribly outdated...
[ Parent | on HN ]
Re:Android libstagefright still exploitable by vezzy-fnord on Thursday August 13, 2015 @02:53PM (#10056388)
That's not an SELinux policy? That's just a service statement for Android's init, defining the process' supplementary groups. There is no explicit seclabel I can deduce.
[ Parent | on HN ]
Re:Android libstagefright still exploitable by semenko on Thursday August 13, 2015 @04:34PM (#10057039)
Whoops, yep -- definitely wasn't that clear. As pointed out below, the policy is linked to: https://android.googlesource.com/platform/external/sepolicy/...
[ Parent | on HN ]
Re:Android libstagefright still exploitable by scintill76 on Thursday August 13, 2015 @02:56PM (#10056406)
The policy is linked. The service definition was probably quoted to show other aspects of its isolation and privileges, but the comment is not written very clearly.
[ Parent | on HN ]
Re:Android libstagefright still exploitable by scintill76 on Thursday August 13, 2015 @02:53PM (#10056391)
I could have sworn I read in the OP a few minutes ago, that mediaserver runs as "system" on some devices, which would probably be worse. I'm not finding it now, so maybe it was edited or I'm mis-remembering.

Anyway, vendor customization diverging from AOSP makes it hard to say.

[ Parent | on HN ]
Re:Android libstagefright still exploitable by pacquiao882 on Thursday August 13, 2015 @03:27PM (#10056617)
You are correct. It runs with system and graphics privileges on many devices. It is a native service started at system init and is automatically restarted if it crashes.
[ Parent | on HN ]