Google provides Android kernel with additional protection

Android developers have taken a number of additional measures to better protect the operating system’s Linux kernel. They do this, among other things, by restricting access to the kernel.

Developer Jeffrey Vander Stoep explains that Android relies on the Linux kernel to enforce security policies. For example, it protects the memory of processes in user space, which is separated from kernel space for security reasons. One of the measures taken is to restrict the kernel’s access to memory in the userspace. This makes attacks more difficult, because it allows attackers to exert less control over kernel memory.

More protection against stack buffer overflows has also been added. In addition, the developers have restricted access to the kernel, thereby reducing the attack surface. They did this, for example, by disabling the performance tool ‘perf’ for users in Android Nougat. However, it is still available to developers. By removing certain code or restricting access to entry points, there are fewer opportunities to attack a system.

For example, many kernel vulnerabilities in Android are said to stem from drivers and can be reached via the ioctl-systemcall. Userland applications can send requests to the kernel via a system call. Through a whitelist, the developers want to limit these calls to only the essential parts for third-party apps.