Seccomp filter in Android O

Posted by Paul Lawrence, Android Security Engineer


In Android-powered devices, the kernel does the heavy lifting to enforce the
Android security model. As the security team has worked to harden Android's
userspace and isolate and deprivilege processes, the kernel has become the focus
of more security attacks. System calls are a common way for attackers to target
the kernel.


All Android software communicates with the Linux kernel using system calls, or
syscalls for short. The kernel provides many device- and SOC-specific syscalls
that allow userspace processes, including apps, to directly interact with the
kernel. All apps rely on this mechanism to access collections of behavior
indexed by unique system calls, such as opening a file or sending a Binder
message. However, many of these syscalls are not used or officially supported by
Android.


Android O takes advantage of a Linux feature called