Remember when I said using SELinux permissive is really bad? Here is a privilege escalation PoC where the only requirement is SELinux permissive. If you are still releasing custom ROMs/kernels with permissive, YOU ARE LITERALLY BACKDOORING YOUR USERS!
github.com/vvb2060/Magica
github.com/vvb2060/Magica
In this PoC, when you press install, it will gain (restricted yet still powerful) root access in a service and install Magisk to your boot image. This demo shows that any ARBITRARY app, including malware, can PERMANENTLY root your device without your consent and permission.
Imagine this scenario: you are using a custom kernel that ships with SELinux permissive. You accidentally install a malware using this loophole. The malware installs a modified "malicious Magisk" to permanently gain full root access. BOOM, your device is now #pwned.
Please help spread this information! We should stop the toxic and irresponsible mentality of releasing SELinux permissive ROMs/kernels in this community. You should never, *EVER* switch to permissive unless actually doing development/debugging.
I had shared a longer technical explanation on Reddit: reddit.com/r/Android/comm…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
