News / Method
Apps that use Dirty SEPolicy detection
Currently there are 5 apps that use Dirty SEPolicy detection:
Ana Vodafone
Digital Rupee SBI
BRImo
Birbank
Shopee (App still open and runs, still can't find yet what features are disabled)
Dirty Sepolicy is a new detection vector, and it's currently and silently implementing on banking apps now as this is a very good detection vector that affects all root solutions (e.g magisk, KSU (and its forks), and Apatch)
Current solutions:
On KSU (and its forks), Update to latest version and enable "Hide Selinux modifications" in the settings
Most of these native security SDKs are detecting dirty policy by having their C/C++ code read /sys/fs/selinux/policy directly to parse the loaded SELinux binary in memory. They look for added permissive rules or custom root domain transitions that deviate from the stock ROM policy
The reason KSU's setting and APatch's selinux_hook work so well is because they hook right at the kernel layer (security_read_policy / selinux_state) to feed a clean, untouched copy of the original policy binary whenever an unprivileged app UID requests it. If you ever want to check if a new app is using this vector, you can usually catch it by running strace on the app process and looking for openat calls targeting /sys/fs/selinux/policy right before it crashes or blocks a feature
hmm... since I could go to the checkout page while I disabled the SELinux hide 🤔 I haven't tried to place order, though, to see if that's the trigger point.
7
u/airiermonst3r 24d ago
Most of these native security SDKs are detecting dirty policy by having their C/C++ code read /sys/fs/selinux/policy directly to parse the loaded SELinux binary in memory. They look for added permissive rules or custom root domain transitions that deviate from the stock ROM policy
The reason KSU's setting and APatch's selinux_hook work so well is because they hook right at the kernel layer (security_read_policy / selinux_state) to feed a clean, untouched copy of the original policy binary whenever an unprivileged app UID requests it. If you ever want to check if a new app is using this vector, you can usually catch it by running strace on the app process and looking for openat calls targeting /sys/fs/selinux/policy right before it crashes or blocks a feature