alt Hacker NewsEven AOSP has selinux enabled by default with very comprehensive and scoped policies. That, along with app isolation and permission system, already leaves desktop Linux far, far in the dust on security.
Even AOSP has selinux enabled by default with very comprehensive and scoped policies. That, along with app isolation and permission system, already leaves desktop Linux far, far in the dust on security.
It also has many other advantages including the OS and app ecosystem heavily using memory safe languages from the beginning, which has greatly increased over time. The majority of new code added to the OS has been in memory safe languages for years. Android is replacing Java with Kotlin and C++ with Rust but it was always using a lot of Java and moved to using ahead-of-time compilation for it with Android 5. It then moved to a more complex way of compiling it but GrapheneOS has kept using ahead-of-time compilation.
It has much better adoption of modern exploit protections and far better testing with sanitizers for both the kernel and userspace. It enables us to do even better because most of the memory corruption bugs caught by MTE are resolved. We do still need to resolve more, but it would be far more impractical for us to do it on the desktop.
Android uses SELinux for both whole system MAC and MLS policies with deep OS integration. It uses it for a massive amount of kernel attack surface reduction with allowlists for socket protocols, devices, ioctl commands and other functionality. It's far different from the traditional targeted approach used by desktops or even rare use of whole system SELinux for desktops/servers. It's nearly a completely different thing in practice. The OS has it deeply integrated in userspace for enforcement beyond in the kernel and it's developed around it. It's the main basis for the app sandbox and a lot of other isolation in the OS. OS processes are specifically split up and have IPC set up in a way that they can be contained well with it.
The mandatory app sandbox with yearly backwards incompatible privacy and security improvements as part of new target SDK versions is the most important difference. It's the basis for GrapheneOS being able to do much better. Having the infrastructure it already has available means we can add our features such as Contact Scopes, Storage Scopes and our Sensors toggle on top. We plan to add a lot more, but there are also the yearly improvements we get in the baseline such as how Camera, Microphone and Location have supported one-time grants for years, can only be used while apps are in use once granted (with Location have an extra layer of background opt-in) and precise vs. coarse location.