How Android works
Security
Defence in depth, from the hardware root of trust to your app's sandbox.
8 pages93 min8 interactive12600 words
- 01The security modelAndroid security is not one feature but a set of boundaries, each of which assumes the one outside it has already failed. Read them as rings and the design starts to make sense.beginner11 mininteractive
- 02The app sandboxEvery Android app is a Linux process with its own UID, its own data directory and its own SELinux domain. That single design decision is why installing a stranger's app is a reasonable thing to do.intermediate11 mininteractive
- 03SELinuxLinux has discretionary access control: if you own a file, you decide who else may read it. SELinux adds mandatory access control: a policy written by someone else decides, and even root is subject to it.nerd11 mininteractive
- 04The permissions modelAndroid has 365 documented permissions, four protection levels that matter, three grant mechanisms, and a second permission system most developers never see. Here is how they fit together.intermediate13 mininteractive
- 05Signing and integrityAn APK's signature is not a safety guarantee and not a certificate from a CA. It is an identity claim, and it is the hinge that permission checks, update acceptance and Play App Signing all turn on.nerd12 mininteractive
- 06Keystore and hardware keysKeystore lets an app use a key without ever holding it. The key lives in a TEE or a discrete secure chip, and attestation lets a remote server verify what kind of protection it actually has.nerd12 mininteractive
- 07EncryptionFull-disk encryption protected a phone that was off. File-based encryption protects a phone that is on but locked — which is most of the time, and which is why alarms and incoming calls still work.nerd11 mininteractive
- 08Memory safety and RustMost of Android's worst vulnerabilities were the same bug in different clothes: C or C++ code reading memory it did not own. The response was layered hardening, and then a language change.nerd12 mininteractive
Test yourself
Test yourself: Security
Put these storage states in the order a phone passes through them after a cold boot.
Drag, or use the arrows to reorder.
- 1Credential verified: CE storage available
- 2Direct Boot: DE storage available
- 3Bootloader verifies the images
- 4Powered off