BigMAC

Extract, process, and query Android security policies from Android firmware. BigMAC is a Python tool that helps analysts understand DAC, MAC (SELinux), and capabilities (CAP) on Android devices. It provides a framework for recovering security policies from firmware images, allowing for scalable policy extraction, and for interactive querying using Prolog. This was released at USENIX Security'20.

Installation

Clone the main repository:

git clone https://github.com/FICS/BigMAC

Make a Python 3 virtual environment:

cd BigMAC/
virtualenv -p python3 venv

Activate the virtual environment (do this for each terminal):

source venv/bin/activate

Your prompt will now look like:

(venv) $

Install sefcontext-parser (it's not on pip):

git clone https://github.com/jakev/sefcontext-parser
cd sefcontext-parser
python setup.py install

Install swi-prolog (8.0.X and above is needed):

sudo apt-add-repository ppa:swi-prolog/stable
sudo apt-get update
sudo apt-get install swi-prolog

Install libsepol (a different version than distros have is needed):

git clone --branch libsepol-2.7 https://github.com/SELinuxProject/selinux.git

Install the required build dependencies:

sudo apt install build-essential flex bison swig python-dev graphviz libgraphviz-dev pkg-config libaudit-dev

Apply the selinux.patch below to selinux to make sure that it will be buildable. Apply the patch like this:

$ cd selinux
$ patch -p1 < ../selinux.patch

Build a specific libsepol to be able to parse Android sepolicy files:

make -j # this may not completely build. as long as sepol is built, continue to install step
sudo make install # you MUST install before building setools

Get setools for use in Python:

git clone https://github.com/TresysTechnology/setools.git
cd setools
git checkout 856b56accba14 # required to match with libsepol version

Apply the setools.patch below to setools to make sure that it will be buildable. Apply the patch like this:

$ cd setools
$ patch -p1 < ../setools.patch
patching file setup.py

Build and install setools. Make sure the SEPOL_SRC points to the correct path:

SEPOL_SRC=$(pwd)/../selinux/libsepol/ python3 setup.py build_ext build_py install

Go back to the main BigMAC directory and install all pip requirements:

BigMAC/ $ pip install -r requirements.txt

Try running the process.py main file:

$ ./process.py
BigMAC Android Policy Processor
 by Grant Hernandez (https://hernan.de/z)
usage: process.py [-h] --vendor VENDOR [--debug] [--debug-init] [--skip-boot]
                  [--draw-graph] [--focus-set FOCUS_SET] [--save] [--load]
                  [--save-policy] [--list-objects] [--dont-expand-objects]
                  [--prolog]
                  policy_name
process.py: error: the following arguments are required: --vendor, policy_name

If you see the usage, all imports are correctly installed. Now move on to the next section to get started.

Basic Usage

Policy Processing

Extract out the eval/eval-policy.tar.gz file included in the repo for some example policies. For extracting your own from firmware we are working to stream line this process. See the tools/ for more information.

To start, process a single image from a vendor and print out the log, but don't save anything. Use this to sanity check your saved policies and policy processing code.

./process.py --vendor aosp policy/aosp/sailfish-ppr2.181005.003.a1-factory-dec6298c
./process.py --vendor aosp sailfish-ppr2.181005.003.a1-factory-dec6298c # equivalent to above

The saved policies directory is set in the config.py file.

If you want to process a policy an interact with the final results using IPython, add the --debug flag.

./process.py --debug --vendor aosp sailfish-ppr2.181005.003.a1-factory-dec6298c
...
In [0]: inst
Out[0]: <overlay.SEPolicyInst at 0x7ff0a8fd2d30>

Try viewing and playing with inst.processes, inst.subjects, and inst.objects!

Processing the entire policy into a graph takes time. The final results can be saved and loaded to speed things up.

./process.py --vendor aosp sailfish-ppr2.181005.003.a1-factory-dec6298c --save
./process.py --vendor aosp sailfish-ppr2.181005.003.a1-factory-dec6298c --load --debug # you can load from now on

The saved database will be under the firmware specific policy directory under the db/ sub directory.

To run prolog queries against the policy, add the --prolog command. The first time you do this, you will need to compile the prolog helpers.

./process.py --vendor aosp sailfish-ppr2.181005.003.a1-factory-dec6298c --load --prolog
query>

Prolog mode will fully instantiate the graph and emit Prolog facts and binaries. The facts from the last run will be stored in the current directory under facts.pl. This is compiled together with helper functions that will enable you to query against a static binary of facts, greatly speeding up queries. These binaries are stored in the db/ sub directory of the firmware and can be run manually if you wish.