Analysis of Access Control Framework of Android

Transcription

1 Analysis of Access Control Framework of Android Jawad Manzoor Erisa Dervishi Sari Setianingsih EMDC January-2011

2 Table of Contents 1. Introduction Motivation Goals Android Architecture Application Components Dalvik Virtual Machine Architecture of Dalvik VM Dalvik Byte Code Dalvik optimizations Comparison of Dalvik VM with Java VM Size Comparison of Dex & Jar Files Security Architecture Permissions Permission class AndroidManifest.xml file Permission Enforcement Source Code Analysis Debugging Logging PackageManagerService class Conclusions References... 14

3 1. Introduction Android is the first comprehensive open source mobile software stack introduced in the market by Open Handset Alliance (OHA - A global alliance of leading technology and mobile industries)[1]. It consists of complete mobile operating system supported by Linux kernel, a newly built Dalvik virtual machine, and some modern day mobile applications. Its is targeted at smart phones and ported to many net books and recently on x86 architecture too. 2. Motivation Android is widely adopted by both the end users and the developer community. This adoption has led to the creation of a large number of third party applications. Developers post their applications on Android Market but there is no dedicated team to analyze the application code uploaded to Android Market and decide its trustworthiness. There is a threat of intrusion by malicious applications, worms and viruses. Figure 1 shows the worldwide Operating System share according to AdMob Mobile Metrics Report and figure 2 shows the share for United States. We can clearly see that Android is constantly going up and other operating systems are going down in the graph. Figure 1 - AdMob Mobile Metrics Report, May 2010

4 Figure 2 - Nielsen Report, June Goals Get hands on experience with Android framework. To study and analyze access control mechanism of Android How applications access system resources? What are the vulnerabilities? Find limitations in Android regarding its access control mechanism. 4. Android Architecture Android system architecture is composed of four layers. Mobile applications are on upper most layer, underneath that the second layer contains the application framework. The application framework is a built-in toolkit, which provides set of services to the Android developers in order to build innovative and efficient Android applications. The third layer provides the C/C++ native libraries and Android Runtime (which further consists of two modules, Dalvik virtual machine and Android core libraries). The last layer is Linux kernel that manages low level resources; such as memory management, power management, hardware drivers, process management, etc.

5 Applications Browser Dialer Camera..... Application Framework SMS Manager Location Manager Telephony Manager Package Manager Connectivity Manager... Android Runtime Libraries Core Libraries Dalvik Virtual Machine Webkit.. SSL SQLite.. OpenGL FreeType.. Linux Kernel Display Driver WiFi Driver Binder (IPC) Driver Power Management..... Figure 3: Android architecture 5. Application Components Activities: An activity presents a visual user interface with which the user can interact. It is implemented as a subclass of the Activity base class. Services: A service doesn't have a visual user interface, but rather runs in the background for an indefinite period of time. Broadcast receivers: A broadcast receiver is a component that does nothing but receive and react to broadcast announcements. Content providers: A content provider makes a specific set of the application's data available to other applications. The data can be stored in the file system or SQLite database. 6. Dalvik Virtual Machine All mobile systems features little RAM, low performance CPU, slow internal flash memory, and limited battery power. Therefore, a need was felt for a VM that could provide better performance with limited resources. So came Dalvik [2], designed to run on Linux kernel, which provides process threading, pre-processing for faster application execution, User ID

6 based security procedures and inter-process communication. Dalvik is a virtual machine that is designed specifically for the Android platform. Unlike most of virtual machines that are stack based[4], Dalvik architecture is register based[4]. It is optimized to use less space. The interpreter is simplified for faster execution. 5.1 Architecture of Dalvik VM Dalvik is a register based architecture making it faster and performance efficient for running application code. It has to operate on Dalvik byte code rather than Java byte code. The supported functionalities are: Dalvik execution file format. Dalvik instruction set J2ME CLDC API Multi-threading. The supported libraries in Dalvik include: 1. dalvik/libcore (written in C/C++) 2. dalvik/vm/native (written in C/C++) 3. OpenSSL (for encryption) 4. zlib (free, general-purpose, data-compression library) 5. ICU (for character encoding) 6. java packages (including java.nio, java.lang, java.util) 7. Apache Harmony classlib (including Apache HttpClient) 5.2 Dalvik Byte Code Dalvik operates on its own form of byte-code known as Dalvik byte code. This byte code is created from the Java byte code with the help of dx tool and stored in.dex file. Reason for using its own byte is obvious. It prepares its byte code for optimal performance before it is executed. 5.3 Dalvik optimizations To overcome memory limitations, system overhead, redundancy, and similar issues Dalvik performs several optimizations. To minimize the system memory usage, dex files are mapped read-only (for security purpose), and also sharing is allowed between processes. This avoids unnecessary repetition of data, and reduces memory usage. It also aggregates multiple classes into single dex file to avoid redundancy. This saves a lot of memory for the system. For reducing overhead to the system the byte code is optimized by ordering the byte-code and word alignment adjustment, before launching an application. Dalvik is therefore optimized for running many concurrent instances even in the limited memory of a mobile phone [5]. Byte-code verification is a slow process, so Dalvik makes processing fast by performing pre-verification of this byte code[6]. 5.4 Comparison of Dalvik VM with Java VM The following table depicts different aspects of both VMs.

7 Criteria Dalvik JVM Architecture Register-based Stack-based OS Support Android All Reverse Engineering-tools A few(dexdump,ddx) Many (jad, bcel,_ndbugs,...) Executables DEX JAR Constant-Pool Per application Per class Table 1: Different Aspects of both the VM's [7] 5.5 Size Comparison of Dex & Jar Files From this table it is evident that even the uncompressed dex fie is taking less space than the compressed jar file. Contents Uncompressed jar file Compressed jar files Uncompressed dex file In Bytes In % In Bytes In % In Bytes In % Common System Libraries Web browser Application Alarm Check Application Table 2: Size Comparison between Jar & Dex files [8]. 7. Security Architecture Android is a multi-process system, in which each application runs in its own process. Most security between applications and the system is enforced at the process level through standard Linux facilities, such as user and group IDs that are assigned to applications. Each Android package (.apk) file installed on the device is given its own unique Linux user ID which remains constant for the duration of its life on that device. 7.1 Permissions Every application needs to access some system services in order to perform its actions. In order to access any system service/resource the application must have the appropriate permission. For example:

8 Send SMS, take pictures from the camera, make calls, access Internet 7.2 Permission class Manisfest.Premission class has a list of all permissions that may be needed by an application. public static final class Manifest.permission extends Object java.lang.object android.manifest.permission Some of the common permissions are shown below: READ_CONTACTS Allows an application to read the user's contacts data. WRITE_CONTACTS READ_SMS SEND_SMS ACCESS_FINE_LOCATION ACCESS_COARSE_LOCATION INTERNET CALL_PHONE Allows an application to write (but not read) the user's contacts data Allows an application to read SMS messages Allows an application to send SMS messages. Allows an application to access fine (e.g., GPS) location Allows an application to access coarse (e.g., Cell-ID, WiFi) location Allows applications to open network sockets. Allows an application to initiate a phone call Table 3: List of permissions in Android 7.3 AndroidManifest.xml file The permissions are declared by the application developer in the manifest file AndroidManifest.xml. This file is packaged along the executable of the application. In the uses-permission tag of this file, we specify one by one all the permissions that are required by our application in order to perform its functionalities. The format of the xml file is shown below:

9 <manifest xmlns:android=" package="com.android.app.myapp" > <uses-permission android:name="android.permission.internet" /> </manifest> 7.4 Permission Enforcement Permission Enforcement is done in two steps. First is the install time permission allocation. Permissions requested by application are presented to the user grouped together in categories. The user must allow all permissions or deny to abort installation. Second step is the runtime permission checking. When a user starts using an application, during execution the application requires different permissions. At runtime the system checks if this application was allocated the requested permission during installation. A particular permission may be enforced at a number of places during your program's operation. For Example At the time of a call into the system, to prevent an application from executing certain functions. On starting an activity, to prevent applications from launching activities of other applications. When accessing and operating on a content provider. 8. Source Code Analysis The source code of Android project was downloaded and was configured with eclipse IDE using the following steps: Step 1: Set up source development environment $ sudo apt-get install git-core gnupg sun-java5-jdk flex bison gperf libsdl-dev libesd0-dev libwxgtk2.6-dev build-essential zip curl libncurses5-dev zlib1g-dev Step 2: Initializing a Repo client Create an empty directory to hold your working files: $ mkdir mydroid $ cd mydroid Run repo init to bring down the latest version of Repo. $ repo init -u git://android.git.kernel.org/platform/manifest.git

10 Step 3: Getting the files To pull down files to your working directory from the repositories as specified in the default manifest, run Step 4: Download and install the SDK starter package Step 5: Install the ADT Plugin for Eclipse Debugging After setting up the environment the code was debugged tracing the call hierarchy and type hierarchy of methods and classes. This helped in finding out the places from where a method is called. This technique is shown in the figure below: Figure 4- Debugging techniques

11 8.2 Logging Logging was also used to identify the classes involved in the access control functionality of Android. We used Android Debug Bridge (adb) tool for this purpose which is a versatile tool which facilitates managing the state of an emulator instance or Android-powered device. Adb provides an ash shell that can be used to run a variety of commands on an emulator or device. Logs were monitored using the following commands: Run the emulator: $. build/envsetup.sh $ lunch 1 $ emulator Get the logs: $. build/envsetup.sh $ lunch 1 $ adb logcat > android.log View logs: $ tail -f android.log With this technique we can execute different application on the emulator and see the logs for that at runtime in the console. This shown in the figure below: Figure5 Logging technique

12 8.2 PackageManagerService class Using the debug and log techniques we identified that Android framework revolves around checking the permission at runtime for all applications at a single end point which is PackageManagerService class. checkpermission() method of ApplicationContext class receives requests from applications. It forwards the request to ActivityManagerService class. If the requesting process is root i-e has uid 1000, the permission is granted to it at this point. If the requesting process is not root or system server but a normal application, the request is forwarded to PackageManagerService class. checkuidpermission() method of PackageManagerService class receives the requested permission, user id and process id of the calling application. The requested permission is searched in the grantedpermissions HashSet.If found, the permission is granted to the application. Otherwise it is denied. This mechanism is shown in the following figure 6. The source code of checkuidpermission method of PackageManagerService class is shown below: public int checkuidpermission(string permname, int uid) { } synchronized (mpackages) { Object obj = msettings.getuseridlp(uid); if (obj!= null) { if (obj instanceof SharedUserSetting) { SharedUserSetting sus = (SharedUserSetting)obj; if (sus.grantedpermissions.contains(permname)) { } return PackageManager.PERMISSION_GRANTED; } else if (obj instanceof PackageSetting) { } } } PackageSetting ps = (PackageSetting)obj; if (ps.grantedpermissions.contains(permname)) { } returnpackagemanager.permission_granted; return PackageManager.PERMISSION_DENIED;

13 Figure 6 Access control flow diagram

14 Conclusions We conclude the following points from the analysis of android framework: Dalvik virtual machine is designed specifically for the Android platform for efficient resource usage Security in Android is enforced using unique UID for each application Specific set of permissions are associated with each UID At install time permissions are assigned to application At runtime permission checking is done whenever an application requests access to a resource PackageManagerService class is responsible for permission management References [1] Homepage: Android. Available at: [2] Homepage: Dalvik Virtual Machine. Available at: [3]Ryan Slobojan. Dalvik, android's virtual machine, generates significant debate. Available at: [4] J.E. Smith and R. Nair. Virtual machines: versatile platforms for systems and processes. Morgan Kaufmann Pub, [5] T. Suganuma, T. Ogasawara, M. Takeuchi, T. Yasue, M. Kawahito, K. Ishizaki, H. Komatsu, and T. Nakatani. Overview of the IBM Java just-in-time compiler. IBM Systems Journal, 39(1):175_193, [6] Jeff Wilcox. Android performance 2: Loop speed and the dalvik vm. Available at: [7] Marc Schonefeld. Reconstructing dalvik applications. Available at: [8] Dan Bornstein. Dalvik virtual machine: Internals. Available at: VM-Internals.pdf.