  Android's filesystem access control is a crucial aspect of its system
integrity. It utilizes a combination of mandatory access controls, such as
SELinux, and discretionary access controls, like Unix permissions, along with
specialized access controls such as Android permissions to safeguard OEM and
Android services from third-party applications. However, when OEMs introduce
differentiating features, they often create vulnerabilities due to their
inability to properly reconfigure this complex policy combination. To address
this, we introduce the POLYSCOPE tool, which triages Android filesystem access
control policies to identify attack operations - authorized operations that may
be exploited by adversaries to elevate their privileges. POLYSCOPE has three
significant advantages over prior analyses: it allows for the independent
extension and analysis of individual policy models, understands the flexibility
untrusted parties have in modifying access control policies, and can identify
attack operations that system configurations permit. We demonstrate the
effectiveness of POLYSCOPE by examining the impact of Scoped Storage on
Android, revealing that it reduces the number of attack operations possible on
external storage resources by over 50%. However, because OEMs only partially
adopt Scoped Storage, we also uncover two previously unknown vulnerabilities,
demonstrating how POLYSCOPE can assess an ideal scenario where all apps comply
with Scoped Storage, which can reduce the number of untrusted parties accessing
attack operations by over 65% on OEM systems. POLYSCOPE thus helps Android OEMs
evaluate complex access control policies to pinpoint the attack operations that
require further examination.
