Android intent firewall api?

Question

Does anybody used android intent firewall? http://www.cis.syr.edu/~wedu/android/IntentFirewall/

I verified its work with genymotion emulator and everything works fine. Is there any Java api? Does this firewall present in all android systems after 4.4.2?

Answer 1

this is the author of the documentation you linked.

You are correct, the intent firewall is present on all Android devices after 4.4.2 and there is no API for interacting with it. To my knowledge the only programmatic way to add policies to it is via SEAndroid: https://selinuxproject.org/page/NB_SEforAndroid_2#ifw.xml.

If my memory of a Black Hat talk given awhile ago by a Google security engineer is correct, the intended purpose of IFW is to be able to blacklist malicious components to stall for time in the case of a malware outbreak. I believe it has only been used once (in Russia), but the firewall remains in the code as part of Google's implementation of the "security in layers" mantra.

I agree with your assessment that in practice it's not very useful. That's why I made it the focus of my research while I was at Syracuse University:

Carter Yagemann and Wenliang Du. Intentio Ex Machina: Android Intent Access Control via an Extensible Application Hook. Appeared in Proceedings of the 21st European Symposium on Research in Computer Security (ESORICS'16). Heraklion, Crete, Greece. September 26-30, 2016. [PDF]

Hopefully you find this response helpful.

Answer 2

I fond that there is no any SDK API for intent firewall. Yes, it is present in all Android OS after 4.4.2

There are a lot of issues with using of this firewall. The better way is to use PackageManager to disable specified activities.