Overview
This post is about an Android audit-log information leak fixed by the AOSP change Hide procfs related audit messages from appdomain.
Inside a restricted third-party Android app sandbox, even when the app cannot directly read another process under /proc/<pid>, touching procfs may trigger SELinux audit logs. If those logs are visible through logcat, the tcontext field can reveal the SELinux domain of the target process.
In other words, this is a detection technique based on an audit-log side channel.
I tried three scenarios with this idea:
