System maintenance: factory reset, OTA updates, custom ROM flashing
Zygote
A special daemon process, started early by init, that serves as the parent of all app processes
Loads and initializes Android Runtime (ART/Dalvik), core libraries and system classes once, then forks for new apps
Without Zygote, every app would initialize the ART runtime separately -> resulting in slow launches and high memory usage -> whereas with Zygote, a single preloaded runtime is forked quickly -> enabling fast app launches and efficient memory use
Forking model: fast app launches, efficient memory use
Security: SELinux and sandboxing apply immediately on fork
BusyBox
Lightweight package with Unix/Linux utilities in single executable
Often called the "Swiss Army Knife of Embedded Linux"
Designed for systems with limited resources (Android, routers, IoT devices)
Android lacks many standard Linux utilities by default, but BusyBox fills the gap by providing a wide set of Linux commands in a compact form.
Combines many commands (ls, cat, grep, find, ifconfig) into one binary
Common in custom recoveries (TWRP) and rooted environments
Android Security Core
Android Verified Boot (AVB)
Ensures device boots only trusted software by verifying the integrity of each stage of the boot process
Evolution of dm-verity (introduced Android 4.4), standardized as AVB 2.0 in Android 7.0+
Root of Trust: starts with bootloader (signed by the device manufacturer)
Chain of Trust: each stage verifies the integrity and authenticity of the next stage using cryptographic signatures (bootloader -> kernel -> system -> vendor)
Rollback Protection: prevents downgrading to vulnerable OS versions
Prevents persistent malware, rootkits, system partition tampering
Modified blocks fail verification -> device refuses to boot or shows warning
DM-Verity (Device-Mapper Verity)
Kernel feature for verified boot (AVB implementation)
Block-level integrity checker for /system, /vendor partitions
Uses hash tree (Merkle tree) of cryptographic checksums in boot image
Each block checked against expected hash
Mismatch -> device refuses to boot (bootloop) or replaces block with zeros
On boot, the kernel initiates dm-verity, which verifies each block of the verified partition by hashing it and comparing it against a precomputed hash tree.
The root hash of that tree is signed by the manufacturer and verified during Verified Boot.
If corruption is detected, the device either fails to boot (boot loop) or replaces bad data with zeros (the device runs, but with corrupted or missing functionality).
Prevents: malware persistence, system file tampering, backdoors
Obstacle for root/custom ROMs: must disable dm-verity for modifications
Rooting with system modifications (e.g., SuperSU) breaks dm-verity by altering the verified partition, causing hash mismatches that lead to boot loops or zeroed data
Magisk achieves systemless root by keeping /system intact, modifying /boot
SELinux (Security-Enhanced Linux)
Kernel-level security module, enforces Mandatory Access Control (MAC)
Introduced in Android 4.3 (2013) and default enforcing since Android 5.0 (2014)
Unlike traditional Linux Discretionary Access Control (DAC), where the owner of a resource decides who can access it, SELinux enforces centralized, mandatory rules that define exactly which processes can access which resources.
Every process, file, resource has security context (label)
Policies define allowed actions between contexts
Even root apps must respect SELinux policies (in enforcing mode)
Prevents root malware from complete takeover
Confines compromised apps within defined boundaries
Even if an app like untrusted_app is compromised, SELinux confines it -> blocking access to sensitive areas like /data/system/ and kernel memory