Virtual Machines vs. Containers

SELinux and AppArmor are security tools that enforce strict access control policies, limiting what programs and users can do within the system.

Seccomp is a mechanism that allows you to restrict the system calls a program can make, preventing it from doing harmful operations.

eBPF allows you to monitor and filter network traffic in real-time, enabling you to identify and block suspicious activity.

Verified Boot ensures that the Android operating system has not been tampered with, verifying its integrity before booting.

Google Play Protect actively scans apps on your device for malware and other threats, protecting your privacy and security.

A virtual machine (VM) is a software-based emulation of a physical computer system. It allows multiple operating systems and applications to run on a single physical server, each operating independently within its own virtualized environment.

A hypervisor is a software layer that manages and controls the allocation of hardware resources to virtual machines. It acts as an intermediary between the physical server hardware and the guest operating systems running within the VMs.

A container is a lightweight and portable software package that bundles an application with all its dependencies, such as libraries, configurations, and other required software components. This allows the application to run consistently across different computing environments.

Docker is a popular open-source platform for creating, managing, and deploying containers. It provides tools for building container images, running containers, and orchestrating container deployments.

A container engine is a software component that manages the lifecycle of containers. It unpacks container images, allocates resources, and runs containers on the underlying operating system.

File permissions in Linux control who can access and modify files and directories. They are represented by a three-part code: owner, group, and others, each with permissions for read, write, and execute.

The chown command is used to change the owner of a file or directory in Linux. It takes the new owner's username as the first argument and the file or directory name as the second argument.

The chmod command is used to change the permissions of a file or directory in Linux. It uses octal numbers representing the permissions for owner, group, and others.

The owner permissions define what actions the owner of a file or directory can perform, such as reading, writing, or executing.

Group permissions determine what actions members of a specific group can perform on a file or directory. Groups are assigned to files and directories and allow for shared access and collaboration.

Others permissions define what actions any other user on the system can perform on a file or directory. These permissions are typically restricted, granting only read access by default.

Read permission allows users to view the contents of a file or list the contents of a directory.

Write permission allows users to modify the contents of a file or to create new files or subdirectories within a directory.

Execute permission allows users to run executable files or to access subdirectories within a directory.

Containers share the underlying operating system of the host machine, while VMs have their own dedicated operating system. This makes containers much lighter and faster, but also means they are less isolated.

A mechanism that isolates and protects applications and processes from each other in Linux, using features like namespaces, cgroups, SELinux, AppArmor, and file permissions.

A mechanism used in Android to isolate and protect applications, built upon Linux features and tailored for mobile app security.

In Linux, namespaces create isolated views of resources like process trees, file systems, and network interfaces. For example, a namespace could isolate a process's view of the file system, preventing it from accessing files outside its designated area.

In Linux, cgroups (Control Groups) limit and monitor resource usage (CPU, memory, I/O) for specific processes. It enables the operating system to allocate and track resource consumption for isolated apps.

In Android, each app runs in its own sandbox, isolated using a unique Linux UID (User ID) and GID (Group ID) assigned during installation.

In Android, each app can access its own files, and can only access other files if explicitly shared.

In Android, apps communicate via controlled inter-process communication (IPC) mechanisms like the Binder framework. For example, Binder can be utilized to pass specific information between apps while enforcing permission restrictions.

In Linux, permissions are based on users and groups. Files and resources are protected using traditional read, write, and execute permissions (rwx).

In Android, permissions are declared in the app’s AndroidManifest.xml file and are divided into categories, such as normal, dangerous, signature, etc. Users must grant explicit permission for dangerous permissions.

In Linux, Network isolation is achieved using techniques like network namespaces that create isolated network stacks, and iptables/nftables to manage network traffic rules.

In Android, apps cannot directly access network interfaces. Instead, they use system-provided APIs, allowing Android to enforce network restrictions based on user permissions and policies.

In Linux, traditional IPC mechanisms like pipes, shared memory, and sockets are not sandbox-aware but can be restricted by sandboxing tools to prevent unauthorized communication.

Android uses a custom IPC mechanism called Binder, which enforces permissions for cross-app communication, controls access to data, and prevents apps from directly interfering with each other's processes.

Linux sandboxing focuses on flexibility and containment, enabling administrators to configure sandboxing policies manually or via tools.

Android sandboxing prioritizes user privacy and malware prevention, protecting users from malicious apps by isolating app data and enforcing strict permissions.

The amount of memory that a program thinks it has access to. Each program has its own virtual memory space, which doesn't overlap with other programs.

The actual amount of RAM available to a computer. This is the physical memory that the CPU directly accesses.

The process of mapping a program's virtual addresses to physical addresses. This allows programs to run even if their total memory needs exceed the available physical RAM.

A table that stores the mapping between virtual and physical addresses. It allows the OS to manage the virtual memory system.

A fixed-size block of memory in both virtual and physical memory. Pages are typically 4 kilobytes in size.

The last 12 bits of a virtual or physical address, used to identify the location within a page.

The portion of a virtual or physical address that identifies the page number.

An exception generated by the CPU when a program tries to access a page that is not currently loaded into physical memory.

A special hardware component in the CPU that caches the mappings between virtual and physical addresses to speed up address translation.

The hardware component responsible for address translation and generating page faults. It connects virtual addresses to physical memory.

A technique used to improve the performance of TLBs by adding multiple levels of caches. This reduces the need to access physical RAM.

A mechanism that allows the OS to swap out second-level page table entries to disk to save memory. This is especially helpful for programs that don't use much RAM.

The process of moving data from disk to RAM when a program needs to access it, and writing data from RAM back to disk when it's no longer needed.

A special area on the disk used to store data that is not currently in RAM. It acts as a temporary holding space for swapped pages.