# Aosp Security

> AOSP Part IX — Security. Use when reasoning about SELinux on Android, Keystore/Keymint, Trusty TEE, gatekeeper/weaver, Android Verified Boot, dm-verity, hardware-backed attestation, Credential Manager (CredentialManagerService, credential providers, passkeys/FIDO2, password and autofill integration, digital credentials), or DRM (MediaDrm framework, Widevine L1/L2/L3, OEMCrypto, license acquisition, secure decoder/display path), or the LFI in-process sandbox (Lightweight Fault Isolation for untrusted code such as software codecs). Chapters 40–42, 68.

- Skill: `aospbooks/aosp-security` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aospbooks/aosp-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aospbooks/aosp-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: aospbooks (https://skillmd.com/u/aospbooks)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aospbooks/aosp-security

---


# AOSP Part IX — Security

Trust roots, key storage, credential management, and content protection.

## Chapters in this Part

- `40-security.md` — SELinux on Android, Keystore/Keymint, Trusty TEE, gatekeeper/weaver, AVB, dm-verity, hardware-backed attestation
- `41-credential-manager.md` — CredentialManagerService, credential providers, passkeys/FIDO2, password and autofill integration, digital credentials
- `42-drm.md` — MediaDrm framework, Widevine L1/L2/L3, OEMCrypto, license acquisition, secure decoder/display path
- `43-lfi-sandbox.md` — Lightweight Fault Isolation: memory-safe in-process sandboxing for untrusted code (software codecs) without a separate process; the external/lfi verifier and runtime, the Soong LFI toolchain, and the libapexcodecs/codec2 integration

## When to load which chapter

- Question mentions SELinux, Keystore, Keymint, Trusty, gatekeeper, weaver, AVB, attestation → `40-security.md`
- Question mentions Credential Manager, passkeys, FIDO2, autofill, digital credentials → `41-credential-manager.md`
- Question mentions MediaDrm, Widevine, OEMCrypto, secure decoder, license server → `42-drm.md`
- Question mentions LFI, lightweight fault isolation, in-process sandboxing, sandboxed software codec → `43-lfi-sandbox.md`