Pockr | Part 2 — Executing Binaries on Android

Executing Binaries on Android — The SELinux Problem Part 2 of 6 — building Pockr, a single APK that runs Docker on non-rooted Android. ← Part 1: The Idea and Architecture The First Wall: Permission Denied The most obvious approach is to bundle the QEMU binary inside the APK and extract it to app storage on first launch, then execute it with ProcessBuilder . On Android 10+, this silently fails: Cannot run program ".../files/qemu/qemu-system-aarch64": error=13, Permission denied This isn't a file permission issue. chmod +x won't fix it. Why: SELinux W^X Policy Android 10 enforces a W^X (Write XOR Execute) policy via SELinux. Any file in getFilesDir() — the app's private data directory — is labelled app_data_file . That label does not allow execve() . Directory SELinux Label Executable? getFilesDir() app_data_file ❌ getCacheDir() app_data_file ❌ nativeLibraryDir exec_type ✅ The native library directory is the exception — it's specifically labelled to allow execution. This is where Android