Which of the following BEST describes the Android software stack from bottom to top?
- A.Application Framework (the Java API surface) → Android Runtime → HAL → Linux Kernel → Applications (the layer the user actually touches on screen)
- B.Bootloader (aboot) → Applications → Android Runtime → HAL → Linux Kernel (the lowest layer in this particular ordering of the stack)
- C.Linux Kernel → HAL → Android Runtime (ART) + Core Libraries → Application Framework → Applications
- D.Application Framework → HAL → Linux Kernel → Android Runtime (ART) → Applications (the ordering used in the older Dalvik-era documentation)
Why C is correct
The canonical Android stack (bottom to top): Linux Kernel (drivers, security) → HAL (hardware interfaces) → Android Runtime / ART + Core Java Libraries → Application Framework (Activity Manager, PackageManager, etc.) → Applications. Understanding this layering is essential for understanding where security controls like SELinux, TEE access, and permission enforcement operate.
Know someone studying for Mobile Security Fundamentals? Send them this one.