Initial root access to restore backups?

MikeJ

Ammako you're not going to flash official GOS over a custom build without unlocking the bootloader first.

The bootloader is alread unlocked in my case. I also have root, and I will do a full system backup before switching ROMs, so I expect to start from a clean state. And I would not flash the official GOS image but a modified one.

Or are you referring to my comment in the end where I mentioned that I might go from my modified build to official GOS in the future? It is clear to me that in this case I’d again lose everything. That’s why I mentioned restoring SeedVault backups.

bobbed859

It would be great to have an official build with userdebug activated, so users can choose to install the build with or whithout it activated.
This would solve the current impossibility of making a full backup, (unless enabling userdebug is a major security weakness).

AlphaElwedritsch

bobbed859 It would be great to have an official build with userdebug activated

That would be in direct contrast to the philosophy of GOS.

Think about what consequences and effects that could have and then ask yourself again whether that would be a good decision or not

de0u

bobbed859 It would be great to have an official build with userdebug activated, so users can choose to install the build with or whithout it activated.

Unfortunately, if there were a signed userdebug build available, anybody who captured your device could sideload that build and use it to extract your data.

bobbed859

de0u Unfortunately, if there were a signed userdebug build available, anybody who captured your device could sideload that build and use it to extract your data.

Even if USB debugging is disabled?

de0u

de0u Unfortunately, if there were a signed userdebug build available, anybody who captured your device could sideload that build and use it to extract your data.

bobbed859 Even if USB debugging is disabled?

I think that formulation assumes that attackers don't know a way to enable it. For sure I haven't even skimmed any of the relevant code. That said, there are some people with their own private builds of GrapheneOS who make all sorts of modifications, including running userdebug builds (perhaps after having done their own code audits, or perhaps not). The web site has extensive build directions.

I don't speak for the GrapheneOS project, but I am very doubtful that they will issue signed userdebug builds.

TheGodfather

redfoxjumper that's irrelevant in the scenario presented

It is. He needs to unlock the bootloader again to flash the official GrapheneOS image at the end.

Hirudin

I would be very interested in a tutorial for non-haxors that explains/shows how to make it so I can have GrapheneOS and app backups. I mean REAL app backups, not this SeedVault garbage that seems to be the only officially-supported option. "Yeah, it doesn't work very well, but what do you expect US to do? Fix it‽" - Thanks, GrapheneOS, you're the best!

As a rooted Android user since the HTC G2, I DON'T think it's too much to ask to have a phone that offers a tiny bit of privacy AND app backups. I appreciate that rooting could pose a security threat, but my security concerns are temporal. I'm probably putting myself in much more danger using a phone that refuses to update than one that the KGB could hack into if they could only manage to gain physical access to it for a couple hours without me noticing. (I better watch out! They might replace my vitimins with knockout pills.)

Dumdum

Hirudin "Yeah, it doesn't work very well, but what do you expect US to do? Fix it‽" - Thanks, GrapheneOS, you're the best!

https://grapheneos.org/features#encrypted-backups

Seedvault was created by a GrapheneOS community member for inclusion in our operating system. We plan on replacing it with a new implementation since the project has been taken over by another group of people not sharing our goals or approach.

Hirudin

redfoxjumper Some people have apps called "games". These "game" apps sometimes have progress or stats that span years and cannot just be 'reset' like seem to suggest can be assumed of all apps. It's not just games, many apps are essentially portals to data accumulated over long stretches of time and, despite what you and I would prefer, some of them do not offer an easy or convenient manual backup option.

Rizzler

Wait for the new backup system to drop. Rooting is anti-security. Run LineageOS if you don't care about security.

MikeJ

Rizzler Wait for the new backup system to drop.

Any idea when this will be?

Rizzler Rooting is anti-security.

Not sure if this was directed at me. But my intention is to use GrapheneOS without root. I now have restored my backups and I’ve just flashed a new build without root. I believe this should not compromise security. But please let me know if I’m missing something.

Rizzler

MikeJ So if i got your post right at the end you're still using your unofficial build?

redfoxjumper

Ammako the op was planning to use seedvault if they get to that, so that's still irrelevant

MikeJ

Rizzler So if i got your post right at the end you're still using your unofficial build?

I thought I’d need to do my own build, but it’s not what I ended up doing.

I initially flashed a rooted build on which I restored my apps after locking the bootloader. Then I took the official GrapheneOS build and signed it again with my own set of keys. This way I could flash it over the rooted build after locking the bootloader. I now have a rootless build that should be identical to the official build except for the signature / certs being used.

aw22

MikeJ Also sounds like a viable option. I’ve never done it this way though. Can I easily do full backups this way as well?

Yes, after running "adb root", I use restic (or rsync) to copy the entire filesystem to my laptop via ssh.

With that, you'll be able to fully restore the state of apps that don't use anything from the Keystore.

Rizzler

MikeJ Yeah, if you're fine with signing each update manually, then Godspeed.

Carlos-Anso

Anyone doing this needs to make sure they disable the system updater app. Also Auditor will fail.

MikeJ

Carlos-Anso Anyone doing this needs to make sure they disable the system updater app. Also Auditor will fail.

Good point. I read about this in the build section and disabled my system updater app right away. But we should definitely point this out here for potential future readers.

MarSOnEarth

Could the same outcome be achieved by first flushing the GOS install zip, rooting, restoring ones apps and data, and then overlaying that with the OTA package of the same tag as the install zip? This would do away with the need to keep building and signing each update and would have to be done just once.

No, yes, maybe?

« Previous Page