It's also for historical reasons. When computers were first invented, no one was thinking about hackers, the internet and priviliges. Everything was written around that architecture. When the internet came along, all you could really do, is fix problems with bandaids. Redoing desktop operating systems would break pretty much every program ever written. When smartphones came along, we had already learned quite a bit and security was built in by design. In particular thanks to Apple and their locked down iPhone OS. The iPhone was designed first and foremost for business customers, where security and preventing data loss/leaks are valued immensely. Their effort to patch bugs and destroy the jailbreaks is a good indicator of that. Android hadn't the best security at first either, but it was fixed over time to compete with Apple's offerings. Not only for security itself, but also from a marketing perspective (who would buy phones that are notoriously insecure and full of viruses?).
So these might be some additional reasons why mobile OS'es are designed to run with least privileges. Among the fact that a phone has a lot more capabilities to be used as a wiretap compared to a computer and would do more harm to you when hacked.
Why the stigma against rooting?
But I've never really understood that argument.
It's an objective fact, not an argument that's being made.
So I think I understand how the Android model works. All apps run in user-mode, and only the system itself (and ADB, via a trusted computer) run as root. There's no way for a user-level app to promote itself, and similarly there's no way for a user to promote itself.
No, that's not how it works at all. The base OS does not run as root. It follows the principle of least privilege with components being heavily split up and sandboxed.
But that's not how desktop computers work. Every desktop computer I've ever owned has access to root. If I'm in Windows and run something that needs elevated privileges, I get a User Account Control prompt and hit "Yes". On Linux, I just put the word "sudo" before it, enter a password, and now I can run commands as root. Nobody has ever told me that I should disable "sudo" on a Linux box to make it "more secure". Nobody has ever said to me that I should have to hook my personal desktop computer up to another device in order to access the root user. So why is that the conventional wisdom with smartphones? Why is it that, on a desktop computer, it's normal that I can promote myself into root when I need to, but on a smartphone it's viewed as a gross security violation?
Traditional desktop operating systems lack the basic building blocks of security. They're astoundingly poorly designed from a security perspective and lack basic working app sandboxing or sandboxing throughout the OS. They do not have any real implementation of features like verified boot either. UAC and regular usage of sudo on desktop operating systems is purely security theater with no security value coming from it. It exists to make you feel better, not to provide security.
Sorry if this is a bit rambly, but it's been bugging me since well before I started using GrapheneOS, and I'm sort of hoping the security-minded folks here may be able to shed some light on this for me. What makes a smartphone's threat model different from a desktop computer?
Nothing. Traditional desktop operating systems lack basic security, quite contrary to your belief that it's fine.
Mercerenies What makes a smartphone's threat model different from a desktop computer?
loss and /or theft.
never heard of someone loosing their desktop computer whilst walking the dog, etc
- Edited
Also smartphones tend to have a lot more data. They are used for SMS and calls, contacts details, calendar, notes, todo list, photos etc.
Most people take them everywhere.
Because they are more secure they are increasingly used for banking, controlling insulin pumps, payments, authentication etc. They also have cameras, microphones and GPS functionality, which is not the case with all PCs and laptops.
de0u This is all fine, but it shouldn't feel like I don't own my device, where even the simplest of tasks like toggling airplane mode can't be automated. This same "security" model that conveniently prevents us from unbloating regular android phones and control permissions.
DeletedUser125 This is all fine, but it shouldn't feel like I don't own my device, where even the simplest of tasks like toggling airplane mode can't be automated.
The GrapheneOS web site contains detailed build instructions. If you choose to build a rooted system, or a system with extra high-privilege apps, you may. And if the GrapheneOS developers choose not to release rooted builds, that is likewise their decision.
de0u Sure except I still need to have a powerful enough rig and not make mistakes and not procrastinate on the updates.
DeletedUser125 who said it would be easy/free? Of course you have that feeling since someone else is doing all the work. If you want to feel like you "own" your device, you should actually own it. That implies that you have to invest time, money and labor to get there.
Even though I've never built GrapheneOS, I still have the feeling that I “own” my device and I wouldn't have the same feeling at all on iOS and Stock Android or via any commercially available smartphone with the default operating system in fact, it may not be perfect but I think others share my feeling.
- Edited
yore (Linux is one of the worst offenders here).
In practice, however, ransomware, malware and other malicious programs are always on Windows systems. ;-)
Windows users are either blackmailed by criminals or help antivirus software manufacturers earn billions.
My Tor exits are also guaranteed to be threatened by highly skilled state hackers. Our entire IX only uses Linux & *BSD + Junos OS & Cisco IOS. My ISP too.
DeletedUser125 Since GrapheneOS is FLOSS and if you also place your builds under a free license, you can use many CI/CD for free.
- Edited
boldsuck In practice, however, ransomware, malware and other malicious programs are always on Windows systems. ;-)
While attackers do indeed spread malware best on Windows as it has the largest OS market share, it does not change the fact that Linux systems are far easier to exploit than mainstream operating systems. Security researchers are agreed upon this and there is plenty of evidence and studies out there you can take a look at.
To clarify, 90% of web-facing servers use Linux due its extensiblity; I was not referring to servers, but to users who use Linux systems under the impression that it is more secure. Unfortunately, many users mistakenly believe this due to widespread inaccuracies. Linux (and other desktop OSes) has a design problem and no degree of manual hardening will fix these issues.
You should absolutely add a second Linux user account, separate password, never logged in, that has sudo access.
And remove your main user from the wheel/sudo group. run0 and pkexec work just fine.
boldsuck GrapheneOS does not use Debian-based distributions and recommends against Debian-based distributions due to very poor security. That sentence has been removed from your post.
- Edited
where even the simplest of tasks like toggling airplane mode can't be automated
This is not true.
This same "security" model that conveniently prevents us from unbloating regular android phones and control permissions.
Suggest you avoid derailing threads and making these kinds of attacks on our work. It is in fact a real and very important security model. It's unclear how it stops you from controlling permissions when that is part of what it enables unlike a system without that kind of app sandboxing. It also clearly doesn't stop you using a different OS.
missing-root That makes no practical difference since those provide the same functionality. Even if you entirely avoid all the ways of escalating privileges to root from there, your applications and data is in your main user where they largely run with full access as your user. Sandboxing is largely opt-in and has holes in the containment of apps. It's still designed around granting most access at install time based on whatever the app requests. Anything running as your main user is equivalent root if you ever escalate to root from it, but even if you don't it has access to everything that matters on a typical system without any exploitation involved.
The attack surface of sudo for privilege escalation from unprivileged users is present simply by having it installed as a setuid binary along with other setuid binaries. Any reasonably well contained applications can't make use of those due to having their ability to elevate privileges disabled. On a system that's using whole system MAC policies without huge holes in it, it would barely be relevant but it wouldn't be present on those systems in the first place in practice.
This has all been very enlightening, so thank you all! I was trying to compare threat models as though both systems were designed with them in mind, but it sounds like the main point I was missing was "mainstream desktop OSes were NOT designed with a threat model in mind".
For what it's worth, I'm not planning to root anytime soon. I do occasionally get fed up by the sandboxed file system (trying to move about in Termux but finding myself unable to access a decent chunk of the system), but I definitely get it more now. And I have to mirror @Xtreix 's thoughts: With stock OS, there was always a nagging sense in the back of my mind of how little control I had, but with (official, non-root) GrapheneOS, I feel much more in control and, even without sudo access, do feel like the proper owner of the device at long last. Which is why I'm willing and happy to trust the security experts here and do what they say.
Suggest you avoid derailing threads and making these kinds of attacks on our work.
For what it's worth, I don't think ekeere was criticizing the GrapheneOS security model in particular. It is definitely true that the Android security model (in the abstract) can and has been used for nefarious purposes to make it difficult to remove bloatware (I had a smartphone way back when that had an unremovable NFL app; the football app was apparently so integral to the system that I wasn't allowed to touch it). That's not your fault. That's good technology being used by bad actors to do bad things.
And I do feel like that's relevant to what I was asking about. It's easy for a newbie like me to come in here, still riding my high from switching to Linux and expecting the same of GrapheneOS. It's easy for the Android security model to get a bad rep among power users when the average person's experience with it is "No, you can't uninstall or disable Alexa, she's too important".
Mercerenies Termux has very poor support for Android APIs and modern Android. It could provide far better support for handling shared file access and many other things but doesn't. It was largely written in a way that the same thing could be done far better by simply running a virtual machine instead of trying to do things in the Android way and integrate well with the OS. There will be better support for running a foreign CLI environment via virtual machines built into the OS soon.
GrapheneOS Oh? Is that a GrapheneOS-specific feature you're planning, or something coming to Android as a whole? If you have a link, I'd love to read more about what's planned.