Mercerenies
Google is doing a lot of work on AVF https://cs.android.com/android/platform/superproject/main/+/main:packages/modules/Virtualization/README.md

Within AOSP theres a new 'terminal' app which they are building which facilitates downloading debian and configuring a vm. Its included in the stock Pixel OS developer previews of android 15 QPR2 and android 16.

GrapheneOS has various plans for utilizing VMs to run isolated processes to improve security in the OS and to enable running desktop operating systems, giving users ability to run desktop operating systems and their apps.

      GrapheneOS absolutely. Some of these issues are getting already fixed. run0 is not setuid so in theory you can remove the others.

      SELinux confined user accounts are being developee but not prioritized

          Carlos-Anso Within AOSP theres a new 'terminal' app which they are building which facilitates downloading debian

          How come Google went with Debian for the Linux environment in AOSP and also ChromeOS, when this distro has "very poor security"? I'm just curious, there must be a good reason for it. Or maybe not and it was just some Google engineer's personal preference.

              missing-root

              run0 is not setuid so in theory you can remove the others.

              This doesn't mean that what it does is better or more secure.

              SELinux confined user accounts are being developee but not prioritized

              SELinux is a policy framework. It's fairly meaningless to talk about it being used without specifics. It's hardly used at all in Fedora.

                  GrapheneOS in other words, keeping our devices safe requires multiple layers of security. There is no silver bullet.

                  Pretty sure Debian maintainers patch or investigate reports faster than MS or Google. Those 2 probably get hundreds or more reports per day from all over the world about any number of vulnerabilities but only a small fraction are reproducable and match the criteria those platforms pay out.

                  probably went off path a bit, my bad

                      Rooting is great if you know what you're doing or have a purpose to do it. It gives unfettered access to read and manipulate almost everything on the device. Which ends up being against the terms of the included licenses. So messing with files of any kind without exactly knowing what you are doing is absolutely designed to have consequences.

                      Like everything now a days, a multi layered approach to the security on your devices is your only viable option.. Which means accepting Google as the one true G

                        GrapheneOS

                        Yeah all user files are unconfined, which is being worked at, but still not really useful

                          Viewpoint0232 How come Google went with Debian for the Linux environment in AOSP and also ChromeOS, when this distro has "very poor security"?

                          Hard to know exactly how they arrived at the decision to use debian. They have done this as a tool to be used by software developers. I guess they decided that carefully using tools in the VM, when necessary, while leveraging the security of the host OS provides adequate security.

                          I am assuming they will keep the android implementation hidden away in Developer options.

                            GrapheneOS I am really grateful to the GrapheneOS team for what you do, GOS is the only OS for smartphones that provides real security. But I still have a question. Most arguments about root boil down to the fact that it breaks verified boot. But you can avoid this if you build GOS+Magisk yourself on a trusted device, for example, on a smartphone with GOS without root and sign with your own key. Tell me, please, in this case there will still be a significant degradation of security? If you grant root rights only to a few trusted applications and with verified boot

                                DeletedUser126
                                Hardly any system processes in AOSP get root. Increasing the number of things that can use root opens up security holes.

                                If security is a concern then root should not be used. Theres always another way to achieve what you want. If you cant just use an app to get the functionality you are looking for and you really need changes to system files you should make your own builds with the changes that you want rather than making changes using root.

                                Outside of development and reverse engineering/examining apps Ive yet to see any really compelling uses of root. Generally its people who have been rooting for years and got used to having a rooted device. Theres little to loose by letting go and a lot to gain.

                                  • Xtreix

                                    • Post #46
                                    • Edited

                                    nullable Pretty sure Debian maintainers patch or investigate reports faster than MS or Google

                                    No, Debian is anti-security and Microsoft and Google are doing much better, Google contributes a lot to hardening the Linux kernel, the .deb packages present in Debian-based distributions are riddled with vulnerabilities, many of which date back several decades. Debian is often used for the server side, because it's free and easy to use.

                                    nullable Rooting is great if you know what you're doing or have a purpose to do it

                                    No the rooting on phone is not great and there's always a better way.

                                        nullable This is not how security patches work and that's definitely not the case.

                                          nullable It greatly reduces the security of the OS by having it designed that way even if you never use it.

                                          It gives unfettered access to read and manipulate almost everything on the device.

                                          No, it doesn't. It gives immense access within the OS which is not full control over the device. It also doesn't mean you can persistently modify the OS unless you've removed additional security features beyond what you've already removed for that.