Carlos-Anso Within AOSP theres a new 'terminal' app which they are building which facilitates downloading debian
How come Google went with Debian for the Linux environment in AOSP and also ChromeOS, when this distro has "very poor security"? I'm just curious, there must be a good reason for it. Or maybe not and it was just some Google engineer's personal preference.
run0 is not setuid so in theory you can remove the others.
This doesn't mean that what it does is better or more secure.
SELinux confined user accounts are being developee but not prioritized
SELinux is a policy framework. It's fairly meaningless to talk about it being used without specifics. It's hardly used at all in Fedora.
GrapheneOS in other words, keeping our devices safe requires multiple layers of security. There is no silver bullet.
Pretty sure Debian maintainers patch or investigate reports faster than MS or Google. Those 2 probably get hundreds or more reports per day from all over the world about any number of vulnerabilities but only a small fraction are reproducable and match the criteria those platforms pay out.
probably went off path a bit, my bad
Rooting is great if you know what you're doing or have a purpose to do it. It gives unfettered access to read and manipulate almost everything on the device. Which ends up being against the terms of the included licenses. So messing with files of any kind without exactly knowing what you are doing is absolutely designed to have consequences.
Like everything now a days, a multi layered approach to the security on your devices is your only viable option.. Which means accepting Google as the one true G
Yeah all user files are unconfined, which is being worked at, but still not really useful
Viewpoint0232 How come Google went with Debian for the Linux environment in AOSP and also ChromeOS, when this distro has "very poor security"?
Hard to know exactly how they arrived at the decision to use debian. They have done this as a tool to be used by software developers. I guess they decided that carefully using tools in the VM, when necessary, while leveraging the security of the host OS provides adequate security.
I am assuming they will keep the android implementation hidden away in Developer options.
GrapheneOS I am really grateful to the GrapheneOS team for what you do, GOS is the only OS for smartphones that provides real security. But I still have a question. Most arguments about root boil down to the fact that it breaks verified boot. But you can avoid this if you build GOS+Magisk yourself on a trusted device, for example, on a smartphone with GOS without root and sign with your own key. Tell me, please, in this case there will still be a significant degradation of security? If you grant root rights only to a few trusted applications and with verified boot
DeletedUser126
Hardly any system processes in AOSP get root. Increasing the number of things that can use root opens up security holes.
If security is a concern then root should not be used. Theres always another way to achieve what you want. If you cant just use an app to get the functionality you are looking for and you really need changes to system files you should make your own builds with the changes that you want rather than making changes using root.
Outside of development and reverse engineering/examining apps Ive yet to see any really compelling uses of root. Generally its people who have been rooting for years and got used to having a rooted device. Theres little to loose by letting go and a lot to gain.
nullable Pretty sure Debian maintainers patch or investigate reports faster than MS or Google
No, Debian is anti-security and Microsoft and Google are doing much better, Google contributes a lot to hardening the Linux kernel, the .deb packages present in Debian-based distributions are riddled with vulnerabilities, many of which date back several decades. Debian is often used for the server side, because it's free and easy to use.
nullable Rooting is great if you know what you're doing or have a purpose to do it
No the rooting on phone is not great and there's always a better way.
nullable This is not how security patches work and that's definitely not the case.
nullable It greatly reduces the security of the OS by having it designed that way even if you never use it.
It gives unfettered access to read and manipulate almost everything on the device.
No, it doesn't. It gives immense access within the OS which is not full control over the device. It also doesn't mean you can persistently modify the OS unless you've removed additional security features beyond what you've already removed for that.
