Un-Rooting Device

seraphine

Everyone keeps saying that you shouldn't use GrapheneOS rooted, since its a giant security risk and I understand that. I also found that it is possible to un-root your device again (i'm not sure if its possible on GrapheneOS). Could you theoretically root a grapheneOS device, make a change and unroot it again?
I found a similar post where someone asked if they could root the device for data recovery purposes, but the answer was that all data would be destroyed when rooting. In my case, I don't care if my data gets destroyed, as long as the change I made during root gets preserved. is that possible?

raccoondad

seraphine Could you theoretically root a grapheneOS device, make a change and unroot it again?

No, if you did you aren't using GOS anymore.

de0u

seraphine Could you theoretically root a grapheneOS device, make a change and unroot it again?

If you were successful in making a change to the system partition then verified boot would fail the integrity check (that's what it's for).

If you want verified boot, the system partition must be signed. If you want verified boot for a system partition that you have modified, you will need to sign the modified system partition with your own signing key (and, if you want updates, to manually generate and sign those images). The other option would be to disable verified boot. Of course, all of this is aside from the question of whether any given change would itself be a security problem.

seraphine

raccoondad and apart from that? I'm just asking if it's possible, not whether it would still be 100.00% GrapheneOS. I only need to change the system font file, so it would be hardly any different than normal GrapheneOS

de0u

seraphine I only need to change the system font file, so it would be hardly any different than normal GrapheneOS.

Though this may seem unlikely, fonts can be a vector for security vulnerabilities.
That said, if you want your own private GrapheneOS with different fonts, you will need to disable verified boot, or else manually patch system images and sign them with your own signing key, and repeat that work for each update.

seraphine

de0u Thanks, this was informative. Do you know what triggers the system integrity check? Specifically, what part of the (font) file would have to be different in order for the integrity check to fail?
Also, in your previous responses you implied that unrooting is possible, it just creates more problems (mainly the verified boot failing). Did I get that right?

raccoondad

seraphine Specifically, what part of the (font) file would have to be different in order for the integrity check to fail?

Any modification to the system partition would cause a failure in a signature check, and if the bootloader isn't locked, then anyone with access to the device can modify the system partition. Basically you would have an insecure device.

It would also fail integrity checks with applications seeing if the bootloader is locked, which rooting would cause it to not be.

In other words, no way to lock the bootloader when editing the system partition

de0u

seraphine Do you know what triggers the system integrity check? Specifically, what part of the (font) file would have to be different in order for the integrity check to fail?

Changing any file on the system partition in any way will cause the system partition to no longer match the signature.

seraphine In your previous responses you implied that unrooting is possible, it just creates more problems (mainly the verified boot failing). Did I get that right?

If the goal is to change the system partition while retaining verified boot, there isn't really any such thing as "unrooting".

Also, this isn't really a GrapheneOS modding forum. You may find more interest in this sort of thing on Android modding forums.

seraphine

Thanks, i understand why this option won't work. I'm gonna look into patching the images next then, thanks for the info

avenging1683

seraphine it's honestly not super hard to build GrapheneOS from source - it just takes a while to clone all the repos and compile. So it should be fairly easy to modify whatever you want and just build your own self signed GrapheneOS versions.

seraphine

avenging1683 thats what i was thinking too, the problem I see though are updates. is there a guide on that? how would that work?

de0u

seraphine the problem I see though are updates. is there a guide on that? how would that work?

The build instructions mention switching from one tag to another. Each build will need to be signed with the same key (which one would not want to leak).