Is there any security concern using Termux?

fastb00t

Is there any security concern with using termux and rclone if rclone is the only program I install and are there any inherent security concerns with using termux? I am using the Google Play Store version of termux.

DeletedUser928

hmm, I did not know termux was back on the PlayStore. The GPS version used to be obsoleted and not touched even with a 20 foot barge pole. I guess they are back ...

AFAIK, if you are not running a rooted device, termux is really just another sand-boxed app with whatever privileges you give it. It itself had major internal security vulnerabilities that recent versions fixed, but other than that, really what termux does is pretty much confined to its sandbox and privileges (unless you start opening external facing network services, etc, ... but that goes without saying). Just make sure you are running the latest version.

As to what native termux programs running in termux can do to the termux environment itself, now, that's another can of worms ... (in termux, by default all programs are practically run as superuser)

I myself have been a happy termux user (F-Droid build) with no security concerns beyond keeping it up to date.

DeletedUser1012

Consider this, it remains a pinned discussion on the core termux project.

https://github.com/termux/termux-app/discussions/4000

fastb00t

DeletedUser1012

It's hard to tell if they are equally secure now or if the Google Play Store version still lags behind on security updates since the post was made over 2 years ago and it looks like a lot has happened since then https://github.com/termux-play-store/#updates

DeletedUser1012

My takeaway was that the GPS version (at that time) was considered an unofficial fork. I don't know if that's still the case.

Johnnyloans

DeletedUser928 itself had major internal security vulnerabilities that recent versions fixed

This is true for most high-permission, critical pieces of software on our phones as well as iOS, Samsung, etc. ( Source: the fixed CVE list )

in termux, by default all programs are practically run as superuser)

termux is really just another sand-boxed app with whatever privileges you give it.

This is very misleading.
Termux, the app, doesn't have elevated privileges, but it is practically root as well?
First thing, if Termux did have a root user -- which it doesn't -- So does a virtual machine I spin up or my laptop beside me -- this root doesn't have domain over the host or my phone.

Not having to prepend sudo for commands is not the same thing as being root on any system.

A better description is: Termux runs as a single user ID and it has access to its own files like any other app. All installed packages are signed and verified to be authentic.

Is there a world where a user executes a random script they found online and now they gave themselves a crypto miner? yes
Termux is open source, but the binary for ssh could have malicious code put into it down the road.

However, these same issues exist on a GOS phone, Linux, Windows, or an Apple device -- downloading and running code (an app). Do we know what the 100 devs are doing with Whatsapp or Chess? Nope, but we install and run it.

No root:

~ $ id
uid=10244(u0_a244) gid=10244(u0_a244) groups=10244(u0_a244),3003(inet),9997(everybody),20244(u0_a244_cache),50244(all_a244) context=u:r:untrusted_app_27:s0:c244,c256,c512,c768
~ $ su
No su program found on this device. Termux
does not supply tools for rooting, see e.g.
http://www.androidcentral.com/root for
information about rooting Android.
~ $ ls storage/shared/Termux/
6-26.classification.onnx  config.yaml
~ $ ls storage/shared/Android/data/
ls: cannot open directory 'storage/shared/Android/data/': Permission denied
~ $ ip a
Cannot bind netlink socket: Permission denied

DeletedUser1012
Play Store Termux is an unofficial fork:

The only official release sources to install Termux from are still F-Droid and GitHub as listed in our installation docs and Google PlayStore releases remain deprecated at this time.
-https://github.com/termux/termux-app/discussions/4000

fastb00t It's hard to tell if they are equally secure now or if the Google Play Store version still lags behind on security updates

It's unofficial. We have the git commits or the play store's "Last updated " date. Personally, I wouldn't use a bother this Termux.

DeletedUser928

Touche.

I did say "practically as superuser". I should have phrased that better. Let me clarify:

(fair warning: Do not run this) invoking rm -rf "$TERMUX__ROOTFS_DIR" as the default termux user is akin to rm -rf / on any Unix system AS ROOT . It will run and it will work. All termux programs run as a superuser of the termux environment (sure, not Android Root, but sure as hell can nuke anything IN THE TERMUX ENVIRONMENT as the default user, or worse) and that can be a bad thing(tm) .

That is what I meant by "practically superuser".

DeletedUser928

Addendum: @Johnnyloans On any Linux or Unix, even if you install a crypto-miner/trojan/what-evs as a non privileged user, it won't be able to "root" your system unless a privilege escalation big is exploited. In termux, that barrier does not exist. Everything is "practically superuser"

Johnnyloans

In termux, that barrier does not exist.

I get that you mean that ls, ssh, etc can be deleted or modified -- which hurts -- but these aren't needed by the system (app).

The Termux shell cannot interact with Termux's code and make the system crash -- this would be the root protected files on linux.

/etc, /proc, /usr, etc. either don't exist or are not implemented the same on Termux. ( For example, /usr is owned by root on Linux and it generally contains /usr/lib/modules/$(uname -r)/ )

Termux is closer to the following:
The Linux directory ~/ exists as $TERMUX__ROOTFS_DIR

Everything I run on Linux runs as my user. It can modify ~/ which includes ~/.local/bin -- executables.

If I run rm -rf "$TERMUX__ROOTFS_DIR", the system -- Termux -- will never crash on my phone.

This is similar to deleting Program Files, Users, and Program Data on Windows -- System32 stays.
This means that there is a barrier in Termux. Files that only the user desires are deleted and core, system components stay.

Running sudo rm -rf / on Linux removes core system components. The former keeps the system -- Termux app -- intact.

DeletedUser928

Yes, you are correct in saying that "rooting" the termux environment has no implications with regards to the host Android system. 100% correct.

Regardless, that still leaves a lot to be desired with regards to program isolation within the termux sandbox.

That is the point I was trying to get across.

You called it "single user". I called it "superuser". ultimately the same sh;t.

To paraphrase: Do not run (wget|curl) .*\.sh | bash -c unless you understand what can happen to your termux.

truce @Johnnyloans ? (plus, we hijacked the thread for sure)

DeletedUser928

/etc, /proc, /usr, etc. either don't exist or are not implemented the same on Termux. ( For example, /usr is owned by root on Linux and it generally contains /usr/lib/modules/$(uname -r)/ )

Am I debating an llm? uname -r, surely? And it definitely does not contain kernel modules on fing termux.

plus, $ TERMUX__ROOTFS_DIR is not like ~ . it is the termux app root folder.

come on, johnny.

DeletedUser928

prove me wrong. run the command I told you not to run.

Johnnyloans

DeletedUser928 truce @Johnnyloans ?

Yes, this'll be my last reply. No hard feelings.

Am I debating an llm? ... [F-Ing] termux. ... Come on, johnny

You got me. It's me the clanker.
I'm joking, lol.

DeletedUser928 an llm? uname -r, surely?
DeletedUser928 $TERMUX__ROOTFS_DIR

How is the termux root directory variable common knowledge and less obscure than uname?
1 is obviously not from an LLM but uname is?

I'm pretty sure uname is very common in beginner Linux tutorials.

Plus, these are very common to see:
sudo apt-get install linux-headers-$(uname -r)

The above is faster than taking my hands off the keyboard to copy/paste.

Reviewing makefiles as well:
ARCH=$(shell uname -m)

DeletedUser928 And it definitely does not contain kernel modules on fing termux.

My quote:

Johnnyloans on Linux and it generally contains /usr/lib/modules/$(uname -r)/

ClickClickDrone

DeletedUser928 fuck Android and termux that this divide brought between people. just stop

This paragraph makes no sense at all to me.
Are you sober?

I am genuinely trying to understand...