| Maxdamantus | Well, I think I'm switching to Android tonight as my main phone. | 08:51 |
|---|---|---|
| Maxdamantus | Have been creating a root setup which I think is reasonably secure, so I can run normal debian software on it (without fakeroot/proot stuff with selinux/seccomp workarounds). | 08:52 |
| Maxdamantus | (my root setup involves keeping the bootloader locked, and I have a couple of ways of being able to ssh into a static system in my boot/recovery images, if my mutable debian sshd stops working) | 08:56 |
| sicelo | what is your setup | 10:13 |
| Maxdamantus | Basically a custom boot and recovery image based on the stock ones (OnePlus, "OxygegenOS", Android 11), but containing busybox, dropbear and a fairly self-contained init script I wrote. | 10:24 |
| Maxdamantus | I have a Makefile that builds my custom images given the stock ones, so shouldn't be too much hassle to update. | 10:25 |
| Maxdamantus | and creates a modified vbmeta with a signature from the key that I wrote to avb_custom_key | 10:26 |
| Maxdamantus | (that signature is what allows me to keep the bootloader locked, so if someone picks up the phone, they still can't practically access anything without using one of my ssh passwords, or a device pin, or opening the device and connecting to JTAG or something) | 10:28 |
| Maxdamantus | when there's an OTA update available, I'll probably set it up so I just build it on device and rewrite the OTA after it's installed normally. | 10:30 |
| Maxdamantus | and accessing anything in the debian environment requires me to ssh in as root some time after booting the device. | 10:31 |
| Maxdamantus | since /home and /mnt/sd are encrypted using root's ssh password. | 10:31 |
| Maxdamantus | once /home is unlocked, I can just ssh in as a non-root user using key authentication (no password), shouldn't need to use root very often. | 10:32 |
| Maxdamantus | but I'll probably end up creating sudoable scripts for various things, like USB networking or exposing files as UMS devices. | 10:33 |
| Maxdamantus | https://gist.github.com/Maxdamantus/54d0bdb77523aa7d03120ebb1f10df4e | 10:36 |
| Maxdamantus | That's the init script, which has most of the Android/device-specific logic. | 10:36 |
| Maxdamantus | ultimately just runs something from /data/.debian/root in a separate mount namespace, in an unconfined selinux context. | 10:37 |
| Maxdamantus | and also has some "recovery" system (dropbear) for when that fails or is not available (eg, after locking the bootloader, /data gets wiped) | 10:38 |
| Maxdamantus | Should have included `strace` in that list of programs, since that's also fairly important. | 10:45 |
| Maxdamantus | Because my selinux policy injection involves using strace to add delays to the android init, so I can mount over things at the right time. | 10:46 |
| bencoh | uh, funky | 10:51 |
| Maxdamantus | magisk does it by automatically modifying some strings in the init binary, which seems yuckier to me. | 10:51 |
| peetah | quit | 22:19 |
| sicelo | why :-P | 23:05 |
| sixwheeledbeast | I feel like that | 23:21 |
Generated by irclog2html.py 2.17.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!