Hacker News Reader

Comment by gergles | Hacker News Reader

> The /system partition is now mounted nosuid for zygote-spawned processes, preventing Android applications from executing setuid programs. This reduces root attack surface and likelihood of potential security vulnerabilities.

Well, that sounds great. It's almost like they're trying even harder to prevent people from having control over their device.

View on HN

It's also like they're trying to reduce root attack surface and potential security vulnerabilities.

I believe current Fedora is also setuid free, possibly other distros, too.

> It's almost like they're trying even harder to prevent people from having control over their device.

What utter bullshit. Every Google Android device gives you the full freedom to flash whatever you want to on it. No restrictions at all.

Security should not suffer because it might have a negative effect on an absolutely tiny minority of an userbase that can freely disable that added protection anyway.

You are right with respect to the Google-sold devices. Unfortunately, these are only a minority - and this step will make it significantly harder to root devices made by Samsung, HTC, Sony and all the others...

So? That has nothing to do with Android 4.3 as far Google or the AOSP is concerned. Don't buy a device that doesn't give you control if you want that control.

And no, the Nexus line is not the only line that lets you do what you want to. Although not officially supported, Samsung's flashing protocol has been reverse engineered and they've made no changes to block those efforts. HTC's newest One supports the same fastboot procedure that the Nexus line does. Most of Sony's models can also be unlocked and some even have AOSP support.

This is the right move for security. It is not a move to "take control" from anyone. Instead, it is your duty to vote with your wallet. Don't buy carrier-locked phones or other phones that don't give you that control.

Yes, this is what happens when Google owns Motorola. Things that Motorola cares about (tight control), Google now cares about.

The point is, you shouldn't need to root the device. That's a red herring. You can completely modify the source and then flash the device. All these manufacturers give you methods for flashing. You mention Sony[1], Samsung[2], HTC[3], here you go ... In time projects like Cyanogenmod will have ROMs baked for you that'll give you root. But why should it be easy for a user to root their device? If the user can do it a malicious program can do it. There is nothing wrong with extra security so long as the platform stays relatively open, which it seems to be. If anything handset manufacturers seem to be getting more not less dev friendly. Would you want Windows or MacOSX easy to root?

[1] Sony Android source based on AOSP (Android Open Source Project)

http://developer.sonymobile.com/knowledge-base/open-source/a...

[2] Samsung Android source n stuff (unfriendly interface, a little digging is necessary, Samsung's got a lot of products)

http://opensource.samsung.com/

[3] HTC Android source n stuff, "Kernel Source Code, Binaries and Updates for HTC Android Phones"

http://www.htcdev.com/devcenter/downloads

---

Google's AOSP n drivers (for completeness)

http://source.android.com/ https://developers.google.com/android/nexus/drivers

You need root, because there are apps you want to run, that need root permissions. The use cases for these apps are very wide, from ad blocking to repairing OEM fuckups (I'm looking at you, Asus).

Anyway, it is easy to "root" Windows or Mac OSX. It is just logging in as administrator in Windows or using sudo in OSX. The paranoia and preventing the user to really control the device they bought is a new thing, that came with mobile OSes. It wasn't so widespread before.

It won't make Samsung devices any harder to root - Samsung devices are bootloader-unlocked. You don't need any vulnerabilities, you simply flash your custom firmware using tools such as Samsung's Odin. Most other providers are moving towards methods to allow bootloader unlocking. The ones that lock the bootloader usually get negative social media response and lower sales, so I think this trend will continue for now.

HTC supports unlocking their devices: http://www.htcdev.com/bootloader

Just buy the device free, not subsidized by an operator, and you're set.

Well, there is a problem - root exploits give people control of their device, but are also, by definition, a security hole which can be exploited by malicious apps to break the sandboxing and do bad things (tm). The right solution to the issue of user control is to convince manufacturers (which many already do) to make their devices open without needing exploits, not purposefully making the OS less secure.

Another point to consider.

Android 4.3 now includes Digital Restrictions Management framework. In order to prevent users from accessing their data (or running apps) in a ways they're not allowed (copying files, advertisement blocking, tethering and so on), Google (and vendors) certainly wouldn't like users to have unrestricted access to their phones.

I really think tightening security with nosuid and SELinux is at least partially due to DRM introduction.

'fastboot oem unlock' will still work on Nexus devices, right?

Yes. And not only will it continue to work, it should (hopefully) be the only way of getting a custom image.

http://source.android.com/source/building-devices.html#unloc...

IMO promoting 'security holes' as a mechanism of freeing your device is counter-intuitive. What everyone needs is a safe way of running their own software; security bugs are toxic to the entire ecosystem.

I agree. Just that the parent's point that "Google (and vendors) certainly wouldn't like users to have unrestricted access to their phones" doesn't make sense in light of this fact.

Unlocking the phone does a factory reset, right? So you won't have access to any data that your phone holds (unless you were able to export it or store on SD card).

And, if I understand things correctly, custom ROMs do not have Google Play. Well, in reality they do, but I believe Play .apk's floating around are just warez. Maybe I'm wrong on this matter, though (please correct me if I am). But if I'm right, then, legally, phones flashed with custom ROM should not have access to Google Play.

So you're certainly allowed to put whatever software you want (if you can write, build or find one, huh) on your hardware. But, at the same time, you're not welcomed to tinker with Android as provided out of box, except in a way you're allowed by vendor.

I'm not advocating hacks to get root by any means, though. They're security holes that are exploited in a lack of better ways.

Google authorizes distribution of their apps through a separate channel. This issue was resolved when CM was present a C&D in early 2011 (iirc) for distributing Google apps with the ROM image. My understanding is that as long as Google apps are in a separate file, Google consents to the distribution, at least in the case of CM. IANAL.

Unlocking does a factory reset by design. If someone was to steal your (locked, password-protected) device, and could unlock it without wiping, they could just flash an update that bypassed the password and dump all of your data. Or even worse flash an update that silently gave attackers remote access and put the device back in your possession.

Not wiping when unlocking the bootloader is a security hole.

...which is why the first thing I did when I bought my Nexus was fastboot oem unlock. No worries about a factory reset when I hadn't put anything on it to begin with.

Bad news for all the apps on Google Play that require rooting to use (there are some with millions of downloads), but good news for custom ROMs, I guess. A lot of people just root their phone and start using the apps they rooted for like tethering, controlling GPS and other secure settings on triggered actions, etc.. Now rooting will still be trivial for complete ROMs, but tougher to root existing ones.

Do you know if Nexus 4 will be harder to root (without custom ROM) after this update? Thanks.

I haven't read anywhere whether 4.3 requires the system to be mounted non-suid or merely operates that way by default. If it's not actually required, it shouldn't be too difficult to re-enable suid mount from a custom recovery (but I don't know about the SELinux parts).

Conceivably, this would allow the DRM subsystems to easily detect root-able systems (and perhaps even using some sort of active probing to check whether the kernel has been modified to lie about suid mount status).

You don't need a "root" to get a custom ROM (or any build for that matter) on a Nexus 4. You just have to switch the device to unlocked http://source.android.com/source/building-devices.html#unloc...

Unfortunately non-google-sold devices don't have this capability as standard yet, but the Nexus 4 is good to go.

Considering there haven't been devices yet that are unroot-able, this shouldn't be a problem. At a minimum the various Nexus devices work with fastboot to unlock the device very easily.

I'm guessing you're talking strictly about the Nexus line? Because there's several Android devices that have proven un-rootable thus far, such as most Motorola devices, several HTC devices, and so on.

Honestly, if rooting is important to you, you should be buying Nexus devices anyway, right?

I realize that there are some consumers that are forced into certain handsets, and those people lose out. But many people buy devices like Galaxy S4s with the expectation to root and fix what they don't like, which is never something Samsung promises. If such consumers vote with their wallets, we'll see more things like the S4 Google Edition, which is what such buyers want in the first place.

I don't see much of a problem here (exception of those people who don't have Nexus as an option for whatever reason).

You can pretty much unlock any of the bootloaders on any HTC Android device.

http://www.htcdev.com/bootloader

From there you can install Cyanogenmod if your handset supports it, a lot do.

http://wiki.cyanogenmod.org/w/Devices#vendor="HTC";

There is not much point in complaining about not being able to root Android devices. Go for a Nexus or shop around. Not sure about Samsung devices -- they are the market leader after all -- so somebody'll have to help me out on that.

HTC give you bootloader unlock code in like 5 minutes if you request it. That is a reason why there is so strong support for the devices.

I have an HTC One X on AT&T (came out last year) and HTC will not give bootloader unlock codes from HTC Dev for phones with an AT&T CID. You have to use a root exploit to change the CID that was patched in the last firmware update, but has now been cracked again. Unfortunately, it seems no hardware manufacturer has any consistent policies.

You're confusing the locked bootloader with root. All of those are rootable.

Reply on news.ycombinator.com