Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardening the Kernel in Android Oreo

android-developers.googleblog.com

Post reply on HN
Print view View original

41–50 of 108 posts

Re: Hardening the Kernel in Android Oreo

#41

Post by richdougherty »

tadfisher wrote: post #30
mrhigat4 wrote: post #21

Android should really use a modern kernel. All the forking mess involved in Android updates is a terrible problem predicated by the lack of generic drivers on mobile devices. Copperhead[0] has been working to apply security patches to the kernel for some time and PostMarketOS[1] has an eventual goal of using the mainline upstream kernel. Really pulling for PMOS. [0]: https://copperhead.co/android/ [1]: https://www.po…

Agreed, but let's point fingers at the whole stack if we want this to happen. Treble [0] will finally add a HAL to the base system, so updates to the kernel and drivers should in theory be easier on devices that ship with 8.0 (of which there are exactly zero so far). So at least Google's on the right track. But Google doesn't create the drivers and Google doesn't ship the board support packages which vendors build up…

Agreed, it really is a shared problem. It seems like a kind of "collective action problem" [1], where coordination between different parties is required - but they all have different interests and they're not all interested in splitting the costs.

Google is in a difficult position. In order for Android to catch up to the iPhone they needed to encourage a wide consortium of vendors to adopt and sell Android hardware. Part of the way they encourage vendors to sell Android phones is by being very permissive about how vendors install, update and use Android. This helps Android by growing market share.

Unfortunately, it leads to a lot of variation and fragmentation in devices, which in the long term can hurt the Android ecosystem. I guess there's a balance that Google is trying to strike between being too permissive and too restrictive in how they work with vendors.

[1] https://en.wikipedia.org/wiki/Collective_action#Collective_a...

Re: Hardening the Kernel in Android Oreo

#42

Post by kelnos »

c2h5oh wrote: post #32
kelnos wrote: post #26

Earlier quoted context omitted.

Yes, this was my first thought as I was reading the article. A better title for it would be "Backporting Modern Linux Kernel Features to Our Really Old Kernels Instead of Doing the Right Thing and Keeping Up To Date". I do -- I really do -- appreciate that version churn is difficult, and the Linux kernel also doesn't make it easy since they don't guarantee any stable internal APIs, but they're also adding a lot of wo…

Main reason is that there is a lot of hardware that never got binary blobs / drivers updated for newer kernels. We're talking input controllers, wifi, bluetooth, nfc chips, gyroscopes, amps and half a dozen other parts that never attempted to have drivers mainlined in Linux kernel. It's a chicken and egg problem - they won't make updated blobs until Android doesn't include newer kernel. Android won't use newer kernel…

Yes, and I addressed that in my comment. Google, however, can effectively do whatever they want. If they require kernel X, and a manufacturer doesn't support it, they'll either get their shit together, or they'll get left behind. I bet most of them do enough business supplying parts for Android phones that they'd get their shit together. And it' not hard! Writing an initial driver for some hardware might take a lot of effort, but keeping it up-to-date as new kernel releases happen will not, at least in the vast majority of cases.

Re: Hardening the Kernel in Android Oreo

#43

Post by zanny »

haikuginger wrote: post #23
limeblack wrote: post #5

Earlier quoted context omitted.

You probably know this but because of project Treble for future versions after Android Oreo will probably be adopted more quickly. It is unlikely for Oreo to do much better then Nougat then from what I have read.

Which iteration of "project that will definitely reduce Android device fragmentation and ensure that all capable devices will get the new software version as soon as possible" are we on at this point?

Is it the one where vendors are upstreaming their drivers to Linux mainline, properly supporting them in tree, and users are able to audit and trust their phones for the first time ever?

Because that is the actual answer. Everything else is a compromise trying to please vendors who are only trying to exploit users for profit through planned obsolescence and withholding knowledge of how their devices work.

Re: Hardening the Kernel in Android Oreo

#44

Post by tbrock »

c2h5oh wrote: post #32
kelnos wrote: post #26

Earlier quoted context omitted.

Yes, this was my first thought as I was reading the article. A better title for it would be "Backporting Modern Linux Kernel Features to Our Really Old Kernels Instead of Doing the Right Thing and Keeping Up To Date". I do -- I really do -- appreciate that version churn is difficult, and the Linux kernel also doesn't make it easy since they don't guarantee any stable internal APIs, but they're also adding a lot of wo…

Main reason is that there is a lot of hardware that never got binary blobs / drivers updated for newer kernels. We're talking input controllers, wifi, bluetooth, nfc chips, gyroscopes, amps and half a dozen other parts that never attempted to have drivers mainlined in Linux kernel. It's a chicken and egg problem - they won't make updated blobs until Android doesn't include newer kernel. Android won't use newer kernel…

It's not like more than 1% of android phones that have shipped to date will actually get an android update to Oreo anyway so why not leave them behind and update the kernel?

New phones need new drivers which must support the new kernel, period. I don't see what the big deal is. You aren't getting Oreo on your old ass Samsung Galaxy S2 anyway.

Re: Hardening the Kernel in Android Oreo

#45

Post by MBCook »

gsnedders wrote: post #29
fooker wrote: post #25

Earlier quoted context omitted.

3.x kernels with security patches. What seems to be the issue? You can claim big rewards from Google if you report kernel exploits in Android.

> 3.x kernels with security patches. What seems to be the issue? Limiting the scope of vulnerabilities before they are patched. There's plenty of more recent defence-in-depth work that will make some vulnerabilities impossible to exploit on more recent kernels, and while they will get patched on the older kernels it'd still be nicer if they weren't exploitable in the first place.

Even without that there are lots of power saving fixes that get put into Linux with every release. That kind of stuff seems like it be very important in a phone as well.

Re: Hardening the Kernel in Android Oreo

#46

Post by srcmap »

I like to see Android add System GUI to monitor:

* all apps (including daemon processes) that makes internet connections.

* Where they are connecting to.

* AND give user to GUI/Options block those connections.

I also want Android give users option to audit/monitor all new programs, .so, files that has been added to the systems and by which program, time.

If there are suspicious file that is added to the system, we can audit/monitor/report/google where it comes from.

In Windows 10, I use netstat to monitor all TCP connections and get the name of the programs and configure the windows firewall to only allow Windows Firewall/Firefox and Chrome to access internet and block IE/Edge/svchost/SearchUI and countless other SW from access internet. My system is so much faster and stable, after I did this.

Re: Hardening the Kernel in Android Oreo

#47

Post by limeblack »

srcmap wrote: post #46

I like to see Android add System GUI to monitor: * all apps (including daemon processes) that makes internet connections. * Where they are connecting to. * AND give user to GUI/Options block those connections. I also want Android give users option to audit/monitor all new programs, .so, files that has been added to the systems and by which program, time. If there are suspicious file that is added to the system, we ca…

This can be done with apps already although you have to start them on reboot in my experience. Let me go fine the name. It is called NoRoot Firewall.

Re: Hardening the Kernel in Android Oreo

#48

Post by tetromino_ »

khc wrote: post #4

"Android 8.0 makes KASLR available in Android kernels 4.4 and newer." And yet on my pixel with Android 8.0, I am only using 3.18.52. Who actually ships Android with kernel 4.x?

OnePlus ships modern kernels.

My OnePlus 5 is using kernel 4.4.21 - this is with Nougat 7.1.1, by the way; no Oreo here yet.

Re: Hardening the Kernel in Android Oreo

#49

Post by KGIII »

snorlaxle wrote: post #38
KGIII wrote: post #35

Earlier quoted context omitted.

From the last time this was asked, they asked permission. With KitKat, they paid - someone linked a citation for it but it's not in my history.

What I read at the time is that no money was paid to anyone. Hope you find the linked citation https://techcrunch.com/2013/09/03/google-strikes-bizarre-lic...

I stand corrected. Well, at least I am not seeing their source.

Re: Hardening the Kernel in Android Oreo

#50

Post by wmf »

trthomps wrote: post #11
khc wrote: post #4

"Android 8.0 makes KASLR available in Android kernels 4.4 and newer." And yet on my pixel with Android 8.0, I am only using 3.18.52. Who actually ships Android with kernel 4.x?

I also have 3.18 on my Pixel XL. I assume the unreleased Pixel 2 devices will be running kernel 4.4 if that's what they targeted. They probably wanted to back port it to 3.18 but it was too much work. I'm pretty disappointed they didn't move the Pixel forward to a new kernel though, this seems to be one of the biggest issues with Android.

This is an interesting case study in development cycles. The Pixel XL from October 2016 uses the Snapdragon 82x released in July 2016 but first announced in March 2015 and it uses a kernel from 2014 which gives us a hint about when driver development started.
Post reply on HN