Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardening the Kernel in Android Oreo

android-developers.googleblog.com

Post reply on HN
Print view View original

61–70 of 108 posts

Re: Hardening the Kernel in Android Oreo

#61

Post by pwg »

srcmap wrote: post #46

I like to see Android add System GUI to monitor: * all apps (including daemon processes) that makes internet connections. * Where they are connecting to. * AND give user to GUI/Options block those connections. I also want Android give users option to audit/monitor all new programs, .so, files that has been added to the systems and by which program, time. If there are suspicious file that is added to the system, we ca…

Another one (at least for the 'monitor' portion) is Net Monitor (https://f-droid.org/packages/org.secuso.privacyfriendlynetmo...) which is available in F-Droid (https://f-droid.org/).

Re: Hardening the Kernel in Android Oreo

#62

Post by petecox »

tadfisher wrote: post #30
mrhigat4 wrote: post #21

Android should really use a modern kernel. All the forking mess involved in Android updates is a terrible problem predicated by the lack of generic drivers on mobile devices. Copperhead[0] has been working to apply security patches to the kernel for some time and PostMarketOS[1] has an eventual goal of using the mainline upstream kernel. Really pulling for PMOS. [0]: https://copperhead.co/android/ [1]: https://www.po…

Agreed, but let's point fingers at the whole stack if we want this to happen. Treble [0] will finally add a HAL to the base system, so updates to the kernel and drivers should in theory be easier on devices that ship with 8.0 (of which there are exactly zero so far). So at least Google's on the right track. But Google doesn't create the drivers and Google doesn't ship the board support packages which vendors build up…

> we come to Qualcomm, Samsung, Mediatek, and whoever else is shipping proprietary drivers for their SoCs and radios, and who don't provide binaries for new ABIs.

Vote with your wallet.

The librem 5 mentioned this week uses a 'liberated' i.MX6 chip because they want a phone with an upstream kernel. Technology wise, it's a little long in the tooth, but they're emphasising it's possible to not reward vendors for bad behaviour.

With RPi providing resources to de-blob and upstream the Pi, perhaps some entrepreneur will get behind a crowdfunded Broadcom based phone, with work underway on VC5.

http://phoronix.com/scan.php?page=news_item&px=BCM7268-DRM-W...

Re: Hardening the Kernel in Android Oreo

#64

Post by duskwuff »

srcmap wrote: post #46

I like to see Android add System GUI to monitor: * all apps (including daemon processes) that makes internet connections. * Where they are connecting to. * AND give user to GUI/Options block those connections. I also want Android give users option to audit/monitor all new programs, .so, files that has been added to the systems and by which program, time. If there are suspicious file that is added to the system, we ca…

I'm not sure I see what security value these features would add for ordinary users.

On a modern device, most application processes will be making some sort of network connections, and many of those connections will be to IPs that can't easily be identified, even by an experienced user. (For instance, a lot of those addresses are likely to belong to Cloudflare or other CDN providers.) You can't rationally expect users to make intelligent decisions about whether to allow or block those connections.

IMO, it shouldn't be possible at all for applications to run code that's created/downloaded at runtime. iOS has the right approach here. This makes monitoring those files unnecessary -- the only path for code to enter the system is through installing or updating apps.

Re: Hardening the Kernel in Android Oreo

#65

Post by duskwuff »

bhhaskin wrote: post #28

I really wish Ubuntu touch was more complete. I would switch in a heart beat.

Don't hold your breath. The project was effectively cancelled in April. There's theoretically a "UBPorts" project that may continue development, but, without any sort of company backing it anymore, I doubt that it's going to have much of an impact.

https://insights.ubuntu.com/2017/04/05/growing-ubuntu-for-cl...

Re: Hardening the Kernel in Android Oreo

#66

Post by ehPReth »

Pharaoh2 wrote: post #9
limeblack wrote: post #3

Glad we are making it more secure. On a side note I love that we now have https://googleblog.blogspot.com/index.html http://blog.google and https://android-developers.googleblog.com/ and https://googleblog.blogspot.com/ (which redirects to blog.google without index.html because it appears to be the new site) which is slightly weird.

Did you mean https://www.blog.google/ ?

Hmm, I recall this being a much cleaner https://blog.google before. I wonder why they added www. after some time? Anyone happen to know the story?

Re: Hardening the Kernel in Android Oreo

#68

Post by c8g »

srcmap wrote: post #46

I like to see Android add System GUI to monitor: * all apps (including daemon processes) that makes internet connections. * Where they are connecting to. * AND give user to GUI/Options block those connections. I also want Android give users option to audit/monitor all new programs, .so, files that has been added to the systems and by which program, time. If there are suspicious file that is added to the system, we ca…

use "NoRoot firewall" to give access to some application :)

Re: Hardening the Kernel in Android Oreo

#69

Post by petecox »

duskwuff wrote: post #65
bhhaskin wrote: post #28

I really wish Ubuntu touch was more complete. I would switch in a heart beat.

Don't hold your breath. The project was effectively cancelled in April. There's theoretically a "UBPorts" project that may continue development, but, without any sort of company backing it anymore, I doubt that it's going to have much of an impact. https://insights.ubuntu.com/2017/04/05/growing-ubuntu-for-cl...

'theoretically?' It's happening, albeit without a corporation behind it.

They have a weekly youtube vodcast, if you're curious, and a Patreon page with a couple of hundred subscribers.

Re: Hardening the Kernel in Android Oreo

#70

Post by xbmcuser »

c2h5oh wrote: post #32
kelnos wrote: post #26

Earlier quoted context omitted.

Yes, this was my first thought as I was reading the article. A better title for it would be "Backporting Modern Linux Kernel Features to Our Really Old Kernels Instead of Doing the Right Thing and Keeping Up To Date". I do -- I really do -- appreciate that version churn is difficult, and the Linux kernel also doesn't make it easy since they don't guarantee any stable internal APIs, but they're also adding a lot of wo…

Main reason is that there is a lot of hardware that never got binary blobs / drivers updated for newer kernels. We're talking input controllers, wifi, bluetooth, nfc chips, gyroscopes, amps and half a dozen other parts that never attempted to have drivers mainlined in Linux kernel. It's a chicken and egg problem - they won't make updated blobs until Android doesn't include newer kernel. Android won't use newer kernel…

Most manufactures don't update their phones to newer version of Android anyway. I think Google should bite the bullet and upgrade to the newer kernal or atleast inform now that the next year Android will be on the latest kernal so hardware manfacturers should upstreaming their patches.
Post reply on HN