Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Termux and Android 10

github.com

Post reply on HN
Print view View original

181–190 of 329 posts

Re: Termux and Android 10

#181

Post by MereInterest »

hsitz wrote: post #160
MereInterest wrote: post #141

Earlier quoted context omitted.

About once every 2-3 months, something would be changed in ChromeOS that would break the crouton installation. The solution could be as simple as updating crouton, only 15-30 minutes of lost time, to switching to/from a later development version of ChromeOS, 3-4 hours of lost time as the entire hard drive is wiped and you need to rebuild the environment. The use of a Linux environment in ChromeOS should only be viewe…

I'm not sure what you're talking about. Crouton is different from Crostini, and it's Crostini that is the default/built-in Linux container on Chromeos (on a Pixelbook). I've been using Crostini on Chromeos since November 2018 and I've never had "the hard drive wiped" or had to rebuild the environment. I'm trying hard to recall anything that's actually been a bug. I'm sure there've been some. Mostly they've been rolli…

Looks like Crostini is the official tool that duplicated the functionality of the the more homebrew Crouton. Crostini came out in early 2018, which was about half a year after I gave up on using linux on chromebooks out of frustration.

https://chromium.googlesource.com/chromiumos/docs/+/master/c...

Re: Termux and Android 10

#182

Post by stonewareslord »

kllrnohj wrote: post #131
asveikau wrote: post #5

Earlier quoted context omitted.

I don't think it's very alarmist or an overstatement though. An android 10 app is no longer allowed to do what termux does. I guess with more reading they are saying they need to declare themselves as targeting android 9 or lower until they find a solution. At some point, I imagine, that will not be an option. To some degree it should also be on Google to ensure that tightening security (or perceived tightening of se…

The title is that Android 10 is killing Termux. But it's not, it's killing exec() on writable files. There's alternatives Termux could take, which the Google issue tracker already mentions such as bundling the executables in the APK & using extractNativeLibs=true so they can be exec'd ( https://issuetracker.google.com/issues/128554619#comment4 ). They could use a loader that mmap's the code with PROT_EXEC but not PRO…

Termux allows you to apt install thousands of packages. The options in that issue aren't nearly as good. Bundling every binary in the apk? That would be a breach of licenses, let alone the amount of storage that would take up to have gimp, libreoffice, Firefox, etc installed. As mentioned, proot is a temporary hack (why wouldn't any app just stick proot in their lib Dir?).

Even if the workaround works, this would break apt install from non-termux repos, compiling and running with gcc, maybe Python packages installed with pip.

Google's intent here is to block code execution in the app home Dir. Any workaround would be a security violation and eventually stopped. How is this not killing Termux?

Re: Termux and Android 10

#183

Post by Dylan16807 »

MereInterest wrote: post #143
Dylan16807 wrote: post #79

Earlier quoted context omitted.

I see your point, but it's not as bad as that. Pressing the right key combination is optional, and all it does is skip an annoying beep. Factory reset isn't triggered by inactivity, it's triggered by pressing space and then confirming.

It may have changed in the past two years, but there was a 30 second splash screen saying "Press space to continue". If you press space during that time, it will "continue" to safe mode, wiping your entire crouton environment. There was no indication at all as to the key combination needed to skip the 30 second wait time.

You have to also confirm clearing data with enter after pressing space.

Re: Termux and Android 10

#184

Post by pmontra »

AsyncAwait wrote: post #100
Sebb767 wrote: post #86

Earlier quoted context omitted.

But you pay 750$ for a 3GB quad core phone; I've got these specs on a 300€ OnePlus One five (six?) years ago. Sure, replaceable battery and open hardware are a _very_ good thing, but the value/$ of these phones are horrendous. That's not to defend OnePlus or any other manufacturer, but when I can get a high end Samsung or Xiaomi device with 4 times the specs at every corner for the same price or less and simply insta…

These phones are primarily about user-freedom, privacy and my ability to do whatever I want with a device that I've purchased, without restrictions imposed by the OEM. Also, honest question; What do you actually 'use' the latest specs for? These Android/iOS phones are basically all about media consumption, something that has been sufficiently performant for years. You have great hardware, but no software to take real…

Basically I'm using Firefox, K9 for email, WhatsApp and Telegram to chat with friends, OSMAnd to plan and record bicycle tracks. Phone and camera. Plus mandatory banking apps or I won't be able to do home banking.

If I buy a Linux phone I'd have to keep using my Android phone probably as my primary device. And I've been using Ubuntu laptops as my only working devices since 2009 so I'd love to use an Ubuntu phone. Unfortunately it lacks at least half of the apps I need.

Re: Termux and Android 10

#185

Post by shockinglytrue »

AshamedCaptain wrote: post #64
shockinglytrue wrote: post #9

Earlier quoted context omitted.

It's still possible, you just have to dance around a little more In one project we work around this by shipping a tiny wrapper in the APK to exec that then uses dlopen() on the target, which is now built as a library. Pretty sure a generic hack could be made to run unmodified executables this way. Certainly in the security community userland ELF loaders are very old news, even X11R6 had its own at one point

And the next release Android uses noexec and therefore you can't even mmap(...PROT_EXEC) the binary. So you now have yo copy the binaries to RAM by yourself on exec(). And then at some point you realize that, like Cygwin, you have built a system where fork() fails randomly by design. And then Google blacklists both fork and exec.

Not sure why you're being downvoted, this unfortunately all makes sense

Re: Termux and Android 10

#186

Post by kllrnohj »

stonewareslord wrote: post #182
kllrnohj wrote: post #131

Earlier quoted context omitted.

The title is that Android 10 is killing Termux. But it's not, it's killing exec() on writable files. There's alternatives Termux could take, which the Google issue tracker already mentions such as bundling the executables in the APK & using extractNativeLibs=true so they can be exec'd ( https://issuetracker.google.com/issues/128554619#comment4 ). They could use a loader that mmap's the code with PROT_EXEC but not PRO…

Termux allows you to apt install thousands of packages. The options in that issue aren't nearly as good. Bundling every binary in the apk? That would be a breach of licenses, let alone the amount of storage that would take up to have gimp, libreoffice, Firefox, etc installed. As mentioned, proot is a temporary hack (why wouldn't any app just stick proot in their lib Dir?). Even if the workaround works, this would bre…

> Google's intent here is to block code execution in the app home Dir

Google's actions are to block exec of writable code. What their _intentions_ are is pure speculation and detracts from the actual issue. Your claim is largely unsubstantiated & lacks evidence, particularly as Google recommended ways to continue to do exactly what you claim they are intending to block.

> The options in that issue aren't nearly as good.

How is using a PROT_EXEC mmap "not nearly as good"? It's the same end result. There's no technical banning of executing downloaded code. That's not what was done, and doing that would also break Chrome which should be glaringly obvious that Google isn't intending or going to do.

It takes a bit more effort, and it's not as "simple" as just exec'ing random stuff, but it's not without its own upsides as well (like not violating W^X, which is a _well_ proven security design)

Re: Termux and Android 10

#187

Post by ShamelessC »

dueF7un3 wrote: post #18
asveikau wrote: post #5

Earlier quoted context omitted.

I don't think it's very alarmist or an overstatement though. An android 10 app is no longer allowed to do what termux does. I guess with more reading they are saying they need to declare themselves as targeting android 9 or lower until they find a solution. At some point, I imagine, that will not be an option. To some degree it should also be on Google to ensure that tightening security (or perceived tightening of se…

I'm confused, because I use termux on android-10 (on a pixel2) without any problem. I have a cron running on it that mails my notifications to me, a ssh server which my laptop use to send my backups on my phone, a go http server running a local app that I use in the mobile's browser, I'll often take screenshots on the phone, then scp them on the laptop, etc. Am I missing something? EDIT: I won't reply to each of you…

> I have a cron running on it that mails my notifications to me.

Off-topic, but that's awesome! How do you get access to your notifications from Termux?

Re: Termux and Android 10

#188

Post by lucb1e »

cft wrote: post #171
lucb1e wrote: post #168

Earlier quoted context omitted.

Wouldn't be the first app that runs into issues with Google's benevolent inclusion of their code in the Google store. I'm sure F-Droid will continue to deliver Termux, especially for the specific Termux audience.

At some point these restrictions to exec() will be enforced on the OS level, rather than on the API level.

Isn't that the same thing in Android? SELinux, which I read elsewhere in this thread is where this is built into, is part of the system in which your app runs.

Re: Termux and Android 10

#189

Post by mwfunk »

sosborn wrote: post #7
pathartl wrote: post #4

I'm really starting to despise most OS's for having such an overbearing security policy. I think it's really why I've stuck with Windows for so long. For sure Windows is not as user-stupid as something like macOS, iOS, Android, etc... but for me as a power user it's just about as powerful as I need to be. I'm not even considering *nix distros here because honestly the market for every day users for something like Ubu…

> No, I do not want to open system preferences every time I want to launch something. I am a power user. You don't have to. Right click on the icon and select 'open.' https://support.apple.com/en-gu/guide/mac-help/mh40616/10.15...

Also, it should be noted that this is only the first time you launch the untrusted app. After that the system considers the app to be trusted and doesn't bug you about it. But self-described power users already know all this stuff, so I'm sure this isn't news to anyone. Self-described power users know everything about everything, or else they wouldn't describe themselves as power users. It's why they're so revered for their humility and lack of obvious cognitive biases throughout the world.

Re: Termux and Android 10

#190

Post by zozbot234 »

cft wrote: post #180
zozbot234 wrote: post #174

Earlier quoted context omitted.

Impossible to distribute in Play. Will work fine as a plain .apk, or downloaded from e.g. F-Droid.

Note that they will eventually tighten SELinux policy to forbid exec() outside of userspace of the process https://github.com/termux/termux-app/issues/1072#issuecommen... So the app will not work on the OS level

One will always be able to gain write access to that "user space" by having a separate app build "APK update" packages on-demand, signed by a user-controlled signature. It will be the moral equivalent of running a Linux live distribution from read-only media and having to reboot Termux for each "update". Of course, one will be able to execute other code via JIT, perhaps even hooking into a patched version of qemu-user. It will be annoying but it will broadly work.
Post reply on HN