Interesting. This is not something that has a simple fix and can be patched. The arms race continues. Or we could end it and give users (limited) root access t

Interesting. This is not something that has a simple fix and can be patched. The arms race continues. Or we could end it and give users (limited) root access to their stock phones. Let us run OCI containers with restricted root user accounts. Bind mount certain filesystems given the correct Android permissions, such as the SD card or internal storage, or the user's emulated root. Or supported nested ARM virtualization. Modern Linux supports a uid 0 with less than complete access in a cgroup, using the LSM to regulate specific capabilities, or creating the cgroup with limited caps to begin with. Make access to areas the carrier considers sensitive conditional on a capability, or limit access to the full video decode hardware or shared memory from this root jail. I have been able to compile but not run the runc binary from OCI/docker/rkt. Nested cgroupfs would solve a lot of these restrictions.