3 ms·

Is there a legitimate reason for the Android sandbox to allow calls to `system()`?

• archi42 7y ago
  I suppose in case you ship some prebuilt executable to do stuff? E.g. ffmpeg. Just a guess, though.
  • asveikau 7y ago
    IMO execve with its already-parsed-argv is a much safer way to invoke another program. You don't need the shell to interpret the boundaries of command line arguments, it invites trouble.
    • archi42 7y ago
      Doesn't execve() end in the same syscall as system()? Not as comfortable for exploitation, but maybe still feasible? (Embedded systems I take a look at usually don't have an OS with either of the two, so I honestly don't know how the implementations look like).
      • asveikau 7y ago
        system() basically does a fork and an execve of sh -c 'arg passed to system()', then waitpid to block on the result. execve is a syscall, system is a libc function.
      • saagarjha 7y ago
        execve("/bin/sh", NULL, NULL) is a quite common replacement for system() in exploits.
• caleb-allen 7y ago
  Is issue related to what you're talking about? https://issuetracker.google.com/issues/128554619 https://issuetracker.google.com/issues/128554619 As of Android Q you can no longer execute native binaries that aren't shipped in the .apk, is that related? (not a systems dev, hence the question)