4 ms·
Even when arbitrary code is being executed, if the user has limited permissions kernel-level, a program can't screw up the whole system. The Android NDK is rel
by udp 15y ago
Even when arbitrary code is being executed, if the user has limited permissions kernel-level, a program can't screw up the whole system.
The Android NDK is reliant on this - any application in Android can perform your arbitrary code execution, and it seems to be working out alright.
- oconnore 15y agoThe kernel is not some almighty bug free program. The question is then just whether or not the person who has gained the capacity to run code on your system knows an exploit that will give them root privileges. The Android thing works because you aren't just running arbitrary code, you are probably running code that you got from the Android Marketplace, which was probably screened to make sure it doesn't do something bad.
- udp 15y agoHow would they be screened? If you include native libraries in your APK, they're binaries, not code. They could scan the binary for API calls, but you're permitted to call dlopen() etc, so you could always hide a shared object in there and call it dynamically.
- aidenn0 15y agoOkay, you can't screw up the whole system, but you can install a keylogger (X has got to be the most insecure windowing system out there), and you can use the system for a DDoS botnet. Also if you use sudo or su in X, they now have root thanks to the keylogger.