21 ms·

> The /system partition is now mounted nosuid for zygote-spawned processes, preventing Android applications from executing setuid programs. This reduces root at

by gergles 13y ago

> The /system partition is now mounted nosuid for zygote-spawned processes, preventing Android applications from executing setuid programs. This reduces root attack surface and likelihood of potential security vulnerabilities. Well, that sounds great. It's almost like they're trying even harder to prevent people from having control over their device.

glhaynes 13y ago
It's also like they're trying to reduce root attack surface and potential security vulnerabilities.
- Nux 13y ago
  I believe current Fedora is also setuid free, possibly other distros, too.
king_jester 13y ago
Considering there haven't been devices yet that are unroot-able, this shouldn't be a problem. At a minimum the various Nexus devices work with fastboot to unlock the device very easily.
- runjake 13y ago
  I'm guessing you're talking strictly about the Nexus line? Because there's several Android devices that have proven un-rootable thus far, such as most Motorola devices, several HTC devices, and so on.
  - Lewisham 13y ago
    Honestly, if rooting is important to you, you should be buying Nexus devices anyway, right? I realize that there are some consumers that are forced into certain handsets, and those people lose out. But many people buy devices like Galaxy S4s with the expectation to root and fix what they don't like, which is never something Samsung promises. If such consumers vote with their wallets, we'll see more things like the S4 Google Edition, which is what such buyers want in the first place. I don't see much of a problem here (exception of those people who don't have Nexus as an option for whatever reason).
  - igravious 13y ago
    You can pretty much unlock any of the bootloaders on any HTC Android device. http://www.htcdev.com/bootloader http://www.htcdev.com/bootloader From there you can install Cyanogenmod if your handset supports it, a lot do. http://wiki.cyanogenmod.org/w/Devices#vendor="HTC"; http://wiki.cyanogenmod.org/w/Devices#vendor="HTC"; There is not much point in complaining about not being able to root Android devices. Go for a Nexus or shop around. Not sure about Samsung devices -- they are the market leader after all -- so somebody'll have to help me out on that.
  - venomsnake 13y ago
    HTC give you bootloader unlock code in like 5 minutes if you request it. That is a reason why there is so strong support for the devices.
    - peterfschaadt 13y ago
      I have an HTC One X on AT&T (came out last year) and HTC will not give bootloader unlock codes from HTC Dev for phones with an AT&T CID. You have to use a root exploit to change the CID that was patched in the last firmware update, but has now been cracked again. Unfortunately, it seems no hardware manufacturer has any consistent policies.
  - fluidcruft 13y ago
    You're confusing the locked bootloader with root. All of those are rootable.
lnanek2 13y ago
Bad news for all the apps on Google Play that require rooting to use (there are some with millions of downloads), but good news for custom ROMs, I guess. A lot of people just root their phone and start using the apps they rooted for like tethering, controlling GPS and other secure settings on triggered actions, etc.. Now rooting will still be trivial for complete ROMs, but tougher to root existing ones.
- pbz 13y ago
  Do you know if Nexus 4 will be harder to root (without custom ROM) after this update? Thanks.
  - fluidcruft 13y ago
    I haven't read anywhere whether 4.3 requires the system to be mounted non-suid or merely operates that way by default. If it's not actually required, it shouldn't be too difficult to re-enable suid mount from a custom recovery (but I don't know about the SELinux parts). Conceivably, this would allow the DRM subsystems to easily detect root-able systems (and perhaps even using some sort of active probing to check whether the kernel has been modified to lie about suid mount status).
  - aray 13y ago
    You don't need a "root" to get a custom ROM (or any build for that matter) on a Nexus 4. You just have to switch the device to unlocked http://source.android.com/source/building-devices.html#unlocking-the-bootloader http://source.android.com/source/building-devices.html#unloc... Unfortunately non-google-sold devices don't have this capability as standard yet, but the Nexus 4 is good to go.
jordanthoms 13y ago
Well, there is a problem - root exploits give people control of their device, but are also, by definition, a security hole which can be exploited by malicious apps to break the sandboxing and do bad things (tm). The right solution to the issue of user control is to convince manufacturers (which many already do) to make their devices open without needing exploits, not purposefully making the OS less secure.
- drdaeman 13y ago
  Another point to consider. Android 4.3 now includes Digital Restrictions Management framework. In order to prevent users from accessing their data (or running apps) in a ways they're not allowed (copying files, advertisement blocking, tethering and so on), Google (and vendors) certainly wouldn't like users to have unrestricted access to their phones. I really think tightening security with nosuid and SELinux is at least partially due to DRM introduction.
  - nileshtrivedi 13y ago
    'fastboot oem unlock' will still work on Nexus devices, right?
    - aray 13y ago
      Yes. And not only will it continue to work, it should (hopefully) be the only way of getting a custom image. http://source.android.com/source/building-devices.html#unlocking-the-bootloader http://source.android.com/source/building-devices.html#unloc... IMO promoting 'security holes' as a mechanism of freeing your device is counter-intuitive. What everyone needs is a safe way of running their own software; security bugs are toxic to the entire ecosystem.
      - nileshtrivedi 13y ago
        I agree. Just that the parent's point that "Google (and vendors) certainly wouldn't like users to have unrestricted access to their phones" doesn't make sense in light of this fact.
veeti 13y ago
> It's almost like they're trying even harder to prevent people from having control over their device. What utter bullshit. Every Google Android device gives you the full freedom to flash whatever you want to on it. No restrictions at all. Security should not suffer because it might have a negative effect on an absolutely tiny minority of an userbase that can freely disable that added protection anyway.
- ge0rg 13y ago
  You are right with respect to the Google-sold devices. Unfortunately, these are only a minority - and this step will make it significantly harder to root devices made by Samsung, HTC, Sony and all the others...
  - veeti 13y ago
    So? That has nothing to do with Android 4.3 as far Google or the AOSP is concerned. Don't buy a device that doesn't give you control if you want that control. And no, the Nexus line is not the only line that lets you do what you want to. Although not officially supported, Samsung's flashing protocol has been reverse engineered and they've made no changes to block those efforts. HTC's newest One supports the same fastboot procedure that the Nexus line does. Most of Sony's models can also be unlocked and some even have AOSP support. This is the right move for security. It is not a move to "take control" from anyone. Instead, it is your duty to vote with your wallet. Don't buy carrier-locked phones or other phones that don't give you that control.
  - fluidcruft 13y ago
    Yes, this is what happens when Google owns Motorola. Things that Motorola cares about (tight control), Google now cares about.
  - igravious 13y ago
    The point is, you shouldn't need to root the device. That's a red herring. You can completely modify the source and then flash the device. All these manufacturers give you methods for flashing. You mention Sony[1], Samsung[2], HTC[3], here you go ... In time projects like Cyanogenmod will have ROMs baked for you that'll give you root. But why should it be easy for a user to root their device? If the user can do it a malicious program can do it. There is nothing wrong with extra security so long as the platform stays relatively open, which it seems to be. If anything handset manufacturers seem to be getting more not less dev friendly. Would you want Windows or MacOSX easy to root? [1] Sony Android source based on AOSP (Android Open Source Project) http://developer.sonymobile.com/knowledge-base/open-source/android-open-source-project-for-xperia-devices/ http://developer.sonymobile.com/knowledge-base/open-source/a... [2] Samsung Android source n stuff (unfriendly interface, a little digging is necessary, Samsung's got a lot of products) http://opensource.samsung.com/ http://opensource.samsung.com/ [3] HTC Android source n stuff, "Kernel Source Code, Binaries and Updates for HTC Android Phones" http://www.htcdev.com/devcenter/downloads http://www.htcdev.com/devcenter/downloads --- Google's AOSP n drivers (for completeness) http://source.android.com/ http://source.android.com/ https://developers.google.com/android/nexus/drivers https://developers.google.com/android/nexus/drivers

by gergles 13y ago

glhaynes 13y ago

It's also like they're trying to reduce root attack surface and potential security vulnerabilities.

Nux 13y ago
I believe current Fedora is also setuid free, possibly other distros, too.

king_jester 13y ago

Considering there haven't been devices yet that are unroot-able, this shouldn't be a problem. At a minimum the various Nexus devices work with fastboot to unlock the device very easily.

runjake 13y ago
I'm guessing you're talking strictly about the Nexus line? Because there's several Android devices that have proven un-rootable thus far, such as most Motorola devices, several HTC devices, and so on.
- Lewisham 13y ago
  Honestly, if rooting is important to you, you should be buying Nexus devices anyway, right? I realize that there are some consumers that are forced into certain handsets, and those people lose out. But many people buy devices like Galaxy S4s with the expectation to root and fix what they don't like, which is never something Samsung promises. If such consumers vote with their wallets, we'll see more things like the S4 Google Edition, which is what such buyers want in the first place. I don't see much of a problem here (exception of those people who don't have Nexus as an option for whatever reason).
- igravious 13y ago
  You can pretty much unlock any of the bootloaders on any HTC Android device. http://www.htcdev.com/bootloader http://www.htcdev.com/bootloader From there you can install Cyanogenmod if your handset supports it, a lot do. http://wiki.cyanogenmod.org/w/Devices#vendor="HTC"; http://wiki.cyanogenmod.org/w/Devices#vendor="HTC"; There is not much point in complaining about not being able to root Android devices. Go for a Nexus or shop around. Not sure about Samsung devices -- they are the market leader after all -- so somebody'll have to help me out on that.
- venomsnake 13y ago
  HTC give you bootloader unlock code in like 5 minutes if you request it. That is a reason why there is so strong support for the devices.
  - peterfschaadt 13y ago
    I have an HTC One X on AT&T (came out last year) and HTC will not give bootloader unlock codes from HTC Dev for phones with an AT&T CID. You have to use a root exploit to change the CID that was patched in the last firmware update, but has now been cracked again. Unfortunately, it seems no hardware manufacturer has any consistent policies.
- fluidcruft 13y ago
  You're confusing the locked bootloader with root. All of those are rootable.

lnanek2 13y ago

Bad news for all the apps on Google Play that require rooting to use (there are some with millions of downloads), but good news for custom ROMs, I guess. A lot of people just root their phone and start using the apps they rooted for like tethering, controlling GPS and other secure settings on triggered actions, etc.. Now rooting will still be trivial for complete ROMs, but tougher to root existing ones.

pbz 13y ago
Do you know if Nexus 4 will be harder to root (without custom ROM) after this update? Thanks.
- fluidcruft 13y ago
  I haven't read anywhere whether 4.3 requires the system to be mounted non-suid or merely operates that way by default. If it's not actually required, it shouldn't be too difficult to re-enable suid mount from a custom recovery (but I don't know about the SELinux parts). Conceivably, this would allow the DRM subsystems to easily detect root-able systems (and perhaps even using some sort of active probing to check whether the kernel has been modified to lie about suid mount status).
- aray 13y ago
  You don't need a "root" to get a custom ROM (or any build for that matter) on a Nexus 4. You just have to switch the device to unlocked http://source.android.com/source/building-devices.html#unlocking-the-bootloader http://source.android.com/source/building-devices.html#unloc... Unfortunately non-google-sold devices don't have this capability as standard yet, but the Nexus 4 is good to go.

jordanthoms 13y ago

Well, there is a problem - root exploits give people control of their device, but are also, by definition, a security hole which can be exploited by malicious apps to break the sandboxing and do bad things (tm). The right solution to the issue of user control is to convince manufacturers (which many already do) to make their devices open without needing exploits, not purposefully making the OS less secure.

drdaeman 13y ago
Another point to consider. Android 4.3 now includes Digital Restrictions Management framework. In order to prevent users from accessing their data (or running apps) in a ways they're not allowed (copying files, advertisement blocking, tethering and so on), Google (and vendors) certainly wouldn't like users to have unrestricted access to their phones. I really think tightening security with nosuid and SELinux is at least partially due to DRM introduction.
- nileshtrivedi 13y ago
  'fastboot oem unlock' will still work on Nexus devices, right?
  - aray 13y ago
    Yes. And not only will it continue to work, it should (hopefully) be the only way of getting a custom image. http://source.android.com/source/building-devices.html#unlocking-the-bootloader http://source.android.com/source/building-devices.html#unloc... IMO promoting 'security holes' as a mechanism of freeing your device is counter-intuitive. What everyone needs is a safe way of running their own software; security bugs are toxic to the entire ecosystem.
    - nileshtrivedi 13y ago
      I agree. Just that the parent's point that "Google (and vendors) certainly wouldn't like users to have unrestricted access to their phones" doesn't make sense in light of this fact.

veeti 13y ago

> It's almost like they're trying even harder to prevent people from having control over their device. What utter bullshit. Every Google Android device gives you the full freedom to flash whatever you want to on it. No restrictions at all. Security should not suffer because it might have a negative effect on an absolutely tiny minority of an userbase that can freely disable that added protection anyway.

ge0rg 13y ago
You are right with respect to the Google-sold devices. Unfortunately, these are only a minority - and this step will make it significantly harder to root devices made by Samsung, HTC, Sony and all the others...
- veeti 13y ago
  So? That has nothing to do with Android 4.3 as far Google or the AOSP is concerned. Don't buy a device that doesn't give you control if you want that control. And no, the Nexus line is not the only line that lets you do what you want to. Although not officially supported, Samsung's flashing protocol has been reverse engineered and they've made no changes to block those efforts. HTC's newest One supports the same fastboot procedure that the Nexus line does. Most of Sony's models can also be unlocked and some even have AOSP support. This is the right move for security. It is not a move to "take control" from anyone. Instead, it is your duty to vote with your wallet. Don't buy carrier-locked phones or other phones that don't give you that control.
- fluidcruft 13y ago
  Yes, this is what happens when Google owns Motorola. Things that Motorola cares about (tight control), Google now cares about.
- igravious 13y ago
  The point is, you shouldn't need to root the device. That's a red herring. You can completely modify the source and then flash the device. All these manufacturers give you methods for flashing. You mention Sony[1], Samsung[2], HTC[3], here you go ... In time projects like Cyanogenmod will have ROMs baked for you that'll give you root. But why should it be easy for a user to root their device? If the user can do it a malicious program can do it. There is nothing wrong with extra security so long as the platform stays relatively open, which it seems to be. If anything handset manufacturers seem to be getting more not less dev friendly. Would you want Windows or MacOSX easy to root? [1] Sony Android source based on AOSP (Android Open Source Project) http://developer.sonymobile.com/knowledge-base/open-source/android-open-source-project-for-xperia-devices/ http://developer.sonymobile.com/knowledge-base/open-source/a... [2] Samsung Android source n stuff (unfriendly interface, a little digging is necessary, Samsung's got a lot of products) http://opensource.samsung.com/ http://opensource.samsung.com/ [3] HTC Android source n stuff, "Kernel Source Code, Binaries and Updates for HTC Android Phones" http://www.htcdev.com/devcenter/downloads http://www.htcdev.com/devcenter/downloads --- Google's AOSP n drivers (for completeness) http://source.android.com/ http://source.android.com/ https://developers.google.com/android/nexus/drivers https://developers.google.com/android/nexus/drivers