![Android Android](http://a.fsdn.com/sd/topics/android_64.png)
![Linux Linux](http://a.fsdn.com/sd/topics/linux_64.png)
Steve "CyanogenMod" Kondik Contemplates The Death of Root On Android 240
c0d3g33k writes "Prompted by the addition of new security features in Android 4.3 that limit the effectiveness of elevated privileges, Steve Kondik wonders which uses really require full root. Most common activities that prompt owners to root their devices (backup/restore tools, firewall/DNS resolver management, kernel tuning), could be accomplished without exposing root, argues Kondik, by providing additional APIs and extensions to the user. This would improve security by limiting the exposure of the system to exploits. Reasonable enough, on the face of it. The title of the post, however, suggests that Kondik believes that eventually all useful activities can be designed into the system so the 'dangerous and insecure' abilities provided by root/administrator privileges aren't needed. This kind of top-down thinking seems a bit troubling because it leads to greater control of the system by the developer at the expense of the owner of the device. It's been said that the best tools are those that lend themselves to uses not anticipated by the creator. Reducing or eliminating the ability of the owner to use a device in ways that are unanticipated ultimately reduces its potential power and usefulness. Perhaps that's what is wanted to prevent an owner from using the device in ways that are inconvenient or contrary to an established business model."
stop phone carriers / oems from slowing down updat (Score:4, Insightful)
stop phone carriers / oems from slowing down updates and force loading software that can't be removed.
also force unlocked sims on all android phones.
CDMA2000 (Score:3)
also force unlocked sims on all android phones.
How would that work on a CDMA2000 network, which doesn't use a SIM in the first place?
Re: (Score:2)
Re: (Score:2)
Um. Last I checked (and no, it hasn't always been this way) I can talk on the phone with VZW over LTE: This is the only way that VZW allows voice and data to exist concurrently on the same handset. This works fine. Almost all of the calls I make are over LTE.
And I can also pull down a w
ObXKCD (Score:5, Funny)
All applicable XKCD [xkcd.com] should just be in tags at top of Slashdot stories.
Fairly Obvious (Score:5, Insightful)
In an ideal world, we'd have all the functionality we need straight up and "rooting" wouldn't even exist as a term.
Re: (Score:2)
Well, CynagonMod specifically has the ability to introduce new CM-specific APIs to allow this functionality.
I know I would feel much better allowing an app to do something specific rather than give it blanket authority via root.
PolicyKit for Android, perhaps?
Re: Fairly Obvious (Score:2)
What timeline do you live in? Here in 2013, iOS is getting absolutely crushed by Android.
In my opinion (Score:5, Insightful)
Most things which required me to root my phone should be preinstalled
-backup
-firewall
-disable any service *which i do not need*
Your forgot ... (Score:5, Insightful)
-remove any app *which i do not want*
Re: (Score:2)
None of those are issues for me.
All I want is to remove pre-installed bloatware so that I have more of what I want.
I've never had a backup issue because there are apps for that, and everything is in the cloud anyway.
Recurring fee (Score:3)
I've never had a backup issue because there are apps for that
Some existing "apps for that" require root to backup or restore because they try to back up private data that belongs to another application.
and everything is in the cloud anyway
If you have more than a couple GB of data to back up, cloud backup becomes an expensive recurring fee compared to backing up to local physical media.
Re: (Score:2)
Also:
Change the device ID string so I can install some badly-packaged apps from Google Play that don't know about my tablet.
Bad summary (Score:5, Insightful)
He's not talking about root going away, he's talking about reducing the need for it, in order to have much of the freedom provided by a rooted phone without the associated security risks. Whether or not root is available is a separate, and orthogonal question, and he clearly never wants to lose the ability to root, just the need.
Re:Bad summary (Score:5, Interesting)
This.
Just like Linus' justifiable rant about having to be root in SuSE to set up a printer.
There are legitimate reasons why an end user should need Root/Administrator, but they should be as few as possible. Microsoft has seen the light and has tried to beat developers over the head with UAC to make them see the light. (a game needing admin to run? seriously?)
--
BMO
Re: (Score:3)
He's not talking about root going away, he's talking about reducing the need for it
Submitter here. I'm probably a little thick, clearly Kondik meant something more subtle by naming his post "The Death of Root" than I was able to discern. Shame on me for taking that as a suggestion of where his thoughts might be turning.
Re: (Score:2)
Re: (Score:2)
Reminds me of linux without a root prompt (Score:3)
There's a certain well known Linux distro that starts with a disabled su command, because root prompts are evil. You can, however, use sudo, to run one command at a time.
Like, for instance, sudo bash.
You can provide a single API to let your user do what he wants. it's called admin access.
Re: (Score:2)
You can, however, use sudo, to run one command at a time.
Errr, I use sudo -s all the time to run as many commands as I want as root. I usually use it only because I don't want to actually have to enable a root user on my machine.
Re: (Score:2)
Yup, and if I remember the post from when I was banned from their forums for giving instructions on how to set a root password to enable su or even direct login they do it for security reasons...
Re: (Score:2, Informative)
Just use "sudo su" instead..
No no no no no no no no no no no no no no no! If you need to drop into a root shell use "sudo -i".
Re: (Score:3)
-i simulates an initial login, so it's more like "sudo su -" in that you get a root shell and all of the .profile and such are read. -s doesn't read those files.
Re:Reminds me of linux without a root prompt (Score:4, Funny)
SE/Linux (and SE/Android) (Score:5, Interesting)
there's an extremely common mistake made which needs to be pointed out: the clue is in the phrase "This kind of top-down thinking". the fundamental assumption is that there is a concept of "more privilege is required than before" to achieve privileged tasks. people imagine that security is hierarchical - that the further towards "the top" you get, the more access you are permitted. this is simply NOT TRUE. the classic example is "root", which is a drastic binary oversimplification which is simply very convenient.
so, people invent new security systems, but they invent them without actual proper thought towards design, and they invent them thinking that this "top down" hierarchical approach is the only way. thus, new APIs have to be invented.
there is another way: it's called SE/Linux (and there's a variant called SE/Android). SE/Linux follows the FLASK model, which basically says that based on the current context, the current application, that a new executable is given a COMPLETELY new security context, where the new privileges have to be explicitly given. the most important implication of this model is: it absolutely does not matter how "powerful" you were in the previous context - the one that fires up the new executable; the new one is literally a completely and utterly separate security context.
to give an example: take a 5 Star General, and send him to a security base. when he gets there, standard security procedure: they take away his passport and all his credentials, and they give him a security pass (a new context). that security pass has a pre-prepared set of restricted corridors and rooms that the 5 Star General can go to. he can go to the conference room, and the bathroom. if he tries to leave without returning the security pass, he has no passport, and no papers.
this incredibly powerful security model - FLASK basically fits on top of an OS *without* interfering with it. it's particularly fascinating because it can watch which programs exec() other programs, and it can watch what APIs those programs use.... *without* needing to actually modify those programs.
basically what i'm saying is that the problem that cyanogen is trying to solve already has a way in which it can be solved, if the SE/Android team haven't already solved it. and that's because, under SE/Linux and SE/Android, you can operate both the normal "root access" system *in parallel* with SE/Linux. all you need to do is create a FLASK security context which restricts access to only those applications that *should* be accessing the restricted APIs. you don't need to modify the applications, nor do anything special to the underlying OS.
Re: (Score:2)
the classic example is "root", which is a drastic binary oversimplification which is simply very convenient.
Indeed, but in the case of SE Linux the Five Star General ( root ) is also the guy who writes the rules about where he is allowed to go and what he is allowed do ( SE Linux config ).
SE Linux doesn't make root go away, it just usefully reduces the need for root day-to-day. But root is still the key capability in configuring the environment.
And Linux distros always have a way for root to disable boot-time or run-time SE Linux.
Re: (Score:2)
Very insightful. You've hit the nail on the head. Brilliant and concise.
Anyone else have something intelligent to add to this? We're dealing with a security model developed long ago in a context where it no longer applies, but we're forced to deal with it because a big corporation decided to cut corners by exploiting an existing system to save time rather than expending the effort to develop their own solution. So now we have cognitive dissonance.
So what is a better security model for computing systems
AdBlockPlus (Score:2)
Enough said.
Steve "CyanogenMod" Kondik (Score:2)
Am I the only one irritated by this? It should be Steve "Cyanogen" Kondik, CyanogenMod is the ROM. FFS
Re: (Score:2)
My bad. Sorry. You are fully justfied in being irritated. I was in a hurry and given the amount of poorly explained stories, I didn't just want to throw "Steve Kondik" out there and expect people to recognize the name. So I picked his pet project, rather than his nick.
Re: (Score:2)
Re: (Score:2)
Nonsense, segin.
Effective communication is the responsibility of the presenter, not the audience. Apart from the very rare instance where the audience is forced to attend, they are indulging the presenter. If the presenter doesn't deliver, the audience goes away. Telling the audience they didn't work hard enough will only make them go away faster.
You must be quite the hit at parties and social gatherings:
"Hey baby, I can light your fire better than Ivar Kreuger. Wanna light *my* matchstick? What? Who
It's needed to remove all the junk pre-installed (Score:2)
To install linux. (Score:2)
I have linux installed on my Asus Fonepad side by side with Android, allowing me to turn my phone/tablet into a nifty little netbook (using a bluetooth keybord). I like having a full LaTeX installation available, if I want to do some writing. It isn't clear to me that I could do this without root (especially if I want to run services on privileged ports). If I can't do this with Android 4.3, I will have to rethink upgrading to it, when it becomes available.
Best wishes,
Bob
permissions on Android are frustrating (Score:2)
Every release, the folks at Google decide that some other capability needs to be restricted, and some useful utility breaks. In 4.2, you don't seem to be able to enable airplane mode from third party widgets anymore, for example. Google really needs to introduce a class of trusted privileged applications that can do stuff like that. If Google doesn't do anything about this, I'm going to switch to something else because it is getting really frustrating and annoying.
Everyone just stay calm and.... (Score:4, Informative)
We've been here before (Score:2)
Pretend you used unix from the start and the web comes along decades later and you have your stuff set up all nice and lo and behold all seventeen web pages work and nearly 700 people a year look them and next thing you know your buddy wants his bread clip collection to have it's own home page and your girlfriend's friends wants to put an anthology of lesbian vegan poetty online so you go fuckit and cut and paste their stuff up then that want to update it themselves so you show them vi wish them the best of
Re:If no root, no Android. FirefoxOS anyone? (Score:5, Informative)
Re:If no root, no Android. FirefoxOS anyone? (Score:5, Insightful)
Root will be nesessary until the carriers allow us to freely uninstall their bloatware, and other useless/quasi-hostile junk (for me, that means facebook).
Re: (Score:3, Informative)
Root will be nesessary until the carriers allow us to freely uninstall their bloatware, and other useless/quasi-hostile junk (for me, that means facebook).
Good news! You haven't needed root to do that for a Long Time now. You can just click the "Disable" button in the app's details page, or drag it to the trash can from the apps drawer, and it's disabled. Sure, it's taking up a few MB of space on your system image, but, "oh well." At least, this is certainly true on any Android 4.x device I've owned.
Re:If no root, no Android. FirefoxOS anyone? (Score:5, Informative)
Good news! You haven't needed root to do that for a Long Time now. You can just click the "Disable" button in the app's details page, or drag it to the trash can from the apps drawer, and it's disabled.
Bad news! You can only disable apps that your carrier has decided that they want to allow you to disable.
Re: If no root, no Android. FirefoxOS anyone? (Score:3)
Don't "buy" your phone subsidized through your carrier? I just bought two Nexus 4's right from Google and switched carriers. No contract _and_ got a 10% discount on my bill each month by bringing my own device.
To be clear I live in Canada, and just switched to Telus.
Re: (Score:2)
Re: If no root, no Android. FirefoxOS anyone? (Score:5, Informative)
Disabled does not mean forgotten (Score:2)
Disabled does not mean forgotten. I had heaps of apps disabled on my phone. Yet once or twice a week I would get a Google Play notification to update [insert disabled and unused app].
I would be happy if they were just taking up space on my phone but as it is they annoyed me every other day.
Re: (Score:2)
Re:If no root, no Android. FirefoxOS anyone? (Score:5, Insightful)
Good news! You haven't needed root to do that for a Long Time now. You can just click the "Disable" button in the app's details page, or drag it to the trash can from the apps drawer, and it's disabled. Sure, it's taking up a few MB of space on your system image, but, "oh well."
Good news, I just took a dump on your doorstep! Don't worry though, you can just throw your doormat over it. It will still stink, but "oh well"
Re: (Score:3)
It's kind of a moot point. If the system is that badly "infected", you should probably replace the rom anyway.
On my aging Gingerbread phone, I used root to delete the OEM bloatware- Facebook, Amazon, NFL Mobile, etc. A few months later, an OTA update rolled out, and it threw a shit fit because the pre-installed crap was missing. Fortunately I had backups. Now I use Titanium Backup's "freeze" feature to disable (and prevent execution of) apps while still keeping them installed/updated.
Re: If no root, no Android. FirefoxOS anyone? (Score:5, Informative)
You don't need root to image a new ROM. You need an UNLOCKED BOOTLOADER. Two completely different things.
Re: (Score:2)
The current Android model does not address the first of these, but it does address the next two. None of these applications installs shared libraries (Android applications can't install shared libraries that are visible to other apps) and they can only be launched either expl
Re: (Score:2)
That's the #1 item on the list (Score:2)
Re: (Score:2)
No CSIM in USA (Score:3)
Or you could try supporting the concept of non-carrier devices by purchasing Nexus devices at "full price".
Good luck doing that in the United States if you happen to live where T-Mobile has poor coverage. CDMA2000 carriers in the United States don't use CSIM.
Re: (Score:2)
Re:If no root, no Android. FirefoxOS anyone? (Score:5, Informative)
I don't care if I don't root my phone until I can write to the hosts file.
Re:If no root, no Android. FirefoxOS anyone? (Score:5, Interesting)
You missed the point--he's saying that root access might one day no longer be necessary, not that it'll become impossible to root an Android device.
Exactly.
The reason people root phones is to get around arbitrary restrictions imposed by the carriers or the manufacturers.
Remove those restrictions, by providing APIs that allow users to do every legal thing, and virtually all reason to root disappear.
When you can remove bloatware, change carriers, bypass carrier restrictions, change the UI, and maybe even change the OS, all without requiring root, what would be the point of rooting?
There will still be those who will root simply because they can. These are the same kids that always ran their Linux machines at root because they were so 133t.
Re: (Score:2)
Yeah using linux on your machine makes zero sense!
Having the freedom to use any os on the hardware you own makes zero sense!
Nice thinking there.
Re: (Score:2)
At least he's thinking. You apparently have decided to forego the process.
Re: (Score:2)
Re: (Score:3)
If you expose every single thing that requires root to non-root users, then there is no distinction between root and non-root and so root is unnecessary. Very few people, for example, feel the need to enable root on OS X, but since normal users in the administrator group can sudo with their password there is no need because they can do anything that a root user can.
If, however, you expose some subset of what root can do to normal users, then you are always going to find some users who need to do some of
Re:If no root, no Android. FirefoxOS anyone? (Score:4, Informative)
You missed the point--he's saying that root access might one day no longer be necessary, not that it'll become impossible to root an Android device.
Yes, this. You shouldn't root your device "just because you can", which seems to be the mentality some people have. It greatly increases your attack surface for security vulnerabilities. I'm certain that the ability to root will stick around "forever", but for most people having a well thought out API which allows separation of privileges is going to lead to better results.
Re: (Score:3)
Re: (Score:3)
Check out XPrivacy [github.com]. Of course, it requires the Xposed Framework [xda-developers.com] to be installed. Which requires root.
Or, of course, the Privacy Guard on the new CyanogenMod 10.1 builds, but which requires CyanogenMod.
Or OpenPDroid, but that requires patching your rom.
Re: (Score:3)
Re: (Score:3)
It greatly increases your attack surface for security vulnerabilities.
As far as I understand, 'rooting your Android phone' generally allows elevation to root privileges, access to which is handled by an SU-application. That means that if you never allow anything to have root privileges, you face no increased risk at all.
on purpose, or the system, or a rogue app (Score:2)
Don't assume that all calls to sudo are you doing it on purpose. The risk is that malware could use sudo.
By way of comparison, Windows is somewhat similarly "secure unless you allow something to have elevated privileges". Compare that with a write-once DVD live system, where there is no such thing as altering the system.
Re: (Score:2)
You obviously have no experience whatsoever with a rooted Android phone. Even if malware were to call the su-application, the su-application would still prompt the user asking for privilege elevation. Now if that su-application is exploitable and the prompt can be avoided by malware, then that would be a pretty bad security risk.
Re: (Score:2)
Before assuming I have no experience, Google my name. Note you're also implying Steve Kondrick
Re: (Score:3)
You have no idea what you are talking about, do you?
Re: (Score:2)
You missed the point--he's saying that root access might one day no longer be necessary, not that it'll become impossible to root an Android device.
It sounds like Android is busy reinventing the wheel. "Root", in ye-olde-user-account-whose-powers-are-above-all-others-and-limitless, is something that (at least optionally), UNIXlikes have been picking away at (precisely because it is a big, gaping, unbelievably-non-granular, security problem) for years. You've got your conceptually simple mechanisms like OpenBSD security levels (once you elevate, suitably marked files are immutable, period, until the system is brought down) and your fairly-seriously-hair
Re: (Score:2)
You missed the point--he's saying that root access might one day no longer be necessary, not that it'll become impossible to root an Android device.
Well, it sounds like he's saying a bit of both...
"Prompted by the addition of new security features in Android 4.3 that limit the effectiveness of elevated privileges..."
Obviously it doesn't sound like root is dead right now, but it does seem Google is taking measures that could lead one to think they might lock it down more completely in the future.
Re: (Score:2)
Yes/No.
It's a classic argument. Next one will be "nobody uses root so lets make sure its never possible to root the device"... and bang, that's the point.
Expect thats the current defacto way to get full device access. The APIs that "replace" what "root is used for" give you only very specific access, not full access like root currently does.
Wi-Fi-only devices (Score:5, Insightful)
So the only people who will need it will be the carriers and NSA.
Wi-Fi carriers such as cable and DSL ISPs typically don't provide a subsidized tablet. Nor do cellular carriers outside North America and maybe Japan. So what do "carriers" necessarily have to do with rooting, especially with rooting a Wi-Fi-only device?
Re:If no root, no Android. FirefoxOS anyone? (Score:4, Informative)
what hardware? there is NO HARDWARE - thats why its on igg and not kickstarter (rules prevent vaporware)
Re: (Score:3)
Perhaps get a Jolla instead?
http://www.jolla.com/ [jolla.com]
Yeah, I've already pre-ordered mine...
Re: (Score:2)
The site doesn't actually say what a Jolla *is*. Some sort of compact tablet?
Re: (Score:3)
The first thing I noticed when upgrading to 4.3 was that my ad-blocker that works by altering the hosts file no longer works. That's one thing I'm sure Google would love to see people stop doing. I'm sure it's fixable with some new SELinux rules, but I haven't looked into it yet.
You said hosts file. Are you trying to summon him? (Score:2)
The first thing I noticed when upgrading to 4.3 was that my ad-blocker that works by altering the hosts file no longer works.
So Google is blocking one sort of APK, namely use of the hosts file as a crude DNS blacklist. Does this means we're soon going to lose another sort of APK, namely loading applications from unknown sources? Or am I clanging [wikipedia.org] again?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Joystick API (Score:2)
Re: (Score:3)
Warning: SPAM link in parent.
Re: (Score:2)
Re: (Score:2)
be gone spammer.
Re: (Score:2)
Nexus: Collect all four (Score:2)
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Steve Kondik said what he said - we shouldn't put words into his mouth. You're talking about my speculation about what this kind of approach ultimately means.
You're missing the big picture. In order to design API's or extensions that remove the need for elevated privileges for certain use cases, you need to know what those uses cases are. So you can, you know, design for them. This is the antithesis of unanticipated.
The point of administrator privileges on a system you own isn't to facilitate a set of s
Re: (Score:2)
Sorry, but you're not making much sense and don't quite seem to understand how operating systems work. If this mythical "totally safe because it limits root privileges but not really limited because you can do all the same things as you used to do with root" API you describe existed, it would be functionally the same as what currently exists. Wrapping the system in an API that allows you to do officially sanctioned 'useful' things (things that have been designed into the API) but protects you from all the
Re: (Score:2)
lesuth? Oh, you troll, is that you, you forked tongued devil? I applaud your efforts. I fed you once - are you still hungry? Sorry, other than this small treat, I have no more because your comments are devoid of meaningful content, and I require meaningful content to justify fetching you more treats. Dorothy and Toto would undoubtedly agree with me. Toto totally wants your treats. He'll be coming around to collect them when he's finished traveling to 1984 in his time machine to deal with Big Brother
Re: (Score:2)
Dude (or Dudette), you are so much fun!
Oh, Slashdot, how many years I have read thee... How many poignant articles I have digested!
Not very many, based on your ginormous UID, n00b. :-)
Thanks for that last reply of nonsense - ranks right up there with the theory. :^)
You're quite welcome. This place is too much fun to take seriously. But you're still borderline incoherent. You need to elevate your troll-fu. Or ease up on the ethanol a bit, clever lad. Your trolling will be much more effective if you can simulate a serious commentor. Your babbling is much less clever than you realize. But kudos for hanging in there and giving it the old college try.
If you were actually serio
Re: (Score:2)
Thank you for the entertainment. Why settle for a concise argument on the topic at hand when a flurry of semi-relevant sentences will do. You, sir, are the master of trolls. Or lawyers. Blessed be you and your kin.
I must leave you now. Good night.
If Google plays fair with Android (Score:2)
I don't think its a Google problem, its the carriers.
Re: (Score:2)
Yes, as a matter of fact I do. I have a Toshiba laptop with integrated Intel graphics that runs Fedora 19 with Xfce and Compiz. It works very well, TYVM, with no need for proprietary video drivers.
My desktop has nVidia graphics, and uses the same desktop and Compiz. I use the binary drivers as re-packaged for Fedora only because the OSS nouveau driver isn't qu