SELinux on Android

SELinux on Android

Some random thoughts in reply while I'm waiting for this compile to finish...

Grsecurity is much more than RBAC; the kernel hardening aspects come with some (usually minor) performance penalties, which might be an issue on battery-operated devices, but I'm willing to trade some battery life for better protection against 0days.

I'm fairly optimistic that unlocked phones and tablets will be remain available. We're getting to the point where the functionality of devices several generations old is still perfectly usable.

For USAians, it would be nice if our Congress got rid of the DMCA and demanded more openness for devices, perhaps arguing that device owners have a right to engage in self-service once a device is abandoned by the manufacturer (no more updates). [Though I can hear the wails of protest by lobbyists that the world economy will collapse if the "new shiny" can't be forced upon consumers every 2-3 years.] This might go hand-in-hand with Dan Geer's proposal to hold vendors liable for security, and only allow them to disclaim liability only via openness.

As for softmodems, Nvidia acquired Icera and now uses the Icera LTE softmodem running on the baseband processor of the Tegra 4i. Whether we'll ever get to a place where similar code is, if not open source, at least wrapped in a sandbox with verifiable inputs and outputs, is difficult to say, though I think it unlikely.

If people want to avoid having their communications monitored or blocked at protests, and other events, then they need to ditch telco service and use WiFi with random MACs on their rooted devices. If cruise lines can supply passengers with messaging apps that work on-board, surely we can put better technology in the hands of protesters, particularly since we have mesh networking already available in the Linux networking stack. Sure, then WiFi jammers will be deployed, and the response will eventually require full-on SDR.

Afterwards, needless to say, people will get in their cars all amped up and discuss the whole event, while OnStar or your Android or Tizen-based IVI relays unique IDs and perhaps whole conversations to the interested parties. :-/