Thread: QuadRooter: New Android Vulnerabilities
View Single Post
MartinK is offline MartinK
2016-08-09 , 20:24
Posts: 1,548 | Thanked: 7,510 times | Joined on Apr 2010 @ Czech Republic
#27
Originally Posted by javispedro View Post
No, and 1000 times no. The "library whitelist" in the Jolla Store basically exists out of some (in my opinion, as discussed almost two years ago, misguided) concern about binary compatibility with future SailfishOS versions.

It does absolutely nothing regarding security.

I mean, just look at what most people do to escape the library whitelist: statically link to whatever library they feel like.
Yeah - it basically comes down to accepting random binaries from random people, which is really not a good idea unless you have a very good sandboxing.

And good sandboxing that does not reduce all applications to toys due to blocking critical functionality is hard...

That's why most "normal" Linux distros accept software to their repositories in a source form only & require it to built on the distro managed infrastructure. While this is also not foolproof (you would have to read & audit the complete source code of all the software you accept to be 100% sure), it's still much better than accepting random binaries.

Originally Posted by javispedro View Post
I have no idea how much sandboxing is done in AlienDalvik (it is proprietary) but my wild guess is also "none".
I would kinda assume it at least does the standard Android sandboxing (running apps separately, each, under it's own user, etc.). On the other hand it is indeed proprietary, so all bets are off - they might as well have left it out to make the emulation easier/faster etc. And we have no way (well, no easy way) of checking for that.
__________________
modRana: a flexible GPS navigation system
Mieru: a flexible manga and comic book reader
Universal Components - a solution for native looking yet component set independent QML appliactions (QtQuick Controls 2 & Silica supported as backends)
 

The Following 7 Users Say Thank You to MartinK For This Useful Post: