| 30 Aug 2022 |
 inference | In reply to @darkjac:darkstars.me
what the absolute fuck xD the FSF kinda sucks
while I believe in "FOSS all the way", I also believe in security. So as long as we need proprietary updates, we should not use the linux-libre kernel This. | 10:36:18 |
| inference | We can go towards FOSS, sure, but it's not possible to just abandon ship instantly. That's stupid. | 10:36:51 |
| inference | In reply to @capybara_:matrix.org
But I don’t really understand how it works Android user profiles are 100% isolated from each other. Even the admin profile doesn't have access to the others. | 10:38:25 |
| inference | Apps can only access data inside the same user profile, and don't even know the other profiles exist. | 10:38:54 |
 Horo | In reply to @inference:tchncs.de
Android user profiles are 100% isolated from each other. Even the admin profile doesn't have access to the others. So basiaclly a /home/{a,b} with permissions 700? | 10:39:54 |
| inference | In reply to @the_horo:matrix.org
So basiaclly a /home/{a,b} with permissions 700? Strong than just DAC. It has full UID isolation. | 10:40:55 |
| inference | SELinux is used, not just 700. | 10:41:16 |
| inference | It can't even look at the filesystem to see there are other profiles. | 10:41:51 |
| inference | It can only see its own data. | 10:41:59 |
| Horo | Neat | 10:42:21 |
 /home/jacob | In reply to @inference:tchncs.de
Pixel 6 arrived.
Waiting for case and eSIM. Probably 3 days or so. whoooooop, lots of fun with it! | 11:16:49 |
| /home/jacob | In reply to @inference:tchncs.de
It can't even look at the filesystem to see there are other profiles. ye, it's an "emulated" storage. Much better than anything you do in a normal Linux environment | 11:17:41 |
| /home/jacob | but there is one thing i wonder about: how can i make it so that profiles are completely killed when i switch to another one? | 11:18:41 |
 capybara_ | In reply to @inference:tchncs.de
Android user profiles are 100% isolated from each other. Even the admin profile doesn't have access to the others. Ok what if some major privilege escalation and then persistence to wait until user logs into other profile? | 11:21:05 |
| capybara_ | Or I guess persistence is impossible | 11:21:27 |
| capybara_ | In reply to @darkjac:darkstars.me
but there is one thing i wonder about: how can i make it so that profiles are completely killed when i switch to another one? Non owner profiles can be stopped | 11:22:48 |
| /home/jacob | In reply to @capybara_:matrix.org
Ok what if some major privilege escalation and then persistence to wait until user logs into other profile? afaik not possivle. The concept of "priviliged app" doesn't even really exist in GOD | 11:22:53 |
| /home/jacob | In reply to @capybara_:matrix.org
Non owner profiles can be stopped ye but how automatically? that is what i want | 11:23:04 |
| capybara_ | what privileges are there even in android? kernel -> root -> app? | 11:23:35 |
| inference | 
Download aa367d17-40e4-4518-8eab-e2cd03dec40c.png | 11:24:40 |
| inference | Bottom to top. | 11:24:43 |
| capybara_ | looks complicated | 11:25:03 |
| capybara_ | It’s better to just ask an expert. flawedworld | 11:25:19 |
| inference | It simply shows how everything is isolated. | 11:26:00 |
| capybara_ | What level of compromised privilege can a profile separate from? For example I surely know that apps can’t communicate across profiles then I don’t that profiles can separate app privileges | 11:26:26 |
| capybara_ | * What level of compromised privilege can a profile separate from? For example I surely know that apps can’t communicate across profiles then profiles can separate app privileges | 11:27:00 |
| inference | In reply to @capybara_:matrix.org
What level of compromised privilege can a profile separate from? For example I surely know that apps can’t communicate across profiles then I don’t that profiles can separate app privileges If a profile was compromised, an attacker could only see inside that profile. | 11:27:12 |
| capybara_ | What is a profile? Is it a privilege that lets you see everything that happens in the profile or what? | 11:27:46 |
| inference | Even if the admin profile was compromised, it could only see inside itself. Admin has no special access to other profiles. | 11:28:00 |
| inference | In reply to @capybara_:matrix.org
What is a profile? Is it a privilege that lets you see everything that happens in the profile or what? A profile is effectively a user account. | 11:28:19 |
