maemo.org - Talk
Page 4 of 6 « First 23 4 56
Show 40 post(s) from this thread on one page

maemo.org - Talk (https://talk.maemo.org/index.php)
-   MeeGo / Harmattan (https://talk.maemo.org/forumdisplay.php?f=45)
-   -   Announcing INCEPTION: Deeper access to your N9 [0.1.1] (https://talk.maemo.org/showthread.php?t=82835)

coderus 2012-03-18 17:06
Re: Announcing INCEPTION: Deeper access to your N9
 
it's standart lunux sudo. google, if never worked on linux before.

Arie 2012-03-18 22:31
Re: Announcing INCEPTION: Deeper access to your N9
 
Quote:
Originally Posted by coderus (Post 1181116)
it's standart lunux sudo. google, if never worked on linux before.
Can I install it with opensh already installed?

itsnotabigtruck 2012-03-18 22:40
Re: Announcing INCEPTION: Deeper access to your N9
 
Quote:
Originally Posted by Arie (Post 1181209)
Can I install it with opensh already installed?
Yeah.

Note that coderus' sudo is probably not Aegis-aware, so you won't be able to do certain things that you can with opensh, such as run aegisctl. (not sure - correct me if I'm wrong)

rcolistete 2012-03-18 23:11
Re: Announcing INCEPTION: Deeper access to your N9
 
Thanks itsnotabigtruck for you Inception project. It made possible to :
- use Easy Debian without flashing open kernel;
- use chroot images with programming languages/tools (gcc/g++, etc);
- run binaries created by gcc/g++ running on Nokia N9.

coderus 2012-03-19 04:07
Re: Announcing INCEPTION: Deeper access to your N9
 
itsnotabigtruck, of course, it's like just su (devel-su), no extra hacky privileges =)
i made this for making me happy =) everytime using pc i'm using sudo, and when switching to phone ssh i want to use sudo too. devel-su too complicated to type :D
just usinng it for sudo apt-get, sudo dpkg, sudo nano, sudo mc and so on in daily usage =)

but of course, i can inject checking for opensh installing and make sudo work thru opensh or just sh.

Muzimak 2012-03-19 04:17
Re: Announcing INCEPTION: Deeper access to your N9
 
So has it brought any Developer any use yet and what?

coderus 2012-03-19 04:19
Re: Announcing INCEPTION: Deeper access to your N9
 
Muzimak, of course, look into chroot thread.

lkravovicz 2012-03-19 09:46
Re: Announcing INCEPTION: Deeper access to your N9
 
Quote:
Originally Posted by rcolistete (Post 1181222)
Thanks itsnotabigtruck for you Inception project. It made possible to :
- use Easy Debian without flashing open kernel;
- use chroot images with programming languages/tools (gcc/g++, etc);
- run binaries created by gcc/g++ running on Nokia N9.
Sounds like Gentoo Prefix is now possible :)

wicket 2012-03-25 19:45
Re: Announcing INCEPTION: Deeper access to your N9
 
I've noticed a couple of oddities when running an incepted opensh.

First of all, I am unable to run a simple shell script under opensh:

Code:

BusyBox v1.20.0.git (MeeGo 3:1.20-0.1+0m7) built-in shell (ash)
Enter 'help' for a list of built-in commands.

/home/developer $ cat hello.sh
#!/bin/sh

echo Hello world!
/home/developer $ ls -l hello.sh
-rwxr-xr-x    1 user    users          29 Mar 25 02:43 hello.sh
/home/developer $ ./hello.sh
Hello world!
/home/developer $ devel-su -
Password:


BusyBox v1.20.0.git (MeeGo 3:1.20-0.1+0m7) built-in shell (ash)
Enter 'help' for a list of built-in commands.

mesg: Operation not permitted
RM680-02-6_PR_RM680:~# cd ~developer
RM680-02-6_PR_RM680:/home/developer# accli -I | grep -v IMEI
Current mode: normal
Credentials:
        UID::root
        GID::root
        GRP::root
        GRP::adm
        GRP::dialout
        GRP::pulse-access
RM680-02-6_PR_RM680:/home/developer# ./hello.sh
Hello world!
RM680-02-6_PR_RM680:/home/developer# develsh


BusyBox v1.20.0.git (MeeGo 3:1.20-0.1+0m7) built-in shell (ash)
Enter 'help' for a list of built-in commands.

RM680-02-6_PR_RM680:/home/developer# accli -I | grep -v IMEI
Current mode: normal
Credentials:
        UID::root
        GID::root
        CAP::chown
        CAP::dac_read_search
        CAP::fowner
        CAP::fsetid
        CAP::kill
        CAP::linux_immutable
        CAP::net_bind_service
        CAP::net_broadcast
        CAP::net_admin
        CAP::net_raw
        CAP::ipc_lock
        CAP::ipc_owner
        CAP::sys_chroot
        CAP::sys_ptrace
        CAP::sys_pacct
        CAP::sys_boot
        CAP::sys_nice
        CAP::sys_resource
        CAP::sys_time
        CAP::sys_tty_config
        CAP::lease
        CAP::audit_write
        CAP::audit_control
        CAP::setfcap
        GRP::root
        GRP::dialout
        GRP::video
        GRP::pulse-access
        GRP::users
        GRP::metadata-users
        GRP::calendar
        AID::.develsh.
        tracker::tracker-extract-access
        tracker::tracker-miner-fs-access
        libaccounts-noa::accesssvt
        package-manager::packagemanager_limited
        package-manager::packagemanager_private
        icd2::icd2-plugin
        Cellular
        TrackerReadAccess
        TrackerWriteAccess
        Location
        FacebookSocial
        develsh::develsh
RM680-02-6_PR_RM680:/home/developer# ./hello.sh
Hello world!
RM680-02-6_PR_RM680:/home/developer# exit
RM680-02-6_PR_RM680:/home/developer# opensh


BusyBox v1.20.0.git (MeeGo 3:1.20-0.1+0m7) built-in shell (ash)
Enter 'help' for a list of built-in commands.

RM680-02-6_PR_RM680:/home/developer# accli -I | grep -v IMEI
Current mode: normal
Credentials:
        UID::root
        GID::root
        CAP::chown
        CAP::dac_override
        CAP::dac_read_search
        CAP::fowner
        CAP::fsetid
        CAP::kill
        CAP::setgid
        CAP::setuid
        CAP::linux_immutable
        CAP::net_bind_service
        CAP::net_broadcast
        CAP::net_admin
        CAP::net_raw
        CAP::ipc_lock
        CAP::ipc_owner
        CAP::sys_module
        CAP::sys_rawio
        CAP::sys_chroot
        CAP::sys_ptrace
        CAP::sys_pacct
        CAP::sys_admin
        CAP::sys_boot
        CAP::sys_nice
        CAP::sys_resource
        CAP::sys_time
        CAP::sys_tty_config
        CAP::mknod
        CAP::lease
        CAP::audit_write
        CAP::audit_control
        CAP::setfcap
        CAP::mac_override
        CAP::mac_admin
        GRP::root
        GRP::daemon
        GRP::bin
        GRP::sys
        GRP::adm
        GRP::tty
        GRP::disk
        GRP::lp
        GRP::mail
        GRP::news
        GRP::uucp
        GRP::man
        GRP::proxy
        GRP::kmem
        GRP::dialout
        GRP::fax
        GRP::voice
        GRP::cdrom
        GRP::floppy
        GRP::tape
        GRP::sudo
        GRP::audio
        GRP::dip
        GRP::www-data
        GRP::backup
        GRP::operator
        GRP::list
        GRP::irc
        GRP::src
        GRP::gnats
        GRP::shadow
        GRP::utmp
        GRP::video
        GRP::sasl
        GRP::plugdev
        GRP::staff
        GRP::games
        GRP::libuuid
        GRP::pulse
        GRP::pulse-access
        GRP::pulse-rt
        GRP::cal
        GRP::users
        GRP::input
        GRP::i2c
        GRP::adc
        GRP::upstart
        GRP::crypto
        GRP::metadata-users
        GRP::phonet
        GRP::csd
        GRP::messagebus
        GRP::acm
        GRP::gallerycoredata-users
        GRP::signon
        GRP::osa
        GRP::calendar
        GRP::libaccounts-noa
        GRP::lpm
        GRP::visualreminder
        GRP::location
        GRP::nfc
        GRP::slpgwd
        GRP::haldaemon
        GRP::powerdev
        GRP::developer
        GRP::ssh
        GRP::spool
        GRP::nogroup
        tcb
        libbb5-secbins::SEE_CCCWrite
        libbb5-secbins::SEE_DBIWrite
        libbb5-secbins::SEE_HWCWrite
        libbb5-secbins::SEE_NPCWrite
        libbb5-secbins::SEE_SecStorageMaintenance
        libbb5-secbins::SEE_SuperDongleWrite
        libbb5-secbins::SEE_SuperDongleOperation
        libbb5-secbins::SEE_SimLock3Write
        libbb5-secbins::SEE_SimLock3Operation
        libbb5-secbins::SEE_TerminalResponce
        libbb5-secbins::SEE_DeviceLockControl
        aegis-enabler::tcb-sign
        tracker::tracker-extract-access
        tracker::tracker-miner-fs-access
        libaccounts-noa::accesssvt
        package-manager::packagemanager_limited
        package-manager::packagemanager_private
        icd2::icd2-plugin
        Cellular
        TrackerReadAccess
        TrackerWriteAccess
        Location
        FacebookSocial
        csd-base::csd-plugin
        mce::CallStateControl
        mce::DeviceModeControl
        mce::LEDControl
        mce::TKLockControl
        mce::SensorControl
        dsme::DeviceStateControl
        usb-moded::usb-moded-dbus-bind
        usb-moded::USBControl
        aegisfs::AegisFSMountAdd
        aegisfs::aegisfs-verify
        timed::TimeControl
        timed::TimeBackup
        timed::TimedEventQueueWrite
        bme::BatteryControl
        phonet-at::acm-plugin
        applauncherd-launcher::access
        libaccounts-glib0::accounts-glib-access
        libaccounts-glib0::t
        libaccounts-glib0::tok
        smartsearch::RelevanceAllContentTypes
        signond::keychain-access
        signond::ssoProtectedWriteAccess
        signond::ssoProtectedReadAccess
        account-plugin-ovi::noaaccess
        account-plugin-ovi::sso-encryption-token
        caldav-plugin::access
        account-plugin-caldav::sso-encryption-token
        account-plugin-caldav::caldav-access
        account-plugin-facebook::sso-encryption-token
        account-plugin-facebook::access-control
        account-plugin-flickr::flickr-access
        account-plugin-google::sso-encryption-token
        account-plugin-google::access-control
        account-plugin-sip::sso-encryption-token
        account-plugin-sip::access-control
        account-plugin-twitter::sso-encryption-token
        account-plugin-twitter::access-control
        account-plugin-youtube::sso-encryption-token
        account-plugin-youtube::access-control
        aegis-certman-common-ca::CertCACommonAdd
        aegis-certman-common-ca::CertCAGlobalCodeSignAdd
        aegis-certman-common-ca::CertCASSLAdd
        aegis-certman-common-ca::CertCAWifiAdd
        aegis-certman-common-ca::CertCASMIMEAdd
        aegis-certman-common-ca::CertCACodeSignAdd
        aegis-certman-common-ca::CertUserSSLUse
        aegis-certman-common-ca::CertUserWifiUse
        aegis-certman-common-ca::CertUserSMIMEUse
        aegis-certman-common-ca::CertCACodeSignUse
        devicelock::ProvisioningSettings_PasswordForceChange
        devicelock::ProvisioningSettings_MinimalDeviceWipeTypeRequired
        devicelock::ProvisioningSettings_RnD_additional_Debug
        devicelock::DeviceLock_SetPassword
        devicelock::DeviceLockServiceOwn
        devicelock::DeviceLockStorageAccess
        devicelock::State_Unlocked
        devicelock::State_Locked
        devicelock::State_WipeMMC
        devicelock::State_Inhibit
        devicelock::DeviceLockControl
        devicelock::SSO_Exchange
        backup-framework::backup
        libaegis-session::aegis-session-data
        clean-device::CUDOrRFS
        system-ui-screenlock-nokia::ScreenLockEventPublish
        call-ui::call-ui
        duicontrolpanel-certificatesapplet::encryptedDBusMessages
        facebookqml::facebook-token
        mfe-account-ui-plugins::mfe-access
        mfe-account-ui-plugins::sso-encryption-token
        mms-manager::MmsProtectedWriteAccess
        mms-manager::MmsProtectedReadAccess
        mms-manager::MmsWorkerAccess
        libodnp::odnp
        libslpgw::slpgw
        location-ui::location-ui
        messaging-ui::messaging-ui
        ope-service0::OpeWapUtilAccess
        positioningd::LocationControl
        odnp-fpcd::odnp-fpcd
        signon-default-key-extension::key-storage
        signon-ui::signond-access
        telepathy-sasl-signon::sso-encryption-token
        telepathy-spirit::telepathy-spirit
        grob::grob-access
        grob::sso-encryption-token
        groovem-account-ui-plugins::groovem-access
        groovem-account-ui-plugins::sso-encryption-token
        nfcd::ui-agent
        nfcd::tool
        omb0::omb-communication
        npe-maemo0::LocationFW
        opensh::opensh
        SRC::com.nokia.maemo/local
        AID::com.nokia.maemo/local.opensh.
        account-plugin-skype::skype-access
        account-plugin-skype::sso-encryption-token
RM680-02-6_PR_RM680:/home/developer# ./hello.sh
sh: ./hello.sh: Operation not permitted
As you can see, it works fine as a regular user, as regular root user and also under a develsh shell but not under an opensh shell.

The following was written to dmesg. I hope someone can make more sense of this then I can.

Code:
[68900.679321] credp: sh: credential 0::1 not present in source SRC::9990005
[68900.679382] credp: sh: credential 0::6 not present in source SRC::9990005
[68900.679412] credp: sh: credential 0::7 not present in source SRC::9990005
[68900.679443] credp: sh: credential 0::16 not present in source SRC::9990005
[68900.679504] credp: sh: credential 0::17 not present in source SRC::9990005
[68900.679534] credp: sh: credential 0::21 not present in source SRC::9990005
[68900.679565] credp: sh: credential 0::27 not present in source SRC::9990005
[68900.679595] credp: sh: credential 0::32 not present in source SRC::9990005
[68900.679626] credp: sh: credential 0::33 not present in source SRC::9990005
[68900.679656] credp: sh: credential 3::9990209 not present in source SRC::9990005
[68900.679687] credp: sh: credential 3::9990210 not present in source SRC::9990005
[68900.679718] credp: sh: credential 3::9990211 not present in source SRC::9990005
[68900.679748] credp: sh: credential 3::9990212 not present in source SRC::9990005
[68900.679809] credp: sh: credential 3::9990213 not present in source SRC::9990005
[68900.679840] credp: sh: credential 3::9990214 not present in source SRC::9990005
[68900.679870] credp: sh: credential 3::9990215 not present in source SRC::9990005
[68900.679901] credp: sh: credential 3::9990216 not present in source SRC::9990005
[68900.679931] credp: sh: credential 3::9990217 not present in source SRC::9990005
[68900.679962] credp: sh: credential 3::9990218 not present in source SRC::9990005
[68900.679992] credp: sh: credential 3::9990219 not present in source SRC::9990005
[68900.680023] credp: sh: credential 3::9990223 not present in source SRC::9990005
[68900.680084] credp: sh: credential 3::9990001 not present in source SRC::9990005
[68900.680114] credp: sh: credential 3::9990248 not present in source SRC::9990005
[68900.680145] credp: sh: credential 3::9990283 not present in source SRC::9990005
[68900.680175] credp: sh: credential 3::9990445 not present in source SRC::9990005
[68900.680206] Aegis: credp_kcheck failed 9990005 hello.sh
[68900.680236] Aegis: hello.sh verification failed (source origin check)
[68900.696838] init: bme main process (5707) killed by KILL signal
[68900.698242] init: bme main process ended, respawning
It does run fine under opensh if I disable Aegis with "aegistl -s" as you might expect. I would be interested to know if anyone else is experiencing this behaviour either when using opensh via Inception or an open-mode kernel.

wicket 2012-03-25 19:48
Re: Announcing INCEPTION: Deeper access to your N9
 
The second thing I discovered was that it is actually possible to run an incepted opensh shell as a regular user and gain full root privileges without needing to supply a root password!

Code:
~ $ /usr/sbin/aegisctl
+esdrtxk,-az
~ $ accli -I | grep -v IMEI
Current mode: normal
Credentials:
        UID::user
        GID::users
        GRP::adm
        GRP::dialout
        GRP::pulse-access
        GRP::users
~ $ opensh


BusyBox v1.20.0.git (MeeGo 3:1.20-0.1+0m7) built-in shell (ash)
Enter 'help' for a list of built-in commands.

/home/user # id -un
root
/home/user # id -unr
root
/home/user # accli -I | grep -v IMEI
Current mode: normal
Credentials:
        UID::root
        GID::root
        CAP::chown
        CAP::dac_override
        CAP::dac_read_search
        CAP::fowner
        CAP::fsetid
        CAP::kill
        CAP::setgid
        CAP::setuid
        CAP::linux_immutable
        CAP::net_bind_service
        CAP::net_broadcast
        CAP::net_admin
        CAP::net_raw
        CAP::ipc_lock
        CAP::ipc_owner
        CAP::sys_module
        CAP::sys_rawio
        CAP::sys_chroot
        CAP::sys_ptrace
        CAP::sys_pacct
        CAP::sys_admin
        CAP::sys_boot
        CAP::sys_nice
        CAP::sys_resource
        CAP::sys_time
        CAP::sys_tty_config
        CAP::mknod
        CAP::lease
        CAP::audit_write
        CAP::audit_control
        CAP::setfcap
        CAP::mac_override
        CAP::mac_admin
        GRP::root
        GRP::daemon
        GRP::bin
        GRP::sys
        GRP::adm
        GRP::tty
        GRP::disk
        GRP::lp
        GRP::mail
        GRP::news
        GRP::uucp
        GRP::man
        GRP::proxy
        GRP::kmem
        GRP::dialout
        GRP::fax
        GRP::voice
        GRP::cdrom
        GRP::floppy
        GRP::tape
        GRP::sudo
        GRP::audio
        GRP::dip
        GRP::www-data
        GRP::backup
        GRP::operator
        GRP::list
        GRP::irc
        GRP::src
        GRP::gnats
        GRP::shadow
        GRP::utmp
        GRP::video
        GRP::sasl
        GRP::plugdev
        GRP::staff
        GRP::games
        GRP::libuuid
        GRP::pulse
        GRP::pulse-access
        GRP::pulse-rt
        GRP::cal
        GRP::users
        GRP::input
        GRP::i2c
        GRP::adc
        GRP::upstart
        GRP::crypto
        GRP::metadata-users
        GRP::phonet
        GRP::csd
        GRP::messagebus
        GRP::acm
        GRP::gallerycoredata-users
        GRP::signon
        GRP::osa
        GRP::calendar
        GRP::libaccounts-noa
        GRP::lpm
        GRP::visualreminder
        GRP::location
        GRP::nfc
        GRP::slpgwd
        GRP::haldaemon
        GRP::powerdev
        GRP::developer
        GRP::ssh
        GRP::spool
        GRP::nogroup
        tcb
        libbb5-secbins::SEE_CCCWrite
        libbb5-secbins::SEE_DBIWrite
        libbb5-secbins::SEE_HWCWrite
        libbb5-secbins::SEE_NPCWrite
        libbb5-secbins::SEE_SecStorageMaintenance
        libbb5-secbins::SEE_SuperDongleWrite
        libbb5-secbins::SEE_SuperDongleOperation
        libbb5-secbins::SEE_SimLock3Write
        libbb5-secbins::SEE_SimLock3Operation
        libbb5-secbins::SEE_TerminalResponce
        libbb5-secbins::SEE_DeviceLockControl
        aegis-enabler::tcb-sign
        tracker::tracker-extract-access
        tracker::tracker-miner-fs-access
        libaccounts-noa::accesssvt
        package-manager::packagemanager_limited
        package-manager::packagemanager_private
        icd2::icd2-plugin
        Cellular
        TrackerReadAccess
        TrackerWriteAccess
        Location
        FacebookSocial
        csd-base::csd-plugin
        mce::CallStateControl
        mce::DeviceModeControl
        mce::LEDControl
        mce::TKLockControl
        mce::SensorControl
        dsme::DeviceStateControl
        usb-moded::usb-moded-dbus-bind
        usb-moded::USBControl
        aegisfs::AegisFSMountAdd
        aegisfs::aegisfs-verify
        timed::TimeControl
        timed::TimeBackup
        timed::TimedEventQueueWrite
        bme::BatteryControl
        phonet-at::acm-plugin
        applauncherd-launcher::access
        libaccounts-glib0::accounts-glib-access
        libaccounts-glib0::t
        libaccounts-glib0::tok
        smartsearch::RelevanceAllContentTypes
        signond::keychain-access
        signond::ssoProtectedWriteAccess
        signond::ssoProtectedReadAccess
        account-plugin-ovi::noaaccess
        account-plugin-ovi::sso-encryption-token
        caldav-plugin::access
        account-plugin-caldav::sso-encryption-token
        account-plugin-caldav::caldav-access
        account-plugin-facebook::sso-encryption-token
        account-plugin-facebook::access-control
        account-plugin-flickr::flickr-access
        account-plugin-google::sso-encryption-token
        account-plugin-google::access-control
        account-plugin-sip::sso-encryption-token
        account-plugin-sip::access-control
        account-plugin-twitter::sso-encryption-token
        account-plugin-twitter::access-control
        account-plugin-youtube::sso-encryption-token
        account-plugin-youtube::access-control
        aegis-certman-common-ca::CertCACommonAdd
        aegis-certman-common-ca::CertCAGlobalCodeSignAdd
        aegis-certman-common-ca::CertCASSLAdd
        aegis-certman-common-ca::CertCAWifiAdd
        aegis-certman-common-ca::CertCASMIMEAdd
        aegis-certman-common-ca::CertCACodeSignAdd
        aegis-certman-common-ca::CertUserSSLUse
        aegis-certman-common-ca::CertUserWifiUse
        aegis-certman-common-ca::CertUserSMIMEUse
        aegis-certman-common-ca::CertCACodeSignUse
        devicelock::ProvisioningSettings_PasswordForceChange
        devicelock::ProvisioningSettings_MinimalDeviceWipeTypeRequired
        devicelock::ProvisioningSettings_RnD_additional_Debug
        devicelock::DeviceLock_SetPassword
        devicelock::DeviceLockServiceOwn
        devicelock::DeviceLockStorageAccess
        devicelock::State_Unlocked
        devicelock::State_Locked
        devicelock::State_WipeMMC
        devicelock::State_Inhibit
        devicelock::DeviceLockControl
        devicelock::SSO_Exchange
        backup-framework::backup
        libaegis-session::aegis-session-data
        clean-device::CUDOrRFS
        system-ui-screenlock-nokia::ScreenLockEventPublish
        call-ui::call-ui
        duicontrolpanel-certificatesapplet::encryptedDBusMessages
        facebookqml::facebook-token
        mfe-account-ui-plugins::mfe-access
        mfe-account-ui-plugins::sso-encryption-token
        mms-manager::MmsProtectedWriteAccess
        mms-manager::MmsProtectedReadAccess
        mms-manager::MmsWorkerAccess
        libodnp::odnp
        libslpgw::slpgw
        location-ui::location-ui
        messaging-ui::messaging-ui
        ope-service0::OpeWapUtilAccess
        positioningd::LocationControl
        odnp-fpcd::odnp-fpcd
        signon-default-key-extension::key-storage
        signon-ui::signond-access
        telepathy-sasl-signon::sso-encryption-token
        telepathy-spirit::telepathy-spirit
        grob::grob-access
        grob::sso-encryption-token
        groovem-account-ui-plugins::groovem-access
        groovem-account-ui-plugins::sso-encryption-token
        nfcd::ui-agent
        nfcd::tool
        omb0::omb-communication
        npe-maemo0::LocationFW
        opensh::opensh
        SRC::com.nokia.maemo/local
        AID::com.nokia.maemo/local.opensh.
        account-plugin-skype::skype-access
        account-plugin-skype::sso-encryption-token
This is obviously a huge security hole. I'd also like know if this problem occurs when running opensh under an open-mode kernel.

I suggest that anyone using an incepted opensh locks down both /bin/opensh and /bin/open-sh executables with 700 permissions until this is sorted.

rainisto 2012-03-25 20:18
Re: Announcing INCEPTION: Deeper access to your N9
 
Quote:
Originally Posted by wicket (Post 1184008)
The second thing I discovered was that it is actually possible to run an incepted opensh shell as a regular user and gain full root privileges without needing to supply a root password!

This is obviously a huge security hole. I'd also like know if this problem occurs when running opensh under an open-mode kernel.

I suggest that anyone using an incepted opensh locks down both /bin/opensh and /bin/open-sh executables with 700 permissions until this is sorted.
Obviously inception as such is a huge security hole. It has been always known that if you want to bypass password query you install opensh, and if you want to have the password query, then you incept develsh. As only difference between develsh and opensh is the default current user vs. setuid(0).

rainisto 2012-03-25 20:30
Re: Announcing INCEPTION: Deeper access to your N9
 
Quote:
Originally Posted by wicket (Post 1184007)
I've noticed a couple of oddities when running an incepted opensh.

First of all, I am unable to run a simple shell script under opensh:
There is nothing odd in your paste, it behaves just like aegis should. If you find that odd, then most likely you shouldn't have installed inception or incepted opensh, or atleast you should 1st study how aegis is supposed to work. http://harmattan-dev.nokia.com/docs/...ity_guide.html

itsnotabigtruck 2012-03-25 21:58
Re: Announcing INCEPTION: Deeper access to your N9
 
Quote:
Originally Posted by wicket (Post 1184008)
The second thing I discovered was that it is actually possible to run an incepted opensh shell as a regular user and gain full root privileges without needing to supply a root password!

<snip>
This is why installing opensh is optional - it makes things wide open, often more so than you want. I've been meaning to build a replacement that has a password prompt, à la sudo. (If someone else is interested in implementing one, that would be greatly appreciated; what INCEPTION needs is apps, apps, and more apps!)

Note that as long as Aegis is exploitable, an evil unprivileged app could still obtain full access even without opensh - it would just be more difficult. opensh is essentially poking a hole through a dam that's already leaky.

@rainisto develsh doesn't have a password prompt either, though - so if incepting it does grant it full privileges, doing so is exactly as much of an issue as installing opensh, I'd imagine.

wicket 2012-03-25 23:59
Re: Announcing INCEPTION: Deeper access to your N9
 
Well I knew that the purpose of opensh was to provide real root, what I didn't realise was that setuid(0), setgid(0) was used to achieve this. I'll admit I was naive to install it without knowing this but what surprised me was how nothing has been done to lock it down. To quote the author (http://maemo.cloud-7.de/HARM/N9/openmode_kernel_PR1.1/):

Quote:
Q: But isn't it a big security risk?
---------------------------------
A: Not at all, as user needs to boot into open mode kernel, something that no malware
could do. Of course once you switched "to the dark side" and got opensh installed
on your system, it is basically as safe or vulnerable to malware attacks as any other
linux system, maybe marginally better still thanks aegis.
No way is the default install of opensh as safe as any Linux system. Perhaps most people here find it acceptable to be able to gain root access without some form of password or key. Fremantle's rootsh was just as vulnerable.

itsnotabigtruck 2012-03-26 03:54
Re: Announcing INCEPTION: Deeper access to your N9
 
Quote:
Originally Posted by wicket (Post 1184067)
Well I knew that the purpose of opensh was to provide real root, what I didn't realise was that setuid(0), setgid(0) was used to achieve this. I'll admit I was naive to install it without knowing this but what surprised me was how nothing has been done to lock it down. To quote the author (http://maemo.cloud-7.de/HARM/N9/openmode_kernel_PR1.1/):



No way is the default install of opensh as safe as any Linux system. Perhaps most people here find it acceptable to be able to gain root access without some form of password or key. Fremantle's rootsh was just as vulnerable.
If opensh asserted all Aegis credentials, but didn't switch to the root user, one could still trivially become root using either the tcb or CAP::setuid credentials, both of which would be available. Merely having opensh run as the current user wouldn't do anything at all to improve security.

Under other circumstances I'd be a bit more fervent about locking down access to credentials/root, but with Harmattan as it is I'm afraid it's a bit of a lost cause. That said, the Aegis-aware sudo I proposed earlier is definitely something that's required.

Edit: Also, you can get rid of opensh without getting rid of INCEPTION - just do apt-get remove opensh from a root shell and you're set.

rainisto 2012-03-26 04:59
Re: Announcing INCEPTION: Deeper access to your N9
 
And ofcourse the real security hole is that one can make application to ovi store, and which would check the existance of /usr/sbin/incept and if binary is found then incept malware into device, and if binary is not found then do nothing.

So 1st you should make /usr/sbin/incept to set and query some custom password to able to be run it (which would not be rootme ie force change of default passwd).

coderus 2012-03-26 15:19
Re: Announcing INCEPTION: Deeper access to your N9
 
tried to make sudo work with all credentials, no succes. too little skill in linux. need help =)

zszabo 2012-03-26 18:59
Re: Announcing INCEPTION: Deeper access to your N9
 
Quote:
Originally Posted by coderus (Post 1184282)
tried to make sudo work with all credentials, no succes. too little skill in linux. need help =)
After running

Code:
/usr/sbin/incept sudo_1.6.8p12-4osso28+0m6_armel.deb
Run

Code:
EDITOR=/usr/bin/vi /usr/sbin/visudo
to edit the sudoers file.

A guide on the sudoers file (content, syntax) can be found here: https://help.ubuntu.com/community/Sudoers

coderus 2012-03-26 19:19
Re: Announcing INCEPTION: Deeper access to your N9
 
man, i know. i trying to compile sudo to have all credentials. my last success is:
Code:
~ $ sudo su
Password:


BusyBox v1.20.0.git (MeeGo 3:1.20-0.1+0m7) built-in shell (ash)
Enter 'help' for a list of built-in commands.

~ # accli -I
Current mode: open
IMEI: 357923040175103
Credentials:
        UID::root
        GID::root
        CAP::chown
        CAP::dac_override
        CAP::dac_read_search
        CAP::fowner
        CAP::fsetid
        CAP::kill
        CAP::setgid
        CAP::setuid
        CAP::linux_immutable
        CAP::net_bind_service
        CAP::net_broadcast
        CAP::net_admin
        CAP::net_raw
        CAP::ipc_lock
        CAP::ipc_owner
        CAP::sys_module
        CAP::sys_rawio
        CAP::sys_chroot
        CAP::sys_ptrace
        CAP::sys_pacct
        CAP::sys_admin
        CAP::sys_boot
        CAP::sys_nice
        CAP::sys_resource
        CAP::sys_time
        CAP::sys_tty_config
        CAP::mknod
        CAP::lease
        CAP::audit_write
        CAP::audit_control
        CAP::setfcap
        CAP::mac_override
        CAP::mac_admin
        GRP::root
        GRP::adm
        GRP::dialout
        GRP::pulse-access

zszabo 2012-03-26 19:32
Re: Announcing INCEPTION: Deeper access to your N9
 
Since sudoers already contains a line that lets "user" run anything, how about:

Code:
/usr/bin/sudo /bin/opensh -c /bin/bash --rcfile <rc filename>
(provided you have bash)

That gives me all credentials.

coderus 2012-03-26 19:36
Re: Announcing INCEPTION: Deeper access to your N9
 
no, our discussing about using sudo instead of opensh, for having password prompt and better security.
and need to have all credentials inside sudo shell

zszabo 2012-03-26 19:51
Re: Announcing INCEPTION: Deeper access to your N9
 
Quote:
Originally Posted by coderus (Post 1184369)
no, our discussing about using sudo instead of opensh, for having password prompt and better security.
If you set timestamp_timeout=0 in sudoers, it will ask for a password every time that line is run. Just don't add NOPASSWD: to the sudoers definition.

itsnotabigtruck 2012-03-26 21:27
Re: Announcing INCEPTION: Deeper access to your N9
 
Quote:
Originally Posted by coderus (Post 1184360)
man, i know. i trying to compile sudo to have all credentials. my last success is:
Code:
~ $ sudo su
<snip>
I think that's the problem. Try doing sudo -i instead, then see what credentials you have.

BTW Consider editing your IMEI out of any accli printouts you post!

Quote:
Originally Posted by zszabo (Post 1184375)
If you set timestamp_timeout=0 in sudoers, it will ask for a password every time that line is run. Just don't add NOPASSWD: to the sudoers definition.
The problem he's having has nothing to do with the sudoers file - it has to do with obtaining the correct Aegis credentials after sudoing.

coderus 2012-03-27 11:49
Re: Announcing INCEPTION: Deeper access to your N9
 
sudo su, sudo -i, sudo -u have same credentials. sudo accli -I return minimal user credentials.
i'm not worry about my imei, i'm not paranoic :D

m4r0v3r 2012-04-06 11:57
Re: Announcing INCEPTION: Deeper access to your N9
 
i think i've installed inception correctly and then opensh, so i run opensh, and run accli -I and I get this

Quote:
UID::root
GID::video
CAP::chown
CAP::dac_read_search
CAP::fowner
CAP::fsetid
CAP::kill
CAP::linux_immutable
CAP::net_bind_service
CAP::net_broadcast
CAP::net_admin
CAP::net_raw
CAP::ipc_lock
CAP::ipc_owner
CAP::sys_chroot
CAP::sys_ptrace
CAP::sys_pacct
CAP::sys_boot
CAP::sys_nice
CAP::sys_resource
CAP::sys_time
CAP::sys_tty_config
CAP::lease
CAP::audit_write
CAP::audit_control
CAP::setfcap
GRP::root
GRP::dialout
GRP::video
GRP::pulse-access
GRP::users
GRP::metadata-users
GRP::calendar
tracker::tracker-extract-access
tracker::tracker-miner-fs-access
libaccounts-noa::accesssvt
package-manager::packagemanager_limited
package-manager::packagemanager_private
icd2::icd2-plugin
Cellular
TrackerReadAccess
TrackerWriteAccess
Location
FacebookSocial
AID::.opensh.
opensh::opensh
but the problem is i can't run this command

tar xjvf /home/user/MyDocs/sillyboot_2.tar.bz2 -C /

tar: can't remove old file sbin/preinit: Permission denied

with that error, will this definitely require open mode? since I thought opensh should of given me full control.

ah nvm seems theres no way but to flash open mode

coderus 2012-04-06 13:22
Re: Announcing INCEPTION: Deeper access to your N9
 
this is wrong thread to ask about nitdroid.
(you should flash to dualboot kernel)

semua 2012-04-10 15:38
Re: Announcing INCEPTION: Deeper access to your N9
 
I'm not able to "incept" my N9. I have tried several times with "pasiv" (devel-su -c /usr/sbin/pasiv) but it always ends with:

Code:
|| PASIV device activated
pasiv: fatal error occurred
~ $
:confused:... I don't know what to do... any suggestion would be very welcome!

Edit: It is running Harmattan PR1.2

itsnotabigtruck 2012-04-11 02:09
Re: Announcing INCEPTION: Deeper access to your N9
 
Quote:
Originally Posted by semua (Post 1190452)
I'm not able to "incept" my N9. I have tried several times with "pasiv" (devel-su -c /usr/sbin/pasiv) but it always ends with:

Code:
|| PASIV device activated
pasiv: fatal error occurred
~ $
:confused:... I don't know what to do... any suggestion would be very welcome!

Edit: It is running Harmattan PR1.2
This should reveal exactly where it's failing: devel-su -c 'develsh -v /usr/sbin/pasiv'

semua 2012-04-11 15:50
Re: Announcing INCEPTION: Deeper access to your N9
 
Quote:
Originally Posted by itsnotabigtruck (Post 1190590)
This should reveal exactly where it's failing: devel-su -c 'develsh -v /usr/sbin/pasiv'
Thanks for the help! (and, of course, for "Inception" :) )

Strangely enough, it works perfectly today (I restarted the phone, but I tried that before my previous post...).

rcolistete 2012-04-12 23:43
Re: Announcing INCEPTION: Deeper access to your N9
 
Quote:
Originally Posted by itsnotabigtruck (Post 1190590)
This should reveal exactly where it's failing: devel-su -c 'develsh -v /usr/sbin/pasiv'
Hi itsnotabigtruck,

Could you confirm : can Inception work with open mode kernels ?

Yeah, I know they are alternatives, so the user should decide between open mode kernel OR Inception.

But there are users using both : open mode kernels AND also Inception. In this way creating confusion to support them in some uses (Easy Debian, Overclocking, etc).

itsnotabigtruck 2012-04-13 00:08
Re: Announcing INCEPTION: Deeper access to your N9
 
Quote:
Originally Posted by rcolistete (Post 1191411)
Hi itsnotabigtruck,

Could you confirm : can Inception work with open mode kernels ?

Yeah, I know they are alternatives, so the user should decide between open mode kernel OR Inception.

But there are users using both : open mode kernels AND also Inception. In this way creating confusion to support them in some uses (Easy Debian, Overclocking, etc).
Yep, it works fine. Most of the people installing it in open mode are doing so because they don't know about AEGIS_FIXED_ORIGIN, but using INCEPTION doesn't really hurt anything, and it's probably a little bit more convenient.

Waynder 2012-04-15 09:15
Re: Announcing INCEPTION: Deeper access to your N9
 
i got me self a tiny problem...

Waynder 2012-04-16 14:28
Re: Announcing INCEPTION: Deeper access to your N9
 
i dont know how to "incept" aegisctl_1.2.armel.deb


instructions are...

"Download the package you would like to install; the wget utility (apt-get install wget) is very useful for this.
wget -O awesome-package_1.0_armel.deb http://awesome.tld/awesomeapp/install.deb
# This is an example - don't download"

so what do i punch in instead of example... URL location of the .deb i want to "incept"? what about this part ///awesome-package_1.0_armel.deb///


sorry... not so good with linux in code -.-

Creamy Goodness 2012-04-16 16:16
Re: Announcing INCEPTION: Deeper access to your N9
 
you don't *have* to use wget, it's just given as a way to get the package onto your device.
so just skip that part if you can download the file and save it somewhere using another method.

coderus 2012-04-16 18:15
Re: Announcing INCEPTION: Deeper access to your N9
 
@Waynder, LOL. You should read full instruction to understand it. Or never use INCEPTION, forget, it is not for you.

Arie 2012-04-16 19:00
Re: Announcing INCEPTION: Deeper access to your N9
 
Quote:
Originally Posted by coderus (Post 1192895)
@Waynder, LOL. You should read full instruction to understand it. Or never use INCEPTION, forget, it is not for you.
As much as I hate to agree with Coderus on this one, he is right.

nieldk 2012-04-16 19:44
Re: Announcing INCEPTION: Deeper access to your N9
 
Quote:
Originally Posted by Arie (Post 1192912)
As much as I hate to agree with Coderus on this one, he is right.
+1

(10 chars)

Waynder 2012-04-17 05:37
Re: Announcing INCEPTION: Deeper access to your N9
 
Quote:
Originally Posted by coderus (Post 1192895)
@Waynder, LOL. You should read full instruction to understand it. Or never use INCEPTION, forget, it is not for you.
well... thanx for apple attitude =P

i was alble to follow instructions for n900 kernel changing, overclocking, nitDROID installing (in code step by step, before one click installation) etc... i just have a glitch in this one....


thanx for helpin out, tough -.-


______

FYI i managed it after all... so im not a complete idiot =P

forum was much more friendly 1 year ago...

Sorrow 2012-04-17 07:28
Re: Announcing INCEPTION: Deeper access to your N9 [0.1.1]
 
I've got new devtools and dev-mode updates today. Did anybody check if they brake inception?

itsnotabigtruck 2012-04-17 12:09
Re: Announcing INCEPTION: Deeper access to your N9 [0.1.1]
 
Quote:
Originally Posted by Sorrow (Post 1193140)
I've got new devtools and dev-mode updates today. Did anybody check if they brake inception?
They did, but I already released the 0.1.1 update to counter it. Install the new version and you'll be fine. :)


All times are GMT. The time now is 12:07.
Page 4 of 6 « First 23 4 56
Show 40 post(s) from this thread on one page

vBulletin® Version 3.8.8