Reply
Thread Tools
Posts: 268 | Thanked: 1,053 times | Joined on May 2010 @ The Netherlands
#311
Alright, who wants to test busybox-power for Harmattan?

You'll need to incept the deb, or install it with AEGIS_FIXED_ORIGIN=com.nokia.maemo if you're running Open Mode*. I previously said this wouldn't be necessary, but although I did got it working that way, I learned that busybox-power will be a lot less cleaner and less user friendly if we go that route.

Busybox-power for Harmattan has two dependencies not found in busybox-power for Fremantle: aegisctl and meego-confirm-text.
  • Aegisctl is used to temporarily disable the source origin check for binaries during the period between (un)installing busybox-power and a reboot**. We could do away with this dependency by reloading Harmattan's refhashlist after (un)installation (which we do ayway), but then there would be a very brief period in which /bin/busybox would be inaccessible (!). As brief as this period is, I can't guarantee that no script on the entire device will try to access /bin/busybox in that period, hence the dependency.
  • Meego-confirm-text is a small (~20KiB) QML/C++ application I made to provide a maemo-confirm-text implementation for Harmattan. It is used to display the warning you'll have to agree with during the first busybox-power installation and displaying encountered issues during uninstallation, just like on Fremantle. This application might be useful for other packages or scripts as well (for displaying Licence agreements or warnings).

Please go forth and test this testing release. I've tried the most obscure (un)install situations I could think of and did not encounter any issues, so I have good faith in the current (un)install framework. Furthermore, since Harmattan ships with a pretty recent BusyBox version, little problems should arise from using busybox-power (I have yet to encounter any ). If you do find a regression however, don't hesitate to let me know!

Obligatory warning: Prepare for the worst, backup your important data. Download links:
Meego-confirm-text: https://garage.maemo.org/frs/downloa....0.1_armel.deb
Aegisctl: http://talk.maemo.org/showthread.php?t=82991
Busybox-power for Harmattan (needs to be incepted): https://garage.maemo.org/frs/downloa...tan0_armel.deb

On other news: I've integrated dpkg-divert in busybox-power for Fremantle. I was previously unaware of this nifty little utility (I don't run a Debian-based OS on my laptop), hence it was not used before. By creating a diversion for /bin/busybox, future BusyBox updates (e.g. by CSSU) won't overwrite our binary.
Unfortunately Nokia has disallowed diversions on Harmattan, so we can't use them there.

All changes made to busybox-power, as well as meego-confirm-text's source, will be pushed shortly to busybox-power's garage page.

* I have not tested busybox-power in Open Mode yet, but I can't think of any issues that would arise. Please hold off installing the deb for a while until I've tested it myself if you want verification. I'll have to read up on entering Open Mode first though .

** I do have some code ready to re-enable the check accordingly to its previous state, but I'm not sure it'll work in Open Mode and is therefore not included yet. I plan to include this feature as soon as my device gets into Open Mode. Until then, it is best to reboot your device after (un)installing busybox-power for maximum security.

Edit: heh, forgot that this topic is posted in the "Maemo 5 / Fremantle" subforum. Well, I suppose that this thread will need to be moved to "Applications" once busybox-power for Harmattan sees its final release.

Last edited by iDont; 2012-10-17 at 21:40.
 

The Following 7 Users Say Thank You to iDont For This Useful Post:
Posts: 1,225 | Thanked: 1,905 times | Joined on Feb 2011 @ Quezon City, Philippines
#312
Awesome. I assume that we can skip rebuilding refhashlist with Open Mode?

Edit: Didn't read the part where you didn't test it under Open Mode.
I'll go test it myself, then.
__________________
N9 PR 1.3 Open Mode + kernel-plus for Harmattan
@kenweknot, working on Glacier for Nemo.
 
Posts: 268 | Thanked: 1,053 times | Joined on May 2010 @ The Netherlands
#313
Originally Posted by Hurrian View Post
Awesome. I assume that we can skip rebuilding refhashlist with Open Mode?

Edit: Didn't read the part where you didn't test it under Open Mode.
I'll go test it myself, then.
The refhashlist gets automatically resigned in postinst/prerm. Unless the signing actually fails in Open Mode (accli return a non-zero status), installation should go fine. I assume the singing will go fine, although it obviously won't have any effect in Open Mode.
If the signing would fail however, the postinst/prerm will handle it gracefully.

P.S. you could inspect the postinst/prerm file yourself, the relevant commands can be found in INSTALL() and UNINSTALL() respectively. If you, or anyone else, sees something that would not work in Open Mode, let me know. I'll try to go into Open mode myself today, so I hope to know by the end of the day whether the (un)installation in its current form works in Open Mode or not.

Update: there are two flavours of Open Mode: one with aegis neutered ("patched" Open Mode), and one without. The current busybox-power installation works on both, but is less than ideal when running patched Open Mode. I need to create a function that can reliably determine whether aegis' source origin check is enabled or not and call aegisctl accordingly. Aegisctl itself won't do for this check, it reports the check is enabled in patched Open Mode.
The function is required since it's best not to call aegisctl to modify security options in patched Open Mode; aegisctl appears to fail when you try to run it a second time without a reboot in between. Stay tuned for updates.

Last edited by iDont; 2012-10-18 at 18:12.
 
Posts: 1,225 | Thanked: 1,905 times | Joined on Feb 2011 @ Quezon City, Philippines
#314
I would definitely wonder how exactly you'd check for that using the regular Aegis tools, as with the neutered Aegis ("Yes, we passed all checks, sire!") kernel, it does what it says on the lid - not return an -EPERM.

Perhaps check uname for the build date? IIRC there is no versioning method published for these kernels, especially that they're not flashable on-device like the N900.

I suggest that new aftermarket kernels leave a sysfs entry (/sys/kernel/security/validator/neutered, perhaps?) to let developers know which kind of device they're working with. Especially when it's an unknown ratio of Inception:Openmode users.
__________________
N9 PR 1.3 Open Mode + kernel-plus for Harmattan
@kenweknot, working on Glacier for Nemo.
 
Posts: 268 | Thanked: 1,053 times | Joined on May 2010 @ The Netherlands
#315
Originally Posted by Hurrian View Post
I would definitely wonder how exactly you'd check for that using the regular Aegis tools, as with the neutered Aegis ("Yes, we passed all checks, sire!") kernel, it does what it says on the lid - not return an -EPERM.
The only way I can think of to reliably determine aegis' true enforcement status, is by actually testing it. We only need to get an executable file under aegis' protection, backup & modify it, and test whether it can still be executed. This executable file could be a simple shell script that calls "exit 0".
The executable file and code to "test it" (and restore it afterwards) could be included in busybox-power's packaging or a separate "aegis-test-enforcement" package (which could be reused by other packages).

Unfortunately, this is by all means not a proper solution to the problem. And besides that, it only tests one aspect of aegis' security options.

Originally Posted by Hurrian View Post
Perhaps check uname for the build date? IIRC there is no versioning method published for these kernels, especially that they're not flashable on-device like the N900.
This crossed my mind as well. The build date doesn't say anything about aegis being neutered or not however.
And including a list of known patched Open Mode kernels doesn't really sound sustainable as well :-/.

Originally Posted by Hurrian View Post
I suggest that new aftermarket kernels leave a sysfs entry (/sys/kernel/security/validator/neutered, perhaps?) to let developers know which kind of device they're working with. Especially when it's an unknown ratio of Inception:Openmode users.
This would most definitely be a good solution. We need to be able to reliably differentiate patched Open Mode kernels from regular kernels missing Nokia's signature, and the (lack of) presence of a sysfs entry could do this job.

Last edited by iDont; 2012-10-19 at 12:06.
 

The Following 2 Users Say Thank You to iDont For This Useful Post:
Posts: 268 | Thanked: 1,053 times | Joined on May 2010 @ The Netherlands
#316
Time for some updates!

First of all, Harmattan support is done. Well, I'm not aware of any bugs at the moment to put it differently . (Un)installation works in normal mode, open mode, and patched open mode; you won't have to worry about that part at all. To view the magic, click here and here.
I've contacted MohammadAG for inclusion of busybox-power for Harmattan in his incepted-repo and got a positive response (thanks ivgalvez for the suggestion!). The sources have been sent already .
As always, debs are also available from busybox-power's garage page. Scroll all the way down to find the Harmattan builds. Don't forget to incept the deb or install it with AEGIS_FIXED_ORIGIN=com.nokia.maemo.

Do note that even though I have all faith in busybox-power for Harmattan (you don't want to know how much I've tested), it is still new and therefore has a higher chance to contain a bug.

Busybox-power for Harmattan depends on meego-confirm-text, which isn't available from Harmattan's community repositories yet. I have to make myself familiar with the current status of Harmattan's community repositories first. For the time being, you'll have to grab the deb and install it yourself. Luckily you only have to do this once .

Secondly, busybox-power for Fremantle has been updated too. It now integrates dpkg-divert in the (un)installation process, so we won't have to worry about future busybox upgrades overwriting the enhanced binary. You can grab the thumbified version of this latest update from our garage page until it's available from community-thumb.

Lastly, most applets execute faster since our latest release. We've increased the copy buffer size in BusyBox' configuration, which -I quote from Debian's changelog- "increases [the] speed of various applets dramatically". Some quick tests performed by myself confirm this. Both the N900 as well as the N9(50) have enough resources to accommodate this larger buffer.

Enjoy!
 

The Following 6 Users Say Thank You to iDont For This Useful Post:
sifo's Avatar
Posts: 1,359 | Thanked: 1,292 times | Joined on Oct 2011 @ Tartus.Syria
#317
First of all thank you for your efforts,
kind of out of the way, what about creating a separate announce thread for harmattan version ? we dont want things to be mixed up as in apkenv thread
best wishes

./sifo
__________________
[ N900-Crack ] [ The Purge ] [ New Smiles ] [ New icons ] [ ? ]
" Hey ! I've just met you and this is crazy, so install cssu maybe ? "
Please help out keeping Maemo.org alive, and consider donating.
https://www.facebook.com/ZoRk7
 

The Following 2 Users Say Thank You to sifo For This Useful Post:
Posts: 268 | Thanked: 1,053 times | Joined on May 2010 @ The Netherlands
#318
Originally Posted by sifo View Post
First of all thank you for your efforts,
kind of out of the way, what about creating a separate announce thread for harmattan version ? we dont want things to be mixed up as in apkenv thread
best wishes

./sifo
Thanks for the suggestion. I still have to decide what's best re: threads here. Currently I'm leaning towards a request to move this thread to the application section at TMO (and rename this thread to [N900/N9/N950] Enhanced BusyBox package" or something like that). I'll keep everyone updated regarding this topic.
 

The Following 4 Users Say Thank You to iDont For This Useful Post:
Estel's Avatar
Posts: 5,028 | Thanked: 8,613 times | Joined on Mar 2011
#319
+1 for idea of different topic for harmattan version.

It's not about "separatism" - it's just too much different boats, to be healthy mixed, comprehensiveness of thread get hurt in the process.

/Estel
__________________
N900's aluminum backcover / body replacement
-
N900's HDMI-Out
-
Camera cover MOD
-
Measure battery's real capacity on-device
-
TrueCrypt 7.1 | ereswap | bnf
-
Hardware's mods research is costly. To support my work, please consider donating. Thank You!
 
peterleinchen's Avatar
Posts: 4,118 | Thanked: 8,901 times | Joined on Aug 2010 @ Ruhrgebiet, Germany
#320
At first I would also say so, but rethinking there will also be lot of common tasks/problems/updates/announces and so on.
Take your time iDont and do what you think is the best.
__________________
SIM-Switcher, automated SIM switching with a Double (Dual) SIM adapter
--
Thank you all for voting me into the Community Council 2014-2016!

Please consider your membership / supporting Maemo e.V. and help to spread this by following/copying this link to your TMO signature:
[MC eV] Maemo Community eV membership application, http://talk.maemo.org/showthread.php?t=94257

editsignature, http://talk.maemo.org/profile.php?do=editsignature
 

The Following User Says Thank You to peterleinchen For This Useful Post:
Reply

Thread Tools

 
Forum Jump


All times are GMT. The time now is 18:01.