[Announce] aegisctl - control Aegis settings from the comfort of your own terminal - maemo.org

Active Topics

Sailfish OS for the Motorola Moto G7 Power (XT1955-5) - (ocean) (3)
to SailfishOS by edp17 - 3 hrs, 22 mins ago
The N900 is now 15 years old! (6)
to Nokia N900 by Macros - 1 day, 7 hrs ago
F(x)tec Pro1x (QWERTY) for sale (0)
to Buy & Sell by aln00000 - 1 day, 20 hrs ago
n770 youtube video (0)
to General by nmdv - 5 days, 19 hrs ago
more...

Page 1 of 3

Next >

Thread Tools

itsnotabigtruck	2012-03-12 , 18:43
Posts: 245 \| Thanked: 915 times \| Joined on Feb 2012	#1

aegisctl
control Aegis settings from the comfort of your own terminal

aegisctl makes it easy to take control and modify the Aegis enforcement bits on your incepted N9. This has many practical uses:

aegisctl -s: allows running any program from opensh, allows running a chroot environment as root
aegisctl -k: allows loading any kernel module without updating the whitelist
aegisctl --really @es: enter permissive mode (WARNING: Only if you know what you're doing)
aegisctl -r: temporarily disable "relaxed mode" (developer mode)
aegisctl +esdrtxk,-az: reset to (developer mode) defaults

aegisctl is built around an adaptation of javispedro's work on the unseal.ko kernel module.

Run aegisctl -? for usage instructions.

WARNING: This program is compatible only with PR1.2 and PR1.3 firmware (including beta versions). aegisctl has only been tested with the "stock" Nokia kernels, and might not work properly on customized third-party kernels.

NOTE: This must be installed using the incept utility provided with INCEPTION. Additionally, you must have opensh or a similar utility installed so that you can run aegisctl with the permissions required to change Aegis settings.

Install package: aegisctl_1.3_armel.deb
Source package: aegisctl_1.3.dsc aegisctl_1.3.tar.gz
License: Contains GPL2, WTFPL, and BSD code
More info in the copyright file

__________________

I N C E P T I O N

Calendarrr | ad-hac | sparsify | aegisctl
MilkyTracker | Mosh
Firmware Flashing Guide

Last edited by itsnotabigtruck; 2012-07-03 at 16:12.

Quote & Reply |

The Following 39 Users Say Thank You to itsnotabigtruck For This Useful Post:
-Tyler-, AlMehdi, ammyt, Arie, banong, Bundyo, Creamy Goodness, Dave999, death_jax, don_falcone, Hurrian, ibrakalifa, jalyst, jberezhnoy, koe, kojacker, lkravovicz, lorenzo, MaddogG, Maemomd, Maj3stic, MaKenZi, Manatus, MartinK, MFaroTusino, MohammadAG, mscion, munozferna, pcfe, qole, rcolistete, Schturman, superjunior, TeHeR, thp, TMavica, wicket, YavkatA, ZogG

	coderus	2012-03-12 , 19:05
	Posts: 6,436 \| Thanked: 12,701 times \| Joined on Nov 2011 @ Ängelholm, Sweden	#2

please explain, what is profit here? more real samples, please.

Quote & Reply |

The Following User Says Thank You to coderus For This Useful Post:
banong

Arie	2012-03-12 , 19:08
Posts: 1,539 \| Thanked: 1,604 times \| Joined on Oct 2011 @ With my N9	#3

Installed working well.

__________________
Arie|www.everythingn9.com|Nokia N9 64GB x2|Nokia N950

@everythingn9

Temporary Inception Fix

Times Banned from TMO: 4

Quote & Reply |

itsnotabigtruck	2012-03-12 , 19:25
Posts: 245 \| Thanked: 915 times \| Joined on Feb 2012	#4

Originally Posted by coderus

please explain, what is profit here? more real samples, please.

The main benefit is that it solves the problem of the "source identifier check": the check that prevents you from running just any executable with any privilege. Normally, you can't just run anything from opensh - only programs provided by Nokia or installed through incept are allowed. The same problem applies with vanilla/stock open mode - it's not only an INCEPTION problem.

With aegisctl, this behavior can be controlled at the flick of a switch.

Also, I added a few more usage examples to the OP.

__________________

I N C E P T I O N

Calendarrr | ad-hac | sparsify | aegisctl
MilkyTracker | Mosh
Firmware Flashing Guide

Quote & Reply |

vzp916	2012-03-12 , 19:35
Posts: 92 \| Thanked: 16 times \| Joined on Jun 2011 @ Sacramento, CA USA	#5

Can I get debian finaly, and run OpenOffice?

If yes...how?

Thanks

Quote & Reply |

	coderus	2012-03-12 , 19:38
	Posts: 6,436 \| Thanked: 12,701 times \| Joined on Nov 2011 @ Ängelholm, Sweden	#6

okay, i see, will be useful for launching binaries.
can i use it without inception but in openmode kernel with patched aegis and wiped /etc/aegisfs.d folder?
or it will be useless? or maybe some test to be sure?

Quote & Reply |

The Following User Says Thank You to coderus For This Useful Post:
jalyst

jalyst	2012-03-12 , 19:38
Moderator \| Posts: 5,320 \| Thanked: 4,464 times \| Joined on Oct 2009	#7

Originally Posted by itsnotabigtruck

The same problem applies with vanilla/stock open mode - it's not only an INCEPTION problem.

My mem must be failing me but I thought stuff like source identifier check was basically a non-issue in vanilla/stock open-mode?
Man I really need to find some time to go back a re-read everything, so much happening in the last few months.

Quote & Reply |

itsnotabigtruck	2012-03-12 , 19:53
Posts: 245 \| Thanked: 915 times \| Joined on Feb 2012	#8

Originally Posted by coderus

okay, i see, will be useful for launching binaries.
can i use it without inception but in openmode kernel with patched aegis and wiped /etc/aegisfs.d folder?
or it will be useless? or maybe some test to be sure?

Don't use this with a patched kernel - it has a hardcoded offset based on the stock PR1.2 kernel and changing the kernel could cause aegisctl to crash your system.

Originally Posted by jalyst

My mem must be failing me but I thought stuff like source identifier check was basically a non-issue in vanilla/stock open-mode?
Man I really need to find some time to go back a re-read everything, so much happening in the last few months.

"Vanilla" open mode basically gives you the same type of access as INCEPTION - you just don't need incept to install privileged packages. However, like with INCEPTION, there aren't any changes in Aegis enforcement unless you make those changes yourself. While I stated in the OP that INCEPTION is required for this, it also works if you use open mode and the stock kernel.

__________________

I N C E P T I O N

Calendarrr | ad-hac | sparsify | aegisctl
MilkyTracker | Mosh
Firmware Flashing Guide

Last edited by itsnotabigtruck; 2012-03-12 at 21:06.

Quote & Reply |

rainisto	2012-03-12 , 19:57
Posts: 1,067 \| Thanked: 2,383 times \| Joined on Jan 2012 @ Finland	#9

Originally Posted by coderus

okay, i see, will be useful for launching binaries.
can i use it without inception but in openmode kernel with patched aegis and wiped /etc/aegisfs.d folder?
or it will be useless? or maybe some test to be sure?

with patched openmode kernel you can freely write to /sys/kernel/security/validator/enabled, so you really don't need this as you can edit the modes without it.

Quote & Reply |

The Following User Says Thank You to rainisto For This Useful Post:
javispedro

	coderus	2012-03-12 , 20:11
	Posts: 6,436 \| Thanked: 12,701 times \| Joined on Nov 2011 @ Ängelholm, Sweden	#10

okay, thanks for explain.

Code:

/sys/kernel/security/validator # ls
cache     devorig   enabled   enforce   flush     hashlist  modlist
/sys/kernel/security/validator # cat enforce
0x7
/sys/kernel/security/validator # cat enabled
0x1e7

what should i change?

and, i have another request.
can you enable AEGIS_FIXED_ORIGIN with inception? it says ".. allowed only in open mode.."

Last edited by coderus; 2012-03-12 at 20:50.