[ssh_x509] next securebox release

[ssh_x509 at roumenpetrov.info]

Hello list members,


(A) Current status:

Unlike "SecureBox Pro" application SecureBox adds additional shell 
command to Android terminal application.

Terminal application "TermOne Plus" is successor of orphaned 
TEA("Terminal Emulator for Android"). It inherits model for commands 
collection. "Path Broadcasts (Sample)" is sample how third party 
application could provide additional commands. So far so good but 
evolution of Android OS adds too many restrictions.

Let list some of them:

* file access

- files system access permissions to application directories

- secure enhanced rules that prevent access application directories

Work-around is "shared user id" but this is not recommended if Android 
API is greater than 32. Dunno when will be ignored.

* broadcast

- restrictions on implicit broadcast (without target)

- restrictions to access third party application information.

Work-around are broadcast with "signature" permission and application 
declaration which package would like to access.

* long running jobs

- require foreground service

SecureBox command provide PKIX-SSH and OpenSSL commands. To work 
properly commands require to exchange some information with application. 
This means that application information should be provided for long time 
even if application is not running. So SecureBox uses service and due to 
Android requirements it should be foreground service. The problem is 
that Android 14 set additional restrictions to applications that could 
use foreground service. Google accepts "TermOne Plus" and "SecureBox 
Pro" but for SecureBox I did not fill request. See below.


Also enforced SE Linux rules add additional restrictions. For instance 
"TermOne Plus" from F-Droid has more permissions. As "signer" is 
different path broadcast are not received by SecureBox application.



(B) Future

Working bound (remote) sessions in "TermOne Plus". Functionality is 
inherited from TEA but was never tested and so does not work. Release 
4.7.0 is first what fixes issues with bound sessions.

At some point of time SecureBox could start directly secsh session into 
terminal. This model does provide additional commands.

Note this is different from "Intents (sample)" where intern start new 
session and execute posted script.



*** New command collection model ***

Remark: Not yet published.

"TermOne Plus" prototype with simple sample command "addon" application 
is almost ready. FYI model is based on RPC.

PKIX-SSH Android port should be adapted to this new model.


So next SecureBox release will be published after "TermOne Plus" release 
with new model and after PKIX-SSH release adapted to new model.

No more signature permissions, no more services even foreground, no more 
needless notifications required by foreground services, no more "shared 
user id".

With other words SecureBox will work with any build of "TermOne Plus".


Regards,

Roumen Petrov