[ssh_x509] SecureBox 3.0.0/1 Was: next securebox release

[ssh_x509 at roumenpetrov.info]

Dear list members,

Finally next securebox release is available for installation i.e., 
accepted by Google "Play Store".

About release:
- Implements "TermOne Plus" remote "command" interface (requires TermOne 
Plus 5.0.0).
- Packaged with PKIX-SSH 15.0.
- Build improvements.


Release 3.0.0 was uploaded to store to 28 Apr 2024 but because of 
"catch 22" logic with removed application permissions was not acceptable.
Actual release is marked as 3.0.1. This is a "fake" release that attempt 
   to bypass "catch 22" publication logic.




На 29.03.24 г. в 10:01 ч., ssh_x509 at roumenpetrov.info написа:
> Hello list members,
> 
> 
> (A) Current status:
> 
> Unlike "SecureBox Pro" application SecureBox adds additional shell 
> command to Android terminal application.
> 
> Terminal application "TermOne Plus" is successor of orphaned 
> TEA("Terminal Emulator for Android"). It inherits model for commands 
> collection. "Path Broadcasts (Sample)" is sample how third party 
> application could provide additional commands. So far so good but 
> evolution of Android OS adds too many restrictions.
> 
> Let list some of them:
> 
> * file access
> 
> - files system access permissions to application directories
> 
> - secure enhanced rules that prevent access application directories
> 
> Work-around is "shared user id" but this is not recommended if Android 
> API is greater than 32. Dunno when will be ignored.
> 
> * broadcast
> 
> - restrictions on implicit broadcast (without target)
> 
> - restrictions to access third party application information.
> 
> Work-around are broadcast with "signature" permission and application 
> declaration which package would like to access.
> 
> * long running jobs
> 
> - require foreground service
> 
> SecureBox command provide PKIX-SSH and OpenSSL commands. To work 
> properly commands require to exchange some information with application. 
> This means that application information should be provided for long time 
> even if application is not running. So SecureBox uses service and due to 
> Android requirements it should be foreground service. The problem is 
> that Android 14 set additional restrictions to applications that could 
> use foreground service. Google accepts "TermOne Plus" and "SecureBox 
> Pro" but for SecureBox I did not fill request. See below.
> 
> 
> Also enforced SE Linux rules add additional restrictions. For instance 
> "TermOne Plus" from F-Droid has more permissions. As "signer" is 
> different path broadcast are not received by SecureBox application.
> 
> 
> 
> (B) Future
> 
> Working bound (remote) sessions in "TermOne Plus". Functionality is 
> inherited from TEA but was never tested and so does not work. Release 
> 4.7.0 is first what fixes issues with bound sessions.
> 
> At some point of time SecureBox could start directly secsh session into 
> terminal. This model does provide additional commands.
> 
> Note this is different from "Intents (sample)" where intern start new 
> session and execute posted script.
> 
> 
> 
> *** New command collection model ***
> 
> Remark: Not yet published.
> 
> "TermOne Plus" prototype with simple sample command "addon" application 
> is almost ready. FYI model is based on RPC.
> 
> PKIX-SSH Android port should be adapted to this new model.
> 
> 
> So next SecureBox release will be published after "TermOne Plus" release 
> with new model and after PKIX-SSH release adapted to new model.
> 
> No more signature permissions, no more services even foreground, no more 
> needless notifications required by foreground services, no more "shared 
> user id".
> 
> With other words SecureBox will work with any build of "TermOne Plus".
> 
> 
> Regards,
> 
> Roumen Petrov
> 


Regards,
Roumen Petrov