[ssh_x509] SecureBox 3.0.2

[ssh_x509 at roumenpetrov.info]

P.S.

Finally is available for installation as 3.0.2 release.


На 15.05.24 г. в 22:24 ч., ssh_x509 at roumenpetrov.info написа:
> Dear list members,
> 
> Finally next securebox release is available for installation i.e., 
> accepted by Google "Play Store".
> 
> About release:
> - Implements "TermOne Plus" remote "command" interface (requires TermOne 
> Plus 5.0.0).
> - Packaged with PKIX-SSH 15.0.
> - Build improvements.
> 
> 
> Release 3.0.0 was uploaded to store to 28 Apr 2024 but because of "catch 
> 22" logic with removed application permissions was not acceptable.
> Actual release is marked as 3.0.1. This is a "fake" release that attempt 
>    to bypass "catch 22" publication logic.
> 
> 
> 
> 
> На 29.03.24 г. в 10:01 ч., ssh_x509 at roumenpetrov.info написа:
>> Hello list members,
>>
>>
>> (A) Current status:
>>
>> Unlike "SecureBox Pro" application SecureBox adds additional shell 
>> command to Android terminal application.
>>
>> Terminal application "TermOne Plus" is successor of orphaned 
>> TEA("Terminal Emulator for Android"). It inherits model for commands 
>> collection. "Path Broadcasts (Sample)" is sample how third party 
>> application could provide additional commands. So far so good but 
>> evolution of Android OS adds too many restrictions.
>>
>> Let list some of them:
>>
>> * file access
>>
>> - files system access permissions to application directories
>>
>> - secure enhanced rules that prevent access application directories
>>
>> Work-around is "shared user id" but this is not recommended if Android 
>> API is greater than 32. Dunno when will be ignored.
>>
>> * broadcast
>>
>> - restrictions on implicit broadcast (without target)
>>
>> - restrictions to access third party application information.
>>
>> Work-around are broadcast with "signature" permission and application 
>> declaration which package would like to access.
>>
>> * long running jobs
>>
>> - require foreground service
>>
>> SecureBox command provide PKIX-SSH and OpenSSL commands. To work 
>> properly commands require to exchange some information with 
>> application. This means that application information should be 
>> provided for long time even if application is not running. So 
>> SecureBox uses service and due to Android requirements it should be 
>> foreground service. The problem is that Android 14 set additional 
>> restrictions to applications that could use foreground service. Google 
>> accepts "TermOne Plus" and "SecureBox Pro" but for SecureBox I did not 
>> fill request. See below.
>>
>>
>> Also enforced SE Linux rules add additional restrictions. For instance 
>> "TermOne Plus" from F-Droid has more permissions. As "signer" is 
>> different path broadcast are not received by SecureBox application.
>>
>>
>>
>> (B) Future
>>
>> Working bound (remote) sessions in "TermOne Plus". Functionality is 
>> inherited from TEA but was never tested and so does not work. Release 
>> 4.7.0 is first what fixes issues with bound sessions.
>>
>> At some point of time SecureBox could start directly secsh session 
>> into terminal. This model does provide additional commands.
>>
>> Note this is different from "Intents (sample)" where intern start new 
>> session and execute posted script.
>>
>>
>>
>> *** New command collection model ***
>>
>> Remark: Not yet published.
>>
>> "TermOne Plus" prototype with simple sample command "addon" 
>> application is almost ready. FYI model is based on RPC.
>>
>> PKIX-SSH Android port should be adapted to this new model.
>>
>>
>> So next SecureBox release will be published after "TermOne Plus" 
>> release with new model and after PKIX-SSH release adapted to new model.
>>
>> No more signature permissions, no more services even foreground, no 
>> more needless notifications required by foreground services, no more 
>> "shared user id".
>>
>> With other words SecureBox will work with any build of "TermOne Plus".
>>
>>
>> Regards,
>>
>> Roumen Petrov
>>
> 
> 
> Regards,
> Roumen Petrov
> 
> 
> _______________________________________________
> ssh_x509 mailing list
> ssh_x509 at roumenpetrov.info
> http://roumenpetrov.info/mailman/listinfo/ssh_x509_roumenpetrov.info