├── App Incompatibility List └── README.md ├── For Maintainers ├── Common-Problems.md ├── Readme.md └── Setting-Up-Your-Host.md ├── For Testers ├── Android-10-cts-report-template.txt ├── Android-12-cts-report-template.txt └── The-Compatibility-Test-Suite.md ├── GrapheneOS-Building-Q&A.md ├── GrapheneOS-General-Q&A.md ├── GrapheneOS-Security-Q&A.md ├── GrapheneOS-Shopping-List.md ├── GrapheneOS-Usage-Q&A.md ├── Miscellanea ├── GrapheneOS-in-Inkscape.svg └── README.md ├── Old FAQ Draft ├── README.md ├── faq-safe.html └── faq.html ├── README.md └── Twitter and Reddit └── README.md /App Incompatibility List/README.md: -------------------------------------------------------------------------------- 1 | # GrapheneOS App Incompatibility List 2 | 3 | In the past, this location was used to try to create a short list of apps that had been found to run or not to run on GrapheneOS and to what degree. 4 | 5 | The game has changed when GrapheneOS implemented compatibility shims to coerce Play Services into running as a regular app with no special access or privileges. This allows Play Services and its associated libraries to be optionally added to profiles on a case-by-case basis and run as a sandboxed, isolated, ordinary app without any privacy or security concerns at all. They can be added, deleted, frozen when not in use, or simply skipped altogether. Play Services, when sandboxed, behaves as a regular app and cannot do anything that any other app, when given the appropriate permissions, could not simply do itself. 6 | 7 | Essentially, GrapheneOS allows you to have your cake and eat it too, and leaves the power to make this choice in your hands. This was deemed to be a safer approach than MicroG, which only emulates a small subset of Play Services, is still reliant on the same closed-source libraries, and requires deep and systematic integration with the operating system as a privileged system app in order to do its work. 8 | 9 | As a result, it is no longer feasible for us to enumerate which apps work, and instead, for us to start looking into what apps *don't*. 10 | 11 | At this moment, Play Services function for the majority of use cases, with some known limitations due to shims that have not yet been added, but are under active and continual development. 12 | 13 | -------------------------------------------------------------------------------- /For Maintainers/Common-Problems.md: -------------------------------------------------------------------------------- 1 | # Troubleshooting Common Problems 2 | 3 | ## android-prepare-vendor 4 | 5 | ### curl fails with "HTTP/2 stream 0 not closed cleanly" 6 | If you get the following error code: `curl: (92) HTTP/2 stream 0 was not closed cleanly: Unknown error code (err 1)"` and cannot resolve it, there may be a conflicting file in your device directory. If this is the case, simply delete the directory for the device's tag to force android-prepare-vendor to start over. For instance, if your device is `blueline` and you were trying to download update `qq2a.200501.001.b2` you can try deleting `vendor/android-prepare-vendor/vendor/blueline/qq2a.200501.001.b2` to make it try again. 7 | 8 | If all else fails, see offline extraction below: 9 | 10 | #### Offline extraction 11 | Download both the factory-image zip file, and the over-the-air update zip file, and place them into a location you can easily memorize, then run `android-prepare-vendor` pointing the script to the files you've just downloaded and pass the `--img` and `--ota` flags to the script to indicate it to use files you've already downloaded, rather than automatically search for and download the files itself. 12 | 13 | For example: 14 | ``` 15 | vendor/android-prepare-vendor/execute-all.sh -d blueline -b QQ2A.200501.001.B2 -o vendor/android-prepare-vendor --img $HOME/Downloads/blueline-factory-qq2a.200501.001.b2.zip --ota $HOME/Downloads/blueline-ota-qq2a.200501.001.b2.zip 16 | ``` 17 | -------------------------------------------------------------------------------- /For Maintainers/Readme.md: -------------------------------------------------------------------------------- 1 | # For The Maintainers 2 | 3 | This section's going to cover bits and pieces about how to become a maintainer or how to help maintainers do their work. 4 | -------------------------------------------------------------------------------- /For Maintainers/Setting-Up-Your-Host.md: -------------------------------------------------------------------------------- 1 | # Setting up your host 2 | Before reading this section I recommend you check out "Your GrapheneOS Shopping List" to see what you're going to need to buy. 3 | 4 | This section's only going to cover what you'd need to do to start building. Learning to build the operating system is a fundamental (non-optional) step towards becoming a maintainer, and that's huge. 5 | 6 | ## Installing Arch 7 | There's only one architecture, and two recommended Linux distributions for building GrapheneOS: Debian 10 Buster, and Arch, both on the x86_64 processor. Building on MacOS and Windows currently isn't supported. The GrapheneOS project recommends Arch for its practice of using as few modifications to software provided to it from its upstream providers and remaining current with upstream. This causes fewer headaches in the long run. 8 | 9 | Installing Arch requires some working knowledge of the commandline to first enter a virtual Live environment with a command shell, set up the disks, networking, download the packages via `pacstrap` and choose items to install. This requires some familiarity with the commandline. The process is extensively documented on the Arch Wiki, and so won't be repeated here, with a few additional hints. 10 | 11 | During your `arch-chroot` session while operating in the LiveCD installer, it's important to add a few extra packages. tutorial assumes that you are either running your build station as a headless build server with no graphical interface and simply access it over a remote shell once it's been set up and provisioned. While you are booted into the `arch-chroot` consider adding the following packages and enabling them via `systemctl` so they initialize at boot. 12 | ``` 13 | pacman -Syy openssh dhcpcd 14 | systemctl enable sshd 15 | systemctl enable dhcpcd 16 | ``` 17 | Proceed with the rest of the installation as normal. 18 | 19 | **Attention!** *Your computer will inevitably at one point or another need to handle signing keys, which must be handled by the host. As Solid State Drives can retain their data for very long periods of time and conventional means of erasing HDDs are ineffective on SSDs, you should install with full disk encryption and encrypted swap or no swap at all as a last-line of defense against if the drive is lost, or stolen.* 20 | 21 | ### Adding Multilib 22 | You'll first want to enable multilib for Arch, which is contained in `/etc/pacman.conf` Scroll to near the bottom, where you'll find the following lines that have been commented out. You should likely use a text editor like `nano` or `vi` to do this. 23 | ``` 24 | #[multilib] 25 | #Include = /etc/pacman.d/mirrorlist 26 | ``` 27 | Simply uncomment these two lines to look like this: 28 | ``` 29 | [multilib] 30 | Include = /etc/pacman.d/mirrorlist 31 | ``` 32 | This should enable multilib for your package repositories. 33 | 34 | ### Adding the dependencies 35 | It should be noted that you'll be using Yay to install other packages, you'll need to be sure you uncommented multilib first, or some of the packages won't be found. 36 | 37 | #### First Step 38 | Install some of the rest of the dependencies 39 | ``` 40 | sudo pacman -S --needed autoconf automake bc binutils bison ccache dhcpcd fakeroot flex gcc git gperf groff jdk-openjdk jre-openjdk jre-openjdk-headless libtool libxslt m4 make nano ninja net-tools nsjail openssh patch perl-switch pkgconf python2-virtualenv repo rsync schedtool sdl squashfs-tools sudo texinfo unzip wxgtk2 zip 41 | ``` 42 | 43 | If you are running with a graphical interface, you may require `lib32-mesa`. Since this tutorial assumes you are building on a detached, headless build server, this likely won't be necessary. 44 | 45 | #### Using yay, or Yet Another Yogurt. 46 | You'll need to use yay to install some of the other dependencies which are maintained by the Arch community. First, you'll need to obtain it, and make a package out of it using the following commands. You should likely do this as a regular user. It isn't recommended to run `yay` as root but instead to use sudo to give it privilege when it's needed. If you haven't already, you should switch to a regular user using adduser, set a password for it, and add the new user account to the group `wheel` with `usermod -a -G wheel [my-username]`. You may need to uncomment the line to allow the usergroup `wheel` to run processes as root using `visudo`. 47 | 48 | First, we'll set up yay. Yay is not a core part of the arch repositories, but is maintained by the Arch User Repositories, and is installed by cloning it using git and the `makepackage` tool. The command sequence is: 49 | ``` 50 | git clone https://aur.archlinux.org/yay.git 51 | cd yay 52 | makepkg -si 53 | ``` 54 | Once that's done, use the following command to fetch the rest of the dependencies. Again, ensure multilib has already been uncommented, or it will fail. 55 | ``` 56 | yay -S --needed base-devel multilib-devel gcc repo gperf sdl wxgtk2 squashfs-tools curl ncurses zlib python2-protobuf schedtool perl-switch zip unzip libxslt bc rsync ccache lib32-zlib lib32-ncurses lib32-readline ncurses5-compat-libs lib32-ncurses5-compat-libs ttf-ms-fonts 57 | ``` 58 | 59 | #### Installing the fonts. 60 | Android requires some fonts that aren't normally in the repositories. If yay can't install them via yay, that's no problem, just simply proceed to install them with: 61 | ``` 62 | git clone https://aur.archlinux.org/ttf-ms-fonts.git 63 | cd ttf-ms-fonts 64 | makepkg -si 65 | ``` 66 | 67 | #### Installing Google's Depot tools. 68 | 69 | Google provide tools written in python to allow for easier management of the projects. To fetch the depot tools, which include the `repo` and `gclient` tool, you'll need to get them from Google and add them to your command path. The easiest way to do that is simply by using the following command structure: 70 | ``` 71 | mkdir ~/Applications/ 72 | cd ~/Applications/ 73 | git clone https://chromium.googlesource.com/chromium/tools/depot_tools.git && cd depot_tools 74 | export PATH=$PATH:$(pwd) 75 | echo "export PATH="$(echo PATH) >> ~/.bashrc 76 | ``` 77 | 78 | ### Installing Android Tools 79 | Arch is one of the very few distributions that correctly numbers, versions, and packages up-to-date versions of the Android Debug Tools and Platform Tools. You can install them and the udev rules directly using: 80 | ``` 81 | pacman -S --needed android-tools android-udev 82 | ``` 83 | You may need to restart your computer after doing so. Note that you may need to whitelist your user account in `adbusers` if you want to use `adb` remotely over ssh. 84 | 85 | Congratulations. You're ready to begin building GrapheneOS on your headless build server. 86 | -------------------------------------------------------------------------------- /For Testers/Android-10-cts-report-template.txt: -------------------------------------------------------------------------------- 1 | CTS results on [DEVICE] ([CODENAME]) running [GrapheneOS/FactoryOS/AOSP] [BUILD_NUMBER] [BETA/STABLE] ([ANDROID_RELEASE_VERSION] with [Chromium/Vanadium] [Chromium/Vanadium Number] [apk_release] as the [Webview and browser/Webview only/browser only] 2 | 3 | * CtsAbiOverrideHostTestCases - 4 | * CtsAccelerationTestCases - 5 | * CtsAccessibilityServiceTestCases - 6 | * CtsAccessibilityTestCases - 7 | * CtsAccountManagerTestCases - 8 | * CtsActivityManagerBackgroundActivityTestCases - 9 | * CtsAdminPackageInstallerTestCases - 10 | * CtsAdminTestCases - 11 | * CtsAlarmManagerTestCases - 12 | * CtsAndroidAppTestCases - 13 | * CtsAndroidTestBase28ApiSignatureTestCases - 14 | * CtsAndroidTestBaseCurrentApiSignatureTestCases - 15 | * CtsAndroidTestMockCurrentApiSignatureTestCases - 16 | * CtsAndroidTestRunnerCurrentApiSignatureTestCases - 17 | * CtsAngleIntegrationHostTestCases - 18 | * CtsAnimationTestCases - 19 | * CtsApacheHttpLegacy27ApiSignatureTestCases - 20 | * CtsApacheHttpLegacyCurrentApiSignatureTestCases - 21 | * CtsApacheHttpLegacyUsesLibraryApiSignatureTestCases - 22 | * CtsApexTestCases - 23 | * CtsAppBindingHostTestCases - 24 | * CtsAppComponentFactoryTestCases - 25 | * CtsAppOpsTestCases - 26 | * CtsAppPredictionServiceTestCases - 27 | * CtsAppSecurityHostTestCases - 28 | * CtsAppTestCases - 29 | * CtsAppUsageHostTestCases - 30 | * CtsAppWidgetTestCases - 31 | * CtsAslrMallocTestCases - 32 | * CtsAssistTestCases - 33 | * CtsAtomicInstallTestCases - 34 | * CtsAtraceHostTestCases - 35 | * CtsAttentionServiceDeviceTestCases - 36 | * CtsAutoFillServiceTestCases - 37 | * CtsBackgroundRestrictionsTestCases - 38 | * CtsBackupHostTestCases - 39 | * CtsBackupTestCases - 40 | * CtsBatterySavingTestCases - 41 | * CtsBionicTestCases - 42 | * CtsBluetoothTestCases - 43 | * CtsBootStatsTestCases - 44 | * CtsCalendarcommon2TestCases - 45 | * CtsCameraApi25TestCases - 46 | * CtsCameraTestCases - 47 | * CtsCarTestCases - 48 | * CtsCarrierApiTestCases - 49 | * CtsClassLoaderFactoryInMemoryDexClassLoaderTestCases - 50 | * CtsClassLoaderFactoryPathClassLoaderTestCases - 51 | * CtsClassloaderSplitsHostTestCases - 52 | * CtsColorModeTestCases - 53 | * CtsCompilationTestCases - 54 | * CtsContactsProviderWipe - 55 | * CtsContentCaptureServiceTestCases - 56 | * CtsContentSuggestionsTestCases - 57 | * CtsContentTestCases - 58 | * CtsCppToolsTestCases - 59 | * CtsCurrentApiSignatureTestCases - 60 | * CtsDatabaseTestCases - 61 | * CtsDeqpTestCases - 62 | * CtsDeviceConfigTestCases - 63 | * CtsDeviceIdleHostTestCases - 64 | * CtsDevicePolicyManagerTestCases - 65 | * CtsDexMetadataHostTestCases - 66 | * CtsDisplayTestCases - 67 | * CtsDownloadManagerApi28 - 68 | * CtsDownloadManagerLegacy - 69 | * CtsDpiTestCases - 70 | * CtsDpiTestCases2 - 71 | * CtsDreamsTestCases - 72 | * CtsDrmTestCases - 73 | * CtsDropBoxManagerTestCases - 74 | * CtsDumpsysHostTestCases - 75 | * CtsDynamicLinkerTestCases - 76 | * CtsEdiHostTestCases - 77 | * CtsEffectTestCases - 78 | * CtsExtendedMockingTestCases - 79 | * CtsExternalServiceTestCases - 80 | * CtsFileSystemTestCases - 81 | * CtsFragmentTestCases - 82 | * CtsFragmentTestCasesSdk26 - 83 | * CtsGestureTestCases - 84 | * CtsGpuToolsHostTestCases - 85 | * CtsGraphicsTestCases - 86 | * CtsHardwareTestCases - 87 | * CtsHarmfulAppWarningHostTestCases - 88 | * CtsHiddenApiBlacklistApi27TestCases - 89 | * CtsHiddenApiBlacklistApi28TestCases - 90 | * CtsHiddenApiBlacklistCurrentApiTestCases - 91 | * CtsHiddenApiBlacklistDebugClassTestCases - 92 | * CtsHiddenApiKillswitchDebugClassTestCases - 93 | * CtsHiddenApiKillswitchWhitelistTestCases - 94 | * CtsHiddenApiKillswitchWildcardTestCases - 95 | * CtsHostTzDataTests - 96 | * CtsHostsideNetworkTests - 97 | * CtsHostsideNumberBlockingTestCases - 98 | * CtsHostsideTvTests - 99 | * CtsHostsideWebViewTests - 100 | * CtsIcuTestCases - 101 | * CtsIncidentHostTestCases - 102 | * CtsInlineMockingTestCases - 103 | * CtsInputMethodServiceHostTestCases - 104 | * CtsInputMethodTestCases - 105 | * CtsIntentSignatureTestCases - 106 | * CtsJdwpSecurityHostTestCases - 107 | * CtsJdwpTestCases - 108 | * CtsJdwpTunnelHostTestCases - 109 | * CtsJniTestCases - 110 | * CtsJobSchedulerSharedUidTestCases - 111 | * CtsJobSchedulerTestCases - 112 | * CtsJvmtiAttachingHostTestCases - 113 | * CtsJvmtiAttachingTestCases - 114 | * CtsJvmtiRedefineClassesHostTestCases - 115 | * CtsJvmtiRunTest1900HostTestCases - 116 | * CtsJvmtiRunTest1901HostTestCases - 117 | * CtsJvmtiRunTest1902HostTestCases - 118 | * CtsJvmtiRunTest1903HostTestCases - 119 | * CtsJvmtiRunTest1904HostTestCases - 120 | * CtsJvmtiRunTest1906HostTestCases - 121 | * CtsJvmtiRunTest1907HostTestCases - 122 | * CtsJvmtiRunTest1908HostTestCases - 123 | * CtsJvmtiRunTest1909HostTestCases - 124 | * CtsJvmtiRunTest1910HostTestCases - 125 | * CtsJvmtiRunTest1911HostTestCases - 126 | * CtsJvmtiRunTest1912HostTestCases - 127 | * CtsJvmtiRunTest1913HostTestCases - 128 | * CtsJvmtiRunTest1914HostTestCases - 129 | * CtsJvmtiRunTest1915HostTestCases - 130 | * CtsJvmtiRunTest1916HostTestCases - 131 | * CtsJvmtiRunTest1917HostTestCases - 132 | * CtsJvmtiRunTest1920HostTestCases - 133 | * CtsJvmtiRunTest1921HostTestCases - 134 | * CtsJvmtiRunTest1922HostTestCases - 135 | * CtsJvmtiRunTest1923HostTestCases - 136 | * CtsJvmtiRunTest1924HostTestCases - 137 | * CtsJvmtiRunTest1925HostTestCases - 138 | * CtsJvmtiRunTest1926HostTestCases - 139 | * CtsJvmtiRunTest1927HostTestCases - 140 | * CtsJvmtiRunTest1928HostTestCases - 141 | * CtsJvmtiRunTest1930HostTestCases - 142 | * CtsJvmtiRunTest1931HostTestCases - 143 | * CtsJvmtiRunTest1932HostTestCases - 144 | * CtsJvmtiRunTest1933HostTestCases - 145 | * CtsJvmtiRunTest1934HostTestCases - 146 | * CtsJvmtiRunTest1936HostTestCases - 147 | * CtsJvmtiRunTest1937HostTestCases - 148 | * CtsJvmtiRunTest1939HostTestCases - 149 | * CtsJvmtiRunTest1941HostTestCases - 150 | * CtsJvmtiRunTest1942HostTestCases - 151 | * CtsJvmtiRunTest1943HostTestCases - 152 | * CtsJvmtiRunTest1953HostTestCases - 153 | * CtsJvmtiRunTest1958HostTestCases - 154 | * CtsJvmtiRunTest902HostTestCases - 155 | * CtsJvmtiRunTest903HostTestCases - 156 | * CtsJvmtiRunTest904HostTestCases - 157 | * CtsJvmtiRunTest905HostTestCases - 158 | * CtsJvmtiRunTest906HostTestCases - 159 | * CtsJvmtiRunTest907HostTestCases - 160 | * CtsJvmtiRunTest908HostTestCases - 161 | * CtsJvmtiRunTest910HostTestCases - 162 | * CtsJvmtiRunTest911HostTestCases - 163 | * CtsJvmtiRunTest912HostTestCases - 164 | * CtsJvmtiRunTest913HostTestCases - 165 | * CtsJvmtiRunTest914HostTestCases - 166 | * CtsJvmtiRunTest915HostTestCases - 167 | * CtsJvmtiRunTest917HostTestCases - 168 | * CtsJvmtiRunTest918HostTestCases - 169 | * CtsJvmtiRunTest919HostTestCases - 170 | * CtsJvmtiRunTest920HostTestCases - 171 | * CtsJvmtiRunTest922HostTestCases - 172 | * CtsJvmtiRunTest923HostTestCases - 173 | * CtsJvmtiRunTest924HostTestCases - 174 | * CtsJvmtiRunTest926HostTestCases - 175 | * CtsJvmtiRunTest927HostTestCases - 176 | * CtsJvmtiRunTest928HostTestCases - 177 | * CtsJvmtiRunTest930HostTestCases - 178 | * CtsJvmtiRunTest931HostTestCases - 179 | * CtsJvmtiRunTest932HostTestCases - 180 | * CtsJvmtiRunTest940HostTestCases - 181 | * CtsJvmtiRunTest942HostTestCases - 182 | * CtsJvmtiRunTest944HostTestCases - 183 | * CtsJvmtiRunTest945HostTestCases - 184 | * CtsJvmtiRunTest947HostTestCases - 185 | * CtsJvmtiRunTest951HostTestCases - 186 | * CtsJvmtiRunTest982HostTestCases - 187 | * CtsJvmtiRunTest983HostTestCases - 188 | * CtsJvmtiRunTest984HostTestCases - 189 | * CtsJvmtiRunTest985HostTestCases - 190 | * CtsJvmtiRunTest986HostTestCases - 191 | * CtsJvmtiRunTest988HostTestCases - 192 | * CtsJvmtiRunTest989HostTestCases - 193 | * CtsJvmtiRunTest990HostTestCases - 194 | * CtsJvmtiRunTest991HostTestCases - 195 | * CtsJvmtiRunTest992HostTestCases - 196 | * CtsJvmtiRunTest993HostTestCases - 197 | * CtsJvmtiRunTest994HostTestCases - 198 | * CtsJvmtiRunTest995HostTestCases - 199 | * CtsJvmtiRunTest996HostTestCases - 200 | * CtsJvmtiRunTest997HostTestCases - 201 | * CtsJvmtiTaggingHostTestCases - 202 | * CtsJvmtiTrackingHostTestCases - 203 | * CtsKernelConfigTestCases - 204 | * CtsKeystoreTestCases - 205 | * CtsLeanbackJankTestCases - 206 | * CtsLegacyNotification20TestCases - 207 | * CtsLegacyNotification27TestCases - 208 | * CtsLegacyNotification28TestCases - 209 | * CtsLegacyNotification29TestCases - 210 | * CtsLibcoreApiEvolutionTestCases - 211 | * CtsLibcoreFileIOTestCases - 212 | * CtsLibcoreJsr166TestCases - 213 | * CtsLibcoreLegacy22TestCases - 214 | * CtsLibcoreOjTestCases - 215 | * CtsLibcoreOkHttpTestCases - 216 | * CtsLibcoreTestCases - 217 | * CtsLibcoreWycheproofBCTestCases - 218 | * CtsLibcoreWycheproofConscryptTestCases - 219 | * CtsLiblogTestCases - 220 | * CtsLocation2TestCases - 221 | * CtsLocationTestCases - 222 | * CtsLogdTestCases - 223 | * CtsMediaBitstreamsTestCases - 224 | * CtsMediaHostTestCases - 225 | * CtsMediaStressTestCases - 226 | * CtsMediaTestCases - 227 | * CtsMidiTestCases - 228 | * CtsMockingDebuggableTestCases - 229 | * CtsMockingTestCases - 230 | * CtsMonkeyTestCases - 231 | * CtsMultiUserHostTestCases - 232 | * CtsMultiUserTestCases - 233 | * CtsNNAPIBenchmarkTestCases - 234 | * CtsNNAPITestCases - 235 | * CtsNativeHardwareTestCases - 236 | * CtsNativeMediaAAudioTestCases - 237 | * CtsNativeMediaSlTestCases - 238 | * CtsNativeMediaXaTestCases - 239 | * CtsNativeMidiTestCases - 240 | * CtsNativeNetDnsTestCases - 241 | * CtsNativeNetTestCases - 242 | * CtsNdefTestCases - 243 | * CtsNdkBinderTestCases - 244 | * CtsNetApi23TestCases - 245 | * CtsNetSecConfigAttributeTestCases - 246 | * CtsNetSecConfigBasicDebugDisabledTestCases - 247 | * CtsNetSecConfigBasicDebugEnabledTestCases - 248 | * CtsNetSecConfigBasicDomainConfigTestCases - 249 | * CtsNetSecConfigCleartextTrafficTestCases - 250 | * CtsNetSecConfigDownloadManagerTestCases - 251 | * CtsNetSecConfigInvalidPinTestCases - 252 | * CtsNetSecConfigNestedDomainConfigTestCases - 253 | * CtsNetSecConfigPrePCleartextTrafficTestCases - 254 | * CtsNetSecConfigResourcesSrcTestCases - 255 | * CtsNetSecPolicyUsesCleartextTrafficFalseTestCases - 256 | * CtsNetSecPolicyUsesCleartextTrafficTrueTestCases - 257 | * CtsNetSecPolicyUsesCleartextTrafficUnspecifiedTestCases - 258 | * CtsNetTestCases - 259 | * CtsNetTestCasesInternetPermission - 260 | * CtsNetTestCasesLegacyApi22 - 261 | * CtsNetTestCasesLegacyPermission22 - 262 | * CtsNetTestCasesUpdateStatsPermission - 263 | * CtsNoPermissionTestCases - 264 | * CtsNoPermissionTestCases25 - 265 | * CtsOmapiTestCases - 266 | * CtsOpenGLTestCases - 267 | * CtsOpenGlPerf2TestCases - 268 | * CtsOpenGlPerfTestCases - 269 | * CtsOsHostTestCases - 270 | * CtsOsTestCases - 271 | * CtsPackageInstallTestCases - 272 | * CtsPackageInstallerTapjackingTestCases - 273 | * CtsPackageUninstallTestCases - 274 | * CtsPdfTestCases - 275 | * CtsPerfettoTestCases - 276 | * CtsPermission2TestCases - 277 | * CtsPermissionTestCases - 278 | * CtsPermissionTestCasesSdk28 - 279 | * CtsPermissionTestCasesTelephony - 280 | * CtsPreferenceTestCases - 281 | * CtsPrintTestCases - 282 | * CtsProtoTestCases - 283 | * CtsProviderTestCases - 284 | * CtsProviderUiTestCases - 285 | * CtsRcsTestCases - 286 | * CtsRenderscriptLegacyTestCases - 287 | * CtsRenderscriptTestCases - 288 | * CtsResolverServiceTestCases - 289 | * CtsRoleTestCases - 290 | * CtsRollbackManagerHostTestCases - 291 | * CtsRsBlasTestCases - 292 | * CtsRsCppTestCases - 293 | * CtsSampleDeviceTestCases - 294 | * CtsSampleHostTestCases - 295 | * CtsSaxTestCases - 296 | * CtsSeccompHostTestCases - 297 | * CtsSecureElementAccessControlTestCases1 - 298 | * CtsSecureElementAccessControlTestCases2 - 299 | * CtsSecureElementAccessControlTestCases3 - 300 | * CtsSecurityBulletinHostTestCases - 301 | * CtsSecurityHostTestCases - 302 | * CtsSecurityTestCases - 303 | * CtsSelinuxEphemeralTestCases - 304 | * CtsSelinuxTargetSdk25TestCases - 305 | * CtsSelinuxTargetSdk27TestCases - 306 | * CtsSelinuxTargetSdk28TestCases - 307 | * CtsSelinuxTargetSdkCurrentTestCases - 308 | * CtsSensorTestCases - 309 | * CtsSharedLibsApiSignatureTestCases - 310 | * CtsShortcutHostTestCases - 311 | * CtsShortcutManagerTestCases - 312 | * CtsSignedConfigHostTestCases - 313 | * CtsSimRestrictedApisTestCases - 314 | * CtsSimpleCpuTestCases - 315 | * CtsSimpleperfTestCases - 316 | * CtsSkQPTestCases - 317 | * CtsSliceTestCases - 318 | * CtsSpeechTestCases - 319 | * CtsStagedInstallHostTestCases - 320 | * CtsStatsdHostTestCases - 321 | * CtsSustainedPerformanceHostTestCases - 322 | * CtsSyncAccountAccessOtherCertTestCases - 323 | * CtsSyncContentHostTestCases - 324 | * CtsSyncManagerTestsCases - 325 | * CtsSystemApiAnnotationTestCases - 326 | * CtsSystemApiSignatureTestCases - 327 | * CtsSystemIntentTestCases - 328 | * CtsSystemUiHostTestCases - 329 | * CtsSystemUiTestCases - 330 | * CtsTelecomTestCases - 331 | * CtsTelecomTestCases2 - 332 | * CtsTelecomTestCases3 - 333 | * CtsTelephony2TestCases - 334 | * CtsTelephony3TestCases - 335 | * CtsTelephonyProviderTestCases - 336 | * CtsTelephonySdk28TestCases - 337 | * CtsTelephonyTestCases - 338 | * CtsTestHarnessModeTestCases - 339 | * CtsTextTestCases - 340 | * CtsTfliteNnapiDelegateTestCases - 341 | * CtsThemeDeviceTestCases - 342 | * CtsThemeHostTestCases - 343 | * CtsToastLegacyTestCases - 344 | * CtsToastTestCases - 345 | * CtsTransitionTestCases - 346 | * CtsTrustedVoiceHostTestCases - 347 | * CtsTvProviderTestCases - 348 | * CtsTvTestCases - 349 | * CtsUiAutomationTestCases - 350 | * CtsUiRenderingTestCases - 351 | * CtsUiRenderingTestCases27 - 352 | * CtsUidIsolationTestCases - 353 | * CtsUsageStatsTestCases - 354 | * CtsUsbTests - 355 | * CtsUsesLibraryHostTestCases - 356 | * CtsUtilTestCases - 357 | * CtsVideoTestCases - 358 | * CtsViewInspectorAnnotationProcessorTestCases - 359 | * CtsViewTestCases - 360 | * CtsViewTestCasesSdk28 - 361 | * CtsVoiceInteractionTestCases - 362 | * CtsVoiceSettingsTestCases - 363 | * CtsVrTestCases - 364 | * CtsWebkitTestCases - 365 | * CtsWidgetTestCases - 366 | * CtsWifiBroadcastsHostTestCases - 367 | * CtsWindowManagerDeviceTestCases - 368 | * CtsWindowManagerSdk25TestCases - 369 | * CtsWindowManagerSdk28TestCases - 370 | * CtsWrapNoWrapTestCases - 371 | * CtsWrapWrapDebugMallocDebugTestCases - 372 | * CtsWrapWrapDebugTestCases - 373 | * CtsWrapWrapNoDebugTestCases - 374 | * cts-shared-libs-all.api - 375 | * cts-system-all.api - 376 | * signed-CtsSecureElementAccessControlTestCases1 - 377 | * signed-CtsSecureElementAccessControlTestCases2 - 378 | * signed-CtsSecureElementAccessControlTestCases3 - 379 | * vm-tests-tf - 380 | -------------------------------------------------------------------------------- /For Testers/Android-12-cts-report-template.txt: -------------------------------------------------------------------------------- 1 | CTS results on [DEVICE] ([CODENAME]) running [GrapheneOS/FactoryOS/AOSP] [BUILD_NUMBER] [BETA/STABLE] ([ANDROID_RELEASE_VERSION] with [Chromium/Vanadium] [Chromium/Vanadium Number] [apk_release] as the [Webview and browser/Webview only/browser only] 2 | 3 | * CtsAbiOverrideHostTestCases - 4 | * CtsAccelerationTestCases - 5 | * CtsAccessibilityServiceSdk29TestCases - 6 | * CtsAccessibilityServiceTestCases - 7 | * CtsAccessibilityTestCases - 8 | * CtsAccountManagerTestCases - 9 | * CtsAccountsHostTestCases - 10 | * CtsActivityManagerBackgroundActivityTestCases - 11 | * CtsActivityRecognitionTestCases - 12 | * CtsAdbHostTestCases - 13 | * CtsAdbManagerHostTestCases - 14 | * CtsAdminPackageInstallerTestCases - 15 | * CtsAdminTestCases - 16 | * CtsAlarmManagerTestCases - 17 | * CtsAndroidAppTestCases - 18 | * CtsAndroidTestBase28ApiSignatureTestCases - 19 | * CtsAndroidTestBaseCurrentApiSignatureTestCases - 20 | * CtsAndroidTestMockCurrentApiSignatureTestCases - 21 | * CtsAndroidTestRunnerCurrentApiSignatureTestCases - 22 | * CtsAngleIntegrationHostTestCases - 23 | * CtsAnimationTestCases - 24 | * CtsApacheHttpLegacy27ApiSignatureTestCases - 25 | * CtsApacheHttpLegacyCurrentApiSignatureTestCases - 26 | * CtsApacheHttpLegacyUsesLibraryApiSignatureTestCases - 27 | * CtsApacheHttpTestCases - 28 | * CtsApexSharedLibrariesTestCases - 29 | * CtsApexTestCases - 30 | * CtsAppBindingHostTestCases - 31 | * CtsAppCloningHostTest - 32 | * CtsAppCompatHostTestCases - 33 | * CtsAppComponentFactoryTestCases - 34 | * CtsAppEnumerationTestCases - 35 | * CtsAppExitTestCases - 36 | * CtsAppIntegrityDeviceTestCases - 37 | * CtsAppOps2TestCases - 38 | * CtsAppOpsTestCases - 39 | * CtsAppPredictionServiceTestCases - 40 | * CtsAppSearchHostTestCases - 41 | * CtsAppSearchTestCases - 42 | * CtsAppSecurityHostTestCases - 43 | * CtsAppTestCases - 44 | * CtsAppUsageHostTestCases - 45 | * CtsAppWidgetTestCases - 46 | * CtsAslrMallocTestCases - 47 | * CtsAssistTestCases - 48 | * CtsAtomicInstallTestCases - 49 | * CtsAtraceHostTestCases - 50 | * CtsAttentionServiceDeviceTestCases - 51 | * CtsAutoFillServiceTestCases - 52 | * CtsBackgroundRestrictionsTestCases - 53 | * CtsBackupHostTestCases - 54 | * CtsBackupTestCases - 55 | * CtsBatterySavingTestCases - 56 | * CtsBiometricsTestCases - 57 | * CtsBionicAppTestCases - 58 | * CtsBionicTestCases - 59 | * CtsBlobStoreHostTestCases - 60 | * CtsBlobStoreTestCases - 61 | * CtsBluetoothTestCases - 62 | * CtsBootStatsTestCases - 63 | * CtsBugreportTestCases - 64 | * CtsCalendarProviderTestCases - 65 | * CtsCalendarcommon2TestCases - 66 | * CtsCallLogTestCases - 67 | * CtsCameraApi25TestCases - 68 | * CtsCameraApi31TestCases - 69 | * CtsCameraTestCases - 70 | * CtsCarHostTestCases - 71 | * CtsCarTestCases - 72 | * CtsCarrierApiTestCases - 73 | * CtsClassLoaderFactoryInMemoryDexClassLoaderTestCases - 74 | * CtsClassLoaderFactoryPathClassLoaderTestCases - 75 | * CtsClassloaderSplitsHostTestCases - 76 | * CtsClasspathsTestCases - 77 | * CtsCodePathHostTestCases - 78 | * CtsColorModeTestCases - 79 | * CtsCompilationTestCases - 80 | * CtsContactsProviderTestCases - 81 | * CtsContactsProviderWipe - 82 | * CtsContentCaptureServiceTestCases - 83 | * CtsContentSuggestionsTestCases - 84 | * CtsContentTestCases - 85 | * CtsControlsDeviceTestCases - 86 | * CtsCppToolsTestCases - 87 | * CtsCurrentApiSignatureTestCases - 88 | * CtsDatabaseTestCases - 89 | * CtsDeqpTestCases - 90 | * CtsDeviceConfigTestCases - 91 | * CtsDeviceIdleHostTestCases - 92 | * CtsDevicePolicyManagerTestCases - 93 | * CtsDevicePolicyTestCases[run-on-work-profile] - 94 | * CtsDevicePolicyTestCases[run-on-secondary-user] - 95 | * CtsDevicePolicyTestCases - 96 | * CtsDeviceStateManagerTestCases - 97 | * CtsDexMetadataHostTestCases - 98 | * CtsDisplayTestCases - 99 | * CtsDomainVerificationDeviceMultiUserTestCases[run-on-work-profile] - 100 | * CtsDomainVerificationDeviceMultiUserTestCases[run-on-secondary-user] - 101 | * CtsDomainVerificationDeviceMultiUserTestCases - 102 | * CtsDomainVerificationDeviceStandaloneTestCases - 103 | * CtsDomainVerificationHostTestCases - 104 | * CtsDownloadManagerApi28 - 105 | * CtsDownloadManagerInstaller - 106 | * CtsDpiTestCases - 107 | * CtsDpiTestCases2 - 108 | * CtsDreamsTestCases - 109 | * CtsDrmTestCases - 110 | * CtsDropBoxManagerTestCases - 111 | * CtsDumpsysHostTestCases - 112 | * CtsDynamicLinkerTestCases - 113 | * CtsDynamicMimeHostTestCases - 114 | * CtsEdiHostTestCases - 115 | * CtsEffectTestCases - 116 | * CtsExternalServiceTestCases - 117 | * CtsExtractNativeLibsHostTestCases - 118 | * CtsFileSystemTestCases - 119 | * CtsFragmentTestCases - 120 | * CtsFragmentTestCasesSdk26 - 121 | * CtsFrameRateOverrideTestCases - 122 | * CtsFsMgrTestCases - 123 | * CtsGameManagerTestCases - 124 | * CtsGestureTestCases - 125 | * CtsGpuProfilingDataTestCases - 126 | * CtsGpuToolsHostTestCases - 127 | * CtsGraphicsTestCases - 128 | * CtsGwpAsanTestCases - 129 | * CtsHardwareTestCases - 130 | * CtsHarmfulAppWarningHostTestCases - 131 | * CtsHdmiCecHostTestCases - 132 | * CtsHiddenApiBlocklistApi27TestCases - 133 | * CtsHiddenApiBlocklistApi28TestCases - 134 | * CtsHiddenApiBlocklistCurrentApiTestCases - 135 | * CtsHiddenApiBlocklistDebugClassTestCases - 136 | * CtsHiddenApiBlocklistTestApiTestCases - 137 | * CtsHiddenApiKillswitchDebugClassTestCases - 138 | * CtsHiddenApiKillswitchWildcardTestCases - 139 | * CtsHostTzDataTests - 140 | * CtsHostsideHiddenapiTests - 141 | * CtsHostsideNetworkTests - 142 | * CtsHostsideNumberBlockingTestCases - 143 | * CtsHostsideTvTests - 144 | * CtsHostsideWebViewTests - 145 | * CtsIcu4cTestCases - 146 | * CtsIcuTestCases - 147 | * CtsIdentityTestCases - 148 | * CtsIkeTestCases - 149 | * CtsIncidentHostTestCases - 150 | * CtsIncrementalInstallHostTestCases - 151 | * CtsInitTestCases - 152 | * CtsInlineMockingTestCases - 153 | * CtsInputMethodServiceHostTestCases - 154 | * CtsInputMethodTestCases - 155 | * CtsInputTestCases - 156 | * CtsInstallHostTestCases - 157 | * CtsInstalledLoadingProgressHostTests - 158 | * CtsInstantAppTests - 159 | * CtsIntentSignatureTestCases - 160 | * CtsJdwpSecurityHostTestCases - 161 | * CtsJdwpTestCases - 162 | * CtsJdwpTunnelHostTestCases - 163 | * CtsJniTestCases - 164 | * CtsJobSchedulerSharedUidTestCases - 165 | * CtsJobSchedulerTestCases - 166 | * CtsJvmtiAttachingHostTestCases - 167 | * CtsJvmtiAttachingTestCases - 168 | * CtsJvmtiRedefineClassesHostTestCases - 169 | * CtsJvmtiRunTest1900HostTestCases - 170 | * CtsJvmtiRunTest1901HostTestCases - 171 | * CtsJvmtiRunTest1902HostTestCases - 172 | * CtsJvmtiRunTest1903HostTestCases - 173 | * CtsJvmtiRunTest1904HostTestCases - 174 | * CtsJvmtiRunTest1906HostTestCases - 175 | * CtsJvmtiRunTest1907HostTestCases - 176 | * CtsJvmtiRunTest1908HostTestCases - 177 | * CtsJvmtiRunTest1909HostTestCases - 178 | * CtsJvmtiRunTest1910HostTestCases - 179 | * CtsJvmtiRunTest1911HostTestCases - 180 | * CtsJvmtiRunTest1912HostTestCases - 181 | * CtsJvmtiRunTest1913HostTestCases - 182 | * CtsJvmtiRunTest1914HostTestCases - 183 | * CtsJvmtiRunTest1915HostTestCases - 184 | * CtsJvmtiRunTest1916HostTestCases - 185 | * CtsJvmtiRunTest1917HostTestCases - 186 | * CtsJvmtiRunTest1920HostTestCases - 187 | * CtsJvmtiRunTest1921HostTestCases - 188 | * CtsJvmtiRunTest1922HostTestCases - 189 | * CtsJvmtiRunTest1923HostTestCases - 190 | * CtsJvmtiRunTest1924HostTestCases - 191 | * CtsJvmtiRunTest1925HostTestCases - 192 | * CtsJvmtiRunTest1926HostTestCases - 193 | * CtsJvmtiRunTest1927HostTestCases - 194 | * CtsJvmtiRunTest1928HostTestCases - 195 | * CtsJvmtiRunTest1930HostTestCases - 196 | * CtsJvmtiRunTest1931HostTestCases - 197 | * CtsJvmtiRunTest1932HostTestCases - 198 | * CtsJvmtiRunTest1933HostTestCases - 199 | * CtsJvmtiRunTest1934HostTestCases - 200 | * CtsJvmtiRunTest1936HostTestCases - 201 | * CtsJvmtiRunTest1937HostTestCases - 202 | * CtsJvmtiRunTest1939HostTestCases - 203 | * CtsJvmtiRunTest1941HostTestCases - 204 | * CtsJvmtiRunTest1942HostTestCases - 205 | * CtsJvmtiRunTest1943HostTestCases - 206 | * CtsJvmtiRunTest1953HostTestCases - 207 | * CtsJvmtiRunTest1958HostTestCases - 208 | * CtsJvmtiRunTest1962HostTestCases - 209 | * CtsJvmtiRunTest1967HostTestCases - 210 | * CtsJvmtiRunTest1968HostTestCases - 211 | * CtsJvmtiRunTest1969HostTestCases - 212 | * CtsJvmtiRunTest1970HostTestCases - 213 | * CtsJvmtiRunTest1971HostTestCases - 214 | * CtsJvmtiRunTest1974HostTestCases - 215 | * CtsJvmtiRunTest1975HostTestCases - 216 | * CtsJvmtiRunTest1976HostTestCases - 217 | * CtsJvmtiRunTest1977HostTestCases - 218 | * CtsJvmtiRunTest1978HostTestCases - 219 | * CtsJvmtiRunTest1979HostTestCases - 220 | * CtsJvmtiRunTest1981HostTestCases - 221 | * CtsJvmtiRunTest1982HostTestCases - 222 | * CtsJvmtiRunTest1983HostTestCases - 223 | * CtsJvmtiRunTest1984HostTestCases - 224 | * CtsJvmtiRunTest1988HostTestCases - 225 | * CtsJvmtiRunTest1989HostTestCases - 226 | * CtsJvmtiRunTest1990HostTestCases - 227 | * CtsJvmtiRunTest1991HostTestCases - 228 | * CtsJvmtiRunTest1992HostTestCases - 229 | * CtsJvmtiRunTest1994HostTestCases - 230 | * CtsJvmtiRunTest1995HostTestCases - 231 | * CtsJvmtiRunTest1996HostTestCases - 232 | * CtsJvmtiRunTest1997HostTestCases - 233 | * CtsJvmtiRunTest1998HostTestCases - 234 | * CtsJvmtiRunTest1999HostTestCases - 235 | * CtsJvmtiRunTest2001HostTestCases - 236 | * CtsJvmtiRunTest2002HostTestCases - 237 | * CtsJvmtiRunTest2003HostTestCases - 238 | * CtsJvmtiRunTest2004HostTestCases - 239 | * CtsJvmtiRunTest2005HostTestCases - 240 | * CtsJvmtiRunTest2006HostTestCases - 241 | * CtsJvmtiRunTest2007HostTestCases - 242 | * CtsJvmtiRunTest902HostTestCases - 243 | * CtsJvmtiRunTest903HostTestCases - 244 | * CtsJvmtiRunTest904HostTestCases - 245 | * CtsJvmtiRunTest905HostTestCases - 246 | * CtsJvmtiRunTest906HostTestCases - 247 | * CtsJvmtiRunTest907HostTestCases - 248 | * CtsJvmtiRunTest908HostTestCases - 249 | * CtsJvmtiRunTest910HostTestCases - 250 | * CtsJvmtiRunTest911HostTestCases - 251 | * CtsJvmtiRunTest912HostTestCases - 252 | * CtsJvmtiRunTest913HostTestCases - 253 | * CtsJvmtiRunTest914HostTestCases - 254 | * CtsJvmtiRunTest915HostTestCases - 255 | * CtsJvmtiRunTest917HostTestCases - 256 | * CtsJvmtiRunTest918HostTestCases - 257 | * CtsJvmtiRunTest919HostTestCases - 258 | * CtsJvmtiRunTest920HostTestCases - 259 | * CtsJvmtiRunTest922HostTestCases - 260 | * CtsJvmtiRunTest923HostTestCases - 261 | * CtsJvmtiRunTest924HostTestCases - 262 | * CtsJvmtiRunTest926HostTestCases - 263 | * CtsJvmtiRunTest927HostTestCases - 264 | * CtsJvmtiRunTest928HostTestCases - 265 | * CtsJvmtiRunTest930HostTestCases - 266 | * CtsJvmtiRunTest931HostTestCases - 267 | * CtsJvmtiRunTest932HostTestCases - 268 | * CtsJvmtiRunTest940HostTestCases - 269 | * CtsJvmtiRunTest942HostTestCases - 270 | * CtsJvmtiRunTest944HostTestCases - 271 | * CtsJvmtiRunTest945HostTestCases - 272 | * CtsJvmtiRunTest947HostTestCases - 273 | * CtsJvmtiRunTest951HostTestCases - 274 | * CtsJvmtiRunTest982HostTestCases - 275 | * CtsJvmtiRunTest983HostTestCases - 276 | * CtsJvmtiRunTest984HostTestCases - 277 | * CtsJvmtiRunTest985HostTestCases - 278 | * CtsJvmtiRunTest986HostTestCases - 279 | * CtsJvmtiRunTest988HostTestCases - 280 | * CtsJvmtiRunTest989HostTestCases - 281 | * CtsJvmtiRunTest990HostTestCases - 282 | * CtsJvmtiRunTest991HostTestCases - 283 | * CtsJvmtiRunTest992HostTestCases - 284 | * CtsJvmtiRunTest993HostTestCases - 285 | * CtsJvmtiRunTest994HostTestCases - 286 | * CtsJvmtiRunTest995HostTestCases - 287 | * CtsJvmtiRunTest996HostTestCases - 288 | * CtsJvmtiRunTest997HostTestCases - 289 | * CtsJvmtiTaggingHostTestCases - 290 | * CtsJvmtiTrackingHostTestCases - 291 | * CtsKernelConfigTestCases - 292 | * CtsKeystoreTestCases - 293 | * CtsLeanbackJankTestCases - 294 | * CtsLegacyNotification20TestCases - 295 | * CtsLegacyNotification27TestCases - 296 | * CtsLegacyNotification28TestCases - 297 | * CtsLegacyNotification29TestCases - 298 | * CtsLegacyNotification30TestCases - 299 | * CtsLibcoreApiEvolutionTestCases - 300 | * CtsLibcoreFileIOTestCases - 301 | * CtsLibcoreJsr166TestCases - 302 | * CtsLibcoreLegacy22TestCases - 303 | * CtsLibcoreOjTestCases - 304 | * CtsLibcoreOkHttpTestCases - 305 | * CtsLibcoreTestCases - 306 | * CtsLibcoreWycheproofBCTestCases - 307 | * CtsLibcoreWycheproofConscryptTestCases - 308 | * CtsLiblogTestCases - 309 | * CtsLibnativehelperTestCases - 310 | * CtsLocationCoarseTestCases - 311 | * CtsLocationFineTestCases - 312 | * CtsLocationGnssTestCases - 313 | * CtsLocationNoneTestCases - 314 | * CtsLocationPrivilegedTestCases - 315 | * CtsLocationTimeZoneManagerHostTest - 316 | * CtsLogdTestCases - 317 | * CtsMediaBitstreamsTestCases - 318 | * CtsMediaHostTestCases - 319 | * CtsMediaParserHostTestCases - 320 | * CtsMediaParserTestCases - 321 | * CtsMediaPerformanceClassTestCases - 322 | * CtsMediaProviderTranscodeTests - 323 | * CtsMediaStressTestCases - 324 | * CtsMediaTestCases - 325 | * CtsMediaTranscodingTestCases - 326 | * CtsMediaV2TestCases - 327 | * CtsMidiTestCases - 328 | * CtsMimeMapTestCases - 329 | * CtsMockingDebuggableTestCases - 330 | * CtsMockingTestCases - 331 | * CtsMonkeyTestCases - 332 | * CtsMultiUserHostTestCases - 333 | * CtsMultiUserTestCases - 334 | * CtsMusicRecognitionTestCases - 335 | * CtsNNAPIBenchmarkTestCases - 336 | * CtsNNAPIJavaTestCases - 337 | * CtsNNAPITestCases - 338 | * CtsNativeEncryptionTestCases - 339 | * CtsNativeHardwareTestCases - 340 | * CtsNativeMediaAAudioTestCases - 341 | * CtsNativeMediaMetricsTestCases - 342 | * CtsNativeMediaSlTestCases - 343 | * CtsNativeMediaXaTestCases - 344 | * CtsNativeMidiTestCases - 345 | * CtsNativeNetDnsTestCases - 346 | * CtsNativeNetTestCases - 347 | * CtsNativeVerifiedBootTestCases - 348 | * CtsNdefTestCases - 349 | * CtsNdkBinderTestCases - 350 | * CtsNetApi23TestCases - 351 | * CtsNetSecConfigAttributeTestCases - 352 | * CtsNetSecConfigBasicDebugDisabledTestCases - 353 | * CtsNetSecConfigBasicDebugEnabledTestCases - 354 | * CtsNetSecConfigBasicDomainConfigTestCases - 355 | * CtsNetSecConfigCleartextTrafficTestCases - 356 | * CtsNetSecConfigDownloadManagerTestCases - 357 | * CtsNetSecConfigInvalidPinTestCases - 358 | * CtsNetSecConfigNestedDomainConfigTestCases - 359 | * CtsNetSecConfigPrePCleartextTrafficTestCases - 360 | * CtsNetSecConfigResourcesSrcTestCases - 361 | * CtsNetSecPolicyUsesCleartextTrafficFalseTestCases - 362 | * CtsNetSecPolicyUsesCleartextTrafficTrueTestCases - 363 | * CtsNetSecPolicyUsesCleartextTrafficUnspecifiedTestCases - 364 | * CtsNetTestCases - 365 | * CtsNetTestCasesInternetPermission - 366 | * CtsNetTestCasesLegacyApi22 - 367 | * CtsNetTestCasesLegacyPermission22 - 368 | * CtsNetTestCasesUpdateStatsPermission - 369 | * CtsNfcTestCases - 370 | * CtsNoPermissionTestCases - 371 | * CtsNoPermissionTestCases25 - 372 | * CtsOpenGLTestCases - 373 | * CtsOpenGlPerf2TestCases - 374 | * CtsOpenGlPerfTestCases - 375 | * CtsOsHostTestCases - 376 | * CtsOsTestCases - 377 | * CtsPackageInstallAppOpDefaultTestCases - 378 | * CtsPackageInstallAppOpDeniedTestCases - 379 | * CtsPackageInstallTestCases - 380 | * CtsPackageInstallerTapjackingTestCases - 381 | * CtsPackageManagerMultiUserHostTestCases - 382 | * CtsPackageManagerParsingHostTestCases - 383 | * CtsPackageManagerPreferredActivityHostTestCases - 384 | * CtsPackageManagerStatsHostTestCases - 385 | * CtsPackageUninstallTestCases - 386 | * CtsPackageWatchdogTestCases - 387 | * CtsPdfTestCases - 388 | * CtsPerfettoTestCases - 389 | * CtsPermission2TestCases - 390 | * CtsPermission3TestCases - 391 | * CtsPermission4TestCases - 392 | * CtsPermission5TestCases - 393 | * CtsPermissionManagerNativeTestCases - 394 | * CtsPermissionTestCases - 395 | * CtsPermissionTestCasesSdk28 - 396 | * CtsPermissionTestCasesTelephony - 397 | * CtsPreferenceTestCases - 398 | * CtsPrintTestCases - 399 | * CtsProtoTestCases - 400 | * CtsProviderTestCases - 401 | * CtsProviderUiTestCases - 402 | * CtsQuickAccessWalletTestCases - 403 | * CtsRebootReadinessTestCases - 404 | * CtsRenderscriptLegacyTestCases - 405 | * CtsRenderscriptTestCases - 406 | * CtsResolverServiceTestCases - 407 | * CtsResourcesLoaderTests - 408 | * CtsRoleTestCases - 409 | * CtsRollbackManagerHostTestCases - 410 | * CtsRotationResolverServiceDeviceTestCases - 411 | * CtsRsBlasTestCases - 412 | * CtsRsCppTestCases - 413 | * CtsSampleDeviceTestCases - 414 | * CtsSampleHostTestCases - 415 | * CtsSaxTestCases - 416 | * CtsScopedStorageCoreHostTest - 417 | * CtsScopedStorageDeviceOnlyTest - 418 | * CtsScopedStorageHostTest - 419 | * CtsSdkExtensionsTestCases - 420 | * CtsSearchUiServiceTestCases - 421 | * CtsSeccompHostTestCases - 422 | * CtsSecureFrpInstallTestCases - 423 | * CtsSecurityBulletinHostTestCases - 424 | * CtsSecurityHostTestCases - 425 | * CtsSecurityTestCases - 426 | * CtsSelinuxEphemeralTestCases - 427 | * CtsSelinuxTargetSdk25TestCases - 428 | * CtsSelinuxTargetSdk27TestCases - 429 | * CtsSelinuxTargetSdk28TestCases - 430 | * CtsSelinuxTargetSdk29TestCases - 431 | * CtsSelinuxTargetSdkCurrentTestCases - 432 | * CtsSensorPrivacyTestCases - 433 | * CtsSensorRatePermissionTestCases - 434 | * CtsSensorTestCases - 435 | * CtsSettingsHostTestCases - 436 | * CtsSettingsSuggestionsTest - 437 | * CtsSettingsTestCases - 438 | * CtsSharedLibsApiSignatureTestCases - 439 | * CtsSharesheetTestCases - 440 | * CtsShortcutHostTestCases - 441 | * CtsShortcutManagerTestCases - 442 | * CtsSignedConfigHostTestCases - 443 | * CtsSilentUpdateHostTestCases - 444 | * CtsSimPhonebookProviderTestCases - 445 | * CtsSimRestrictedApisTestCases - 446 | * CtsSimpleCpuTestCases - 447 | * CtsSimpleperfTestCases - 448 | * CtsSliceTestCases - 449 | * CtsSmartspaceServiceTestCases - 450 | * CtsSoundTriggerTestCases - 451 | * CtsSpeechTestCases - 452 | * CtsStatsdAtomHostTestCases - 453 | * CtsStatsdHostTestCases - 454 | * CtsStrictJavaPackagesTestCases - 455 | * CtsSuspendAppsPermissionTestCases - 456 | * CtsSuspendAppsTestCases - 457 | * CtsSustainedPerformanceHostTestCases - 458 | * CtsSyncAccountAccessOtherCertTestCases - 459 | * CtsSyncContentHostTestCases - 460 | * CtsSyncManagerTestsCases - 461 | * CtsSystemApiAnnotationTestCases - 462 | * CtsSystemApiSignatureTestCases - 463 | * CtsSystemIntentTestCases - 464 | * CtsSystemUiHostTestCases - 465 | * CtsSystemUiTestCases - 466 | * CtsTaggingHostTestCases - 467 | * CtsTelecomTestCases - 468 | * CtsTelecomTestCases2 - 469 | * CtsTelecomTestCases3 - 470 | * CtsTelephony2TestCases - 471 | * CtsTelephony3TestCases - 472 | * CtsTelephonyHostCases - 473 | * CtsTelephonyProviderHostCases - 474 | * CtsTelephonyProviderTestCases - 475 | * CtsTelephonySdk28TestCases - 476 | * CtsTelephonyTestCases - 477 | * CtsTelephonyTestCasesPermissionReadPhoneState - 478 | * CtsTestHarnessModeTestCases - 479 | * CtsTetheringTest - 480 | * CtsTextClassifierTestCases - 481 | * CtsTextTestCases - 482 | * CtsTfliteNnapiDelegateTestCases - 483 | * CtsThemeDeviceTestCases - 484 | * CtsThemeHostTestCases - 485 | * CtsThermalTestCases - 486 | * CtsTimeTestCases - 487 | * CtsToastLegacyTestCases - 488 | * CtsToastTestCases - 489 | * CtsTransitionTestCases - 490 | * CtsTranslationTestCases - 491 | * CtsTrustedVoiceHostTestCases - 492 | * CtsTvProviderTestCases - 493 | * CtsTvTestCases - 494 | * CtsUffdGcTestCases - 495 | * CtsUiAutomationTestCases - 496 | * CtsUiRenderingTestCases - 497 | * CtsUiRenderingTestCases27 - 498 | * CtsUidIsolationTestCases - 499 | * CtsUsageStatsTestCases - 500 | * CtsUsbManagerTestCases - 501 | * CtsUsbTests - 502 | * CtsUsesLibraryHostTestCases - 503 | * CtsUsesNativeLibraryTest - 504 | * CtsUtilTestCases - 505 | * CtsUwbTestCases - 506 | * CtsVcnTestCases - 507 | * CtsVideoTestCases - 508 | * CtsViewInspectorAnnotationProcessorTestCases - 509 | * CtsViewReceiveContentTestCases - 510 | * CtsViewTestCases - 511 | * CtsViewTestCasesSdk28 - 512 | * CtsVoiceInteractionTestCases - 513 | * CtsVoiceRecognitionTestCases - 514 | * CtsVoiceSettingsTestCases - 515 | * CtsVrTestCases - 516 | * CtsWebkitTestCases - 517 | * CtsWidgetTestCases - 518 | * CtsWidgetTestCases29 - 519 | * CtsWifiBroadcastsHostTestCases - 520 | * CtsWifiTestCases - 521 | * CtsWindowManagerDeviceTestCases - 522 | * CtsWindowManagerJetpackTestCases - 523 | * CtsWindowManagerSdk25TestCases - 524 | * CtsWindowManagerSdk29TestCases - 525 | * CtsWrapNoWrapTestCases - 526 | * CtsWrapWrapDebugMallocDebugTestCases - 527 | * CtsWrapWrapDebugTestCases - 528 | * CtsWrapWrapNoDebugTestCases - 529 | * LegacyStorageTest - 530 | * ResourceObserverNativeTest - 531 | * ScopedStorageTest - 532 | * signed-CtsOmapiTestCases - 533 | * signed-CtsSecureElementAccessControlTestCases1 - 534 | * signed-CtsSecureElementAccessControlTestCases2 - 535 | * signed-CtsSecureElementAccessControlTestCases3 - 536 | * vm-tests-tf - 537 | -------------------------------------------------------------------------------- /For Testers/The-Compatibility-Test-Suite.md: -------------------------------------------------------------------------------- 1 | # Running the Android Compatibility Test Suite 2 | 3 | ## Initial preparation 4 | 5 | You're going to need a few things to test GrapheneOS. 6 | 7 | ### Hardware 8 | * An x86-64 computer running your flavour of Linux. It doesn't have to be powerful, as the phone will do most of the work. **32-bit x86 is not supported.** 9 | * A good-quality USB-A to USB-C cable. **Take Note:** Android takes full advantage of all the features offered by the USB protocol. Many laptops that have USB-C ports, or computer towers that have front ports often do not implement all the features, and Linux kernels that predate 5 may have broken support for USB 3 and 3.1. Many errors are caused by improperly traced or shoddy cables. For best results, always use a high-quality USB-A to C cable plugged directly into the motherboard of your computer. 10 | * The device you want to test 11 | * A well-lit area with a way to prop the phone up at least an arm's length away from something it can focus on. A great way to do this is simply using tape to secure the phone to something heavy, such as a wooden block, a small weight, or even a mitten drying rack. 12 | 13 | 14 | ### Software 15 | 16 | On the software side of things, you're going to need 17 | 18 | * The compatibility test suite software, which is located at: `https://dl.google.com/dl/android/cts/android-cts-12_r3-linux_x86-arm.zip` 19 | * The compatibility test media, which you can also download at: `https://dl.google.com/dl/android/cts/android-cts-media-1.5.zip` 20 | * The Android Studio, which is available for download at: `https://developer.android.com/studio/` If you're feeling brave, you can simply download it directly from the mirror at `https://redirector.gvt1.com/edgedl/android/studio/ide-zips/2021.1.1.21/android-studio-2021.1.1.21-linux.tar.gz` 21 | 22 | Or you can obtain it all at once by running: 23 | 24 | ``` 25 | wget https://dl.google.com/dl/android/cts/android-cts-12_r2-linux_x86-arm.zip https://dl.google.com/dl/android/cts/android-cts-media-1.5.zip https://redirector.gvt1.com/edgedl/android/studio/ide-zips/2021.1.1.21/android-studio-2021.1.1.21-linux.tar.gz 26 | ``` 27 | 28 | ### Setting up 29 | Android Studio will need to be set up, as the Compatibility Test Suite depends on some software packages included in Android Studio. Simply download the Android Studio and run `studio.sh` in the `bin` directory to get it set up for your system. By default, it will save itself in `$HOME/Android`. You'll want to add this to your command path by running: 30 | 31 | ``` 32 | tar -xf android-studio-2021.1.1.21-linux.tar.gz 33 | ./android-studio/bin/studio.sh 34 | ``` 35 | And following the instructions. By default, it will install to a directory called `Android` in your home directory. Unless you change the defaults, you should be able to add the tools to your command path using the command: 36 | ``` 37 | export PATH=$PATH:$HOME/Android/Sdk/platform-tools/:$HOME/Android/Sdk/tools:$HOME/Android/Sdk/tools/bin:$HOME/Android/Sdk/build-tools/32.0.0 38 | ``` 39 | If you would like this to be done automatically for you after closing the window, run the following: 40 | ``` 41 | echo "export PATH=$PATH:$HOME/Android/Sdk/platform-tools/:$HOME/Android/Sdk/tools:$HOME/Android/Sdk/tools/bin:$HOME/Android/Sdk/build-tools/32.0.0" >> ~/.bashrc 42 | ``` 43 | You can then unpack the compatibility test suite to your computer and appending it to your path by running the following: 44 | ``` 45 | unzip android-cts-12_r2-linux_x86-arm.zip 46 | export PATH=$PATH:$(pwd)/android-cts/tools/: 47 | ``` 48 | If you'd like to make it persistent, you can run the following command: 49 | ``` 50 | echo "export PATH=$PATH:$(pwd)/android-cts/tools/:" >> ~/.bashrc 51 | ``` 52 | Now, you're just about all ready to run the CTS! 53 | 54 | ### Preparing your phone 55 | Preparing the phone is relatively simple now that you've got the computer set up. 56 | 57 | As long as you have ample space to store the CTS media and the bootloader is locked, it's not important what apps or data you have on your phone, so long as you *do **not** disable any of the built-in apps that come with your phone.* This includes the search and camera app. Please leave the default apps enabled. 58 | 59 | #### Turning on USB Debugging 60 | In your phone, open up **Settings ➔ About Phone** and scroll all the way to **Build Number**. Tap on **Build Number** approximately ten times in rapid succession to unlock developer mode. 61 | 62 | Return to **Settings** and go from **Settings ➔ System ➔ Advanced ➔ Developer Options** and turn on **USB Debugging.** 63 | 64 | **Attention:** *Turning on USB Debugging opens up your phone to a significant amount of attack surface from the significantly less-secure computer being trusted to debug it, which can, once given permission to debug the phone, may execute a Unix-like shell on the device at will as well as both write, read, and erase files on the phone's shared storage. USB Debugging is only intended as a feature for debugging and testing only by developers. It is not intended to be used by "advanced users" to unlock additional functionality. Using USB Debugging on a device you intend to use daily is not recommended.* 65 | 66 | Connect the phone to your computer by the USB slot and drag down the top notification bar. You may see something that looks like "Charging this device via USB." Tap the bar to bring up the USB Preferences menu, which should have a multiple choice selection from "No data transfer." Set it to "File Transfer." Once you're done, type in: 67 | 68 | ``` 69 | adb devices 70 | ``` 71 | 72 | A box may pop up to authorize the identity of the computer plugged into the phone. You will need to approve it before any work can begin. You may see something like: 73 | ``` 74 | user@computer: ~ $ adb devices 75 | * daemon not running; starting now at tcp:5037 76 | * daemon started successfully 77 | List of devices attached 78 | XXXXXXXXX device 79 | ``` 80 | If you can see this, you're ready to begin. 81 | 82 | #### Transferring the CTS Media. 83 | The CTS Media is a collection of videos, pictures, and files that the phone will use to debug itself for the CTS testing. If you've successfully set up USB debugging on your phone, you're now ready to begin transferring the CTS media to it, which uses a pair of scripts, and the software you've just provisioned and installed to send all the files to your phone in their proper place. 84 | 85 | Simply unzip the CTS Media and run the scripts. 86 | ``` 87 | unzip android-cts-media-1.5.zip 88 | cd android-cts-media-1.5/ 89 | ./copy_images.sh && ./copy_media.sh 90 | ``` 91 | Wait for them to complete. When they're ready, you're able to go ahead with testing. 92 | 93 | #### Physically Setting Up Your Phone 94 | Your phone should be in a well lit area, propped up on its side so both the front and rear cameras can focus on something. Ideally, each target should be brightly coloured, and at least an arm's length away from the phone. Taping the phone sideways to a brick, or placing it in a mitt drying rack is ideal. Make sure the phone is somewhere where it won't be disturbed. 95 | 96 | **Attention:** *Your phone may at times produce loud squawking sounds or play loud sound effects, ringtones, or even movies. It may take pictures or even short video clips while it is being tested. This is normal and part of the Compatibility Test Suite. If you do not want it to play loud music, plug in a USB splitter and a set of USB headphones to prevent it from playing loud sounds.* 97 | 98 | Prior to testing, you should ensure the phone has a few things set: 99 | * It must be connected to a WiFi network 100 | * You should have a working SIM card in it 101 | * Disable SIM lock 102 | * Enable Bluetooth 103 | * Enable NFC 104 | * Open Chromium and close it once 105 | * You should have a good signal for GPS. 106 | * You must turn off screen lock. A password or pincode will cause the CTS to fail. 107 | 108 | ### Running the CTS 109 | 110 | Bring up the CTS with the command: 111 | 112 | ``` 113 | cts-tradefed 114 | ``` 115 | Which should bring you to the following screen: 116 | ``` 117 | ================== 118 | Notice: 119 | We collect anonymous usage statistics in accordance with our Content Licenses (https://source.android.com/setup/start/licenses), Contributor License Agreement (https://opensource.google.com/docs/cla/), Privacy Policy (https://policies.google.com/privacy) and Terms of Service (https://policies.google.com/terms). 120 | ================== 121 | Android Compatibility Test Suite 10_r3 (6221200) 122 | Use "help" or "help all" to get more information on running commands. 123 | cts-tf > 124 | ``` 125 | Welcome to the Android Compatibility Test Suite. 126 | 127 | #### Running your first test 128 | 129 | First, ensure your phone is propped up in a well-lit area. 130 | 131 | There are hundreds of testing modules available, which can be run individually, or run as a set in a series of tests which are grouped together as plans. To list the modules in the CTS, at the prompt, type: 132 | ``` 133 | cts-tf > list modules 134 | ``` 135 | There are quite a large number of them! Don't be intimidated by the number of them, these are simply the individual test cases for each contingency the CTS has to test. To find a much more intuitive and manageable list of pre-bundled plans, simply type: 136 | ``` 137 | cts-tf > list plans 138 | ``` 139 | It's time to run your first test. At the prompt, type: 140 | ``` 141 | cts-tf > run cts 142 | ``` 143 | And let her rip. Note that you can expect that the testing can take several hours for the plan to run. At this time, the phone will be running tests, and even if it appears to be idle, should not be disturbed. Doing so may give false positives or false negatives on the test, and send all the time the phone has spent on the rack to waste. 144 | 145 | **Heads up!** *The CTS can be running for long periods of time and returns to the prompt while the job is running in the background. Long periods of time may go by when the CTS program will seem to be inactive. If you have any doubts as to what it's doing, find out its status by using the command:* `list invocations` *before attempting to cancel out of the CTS. As CTS batches can take long times to run, you may save yourself large amounts of time and frustration doing so and being patient, rather than simply assuming that the CTS has stopped or frozen, or isn't doing anything.* 146 | 147 | #### After the test 148 | 149 | After your test finishes, you'll be left with a directory listing your results in `android-cts/results` which are listed by date and time and are helpfully copied in zip files. 150 | 151 | Open one of them, and you will see a file called `test_result.html` which can be opened in any web browser. This will tell you a summary of the results. 152 | 153 | ##### Things to keep note of: 154 | 155 | You may want to run the test several times. The CTS is not exact and as it's a real world test of the phone's abilities, it may take running the same test plan up to five or more times to see what consistently passes and what consistently fail. Go through each test result report and be sure to take note of which tests consistently fail, the plans that were run, the time and builds that they were run on. This is important to the developers, and will help save them valuable time in analyzing each report themselves. 156 | 157 | Ideally, the reports for the CTS should be compared between like devices: one running GrapheneOS, one running the Google Android, and one running standard AOSP. 158 | 159 | ### Interpreting the results and composing and sending the report 160 | 161 | As the National Security Agency has had to learn the hard way, data on its own is of little value, and adding more doesn't help the situation! Data is only good if it's something that can be *understood.* 162 | 163 | To help the developers, it's best to understand not only what passes or fails, but also more importantly, why something passes or fails. GrapheneOS as an operating system has security and privacy goals that exceed that of the operating system that Google releases, and is willing to make some compromises in terms of performance or even sometimes reverse or backward compatibility when it comes to maintaining security and privacy, and some tests by design are going to end up failing. It would be a waste of time for one of the developers trying to solve a problem to see a test has failed, end up investigating it, and then find out that the "problem" is intentional! 164 | 165 | A good example of a report is located here: https://gist.github.com/thestinger/17fe9aeb371a4ceae2aaac2a603f2798 . This report was done for the Pixel 2 running an older version of Android 9 AOSP. As the CTS for Android 12 has changed somewhat, a template constructed from the Android 12 CTS is located in this directory under the filename Android-12-cts-report-template.txt 166 | 167 | #### Filling out the title 168 | At the start of the form, you'll notice the title. This is important information in knowing what report corresponds to which device, at which time, with the respective release. 169 | ``` 170 | CTS results on [DEVICE] ([CODENAME]) running [GrapheneOS/FactoryOS/AOSP] [BUILD_NUMBER] [BETA/STABLE] ([ANDROID_RELEASE_VERSION] with [Chromium/Vanadium] [Chromium/Vanadium Number] [apk_release] as the [Webview and browser/Webview only/browser only] 171 | ``` 172 | This should be filled out according to your device. 173 | 174 | ##### Device and codename 175 | | Device | Codename | Status | 176 | |------------|------------|--------------| 177 | | Pixel | Sailfish | Discontinued | 178 | | Pixel | Wahoo | Discontinued | 179 | | Pixel 2 | Walleye | Discontinued | 180 | | Pixel 2XL | Taimen | Discontinued | 181 | | Pixel 3 | Blueline | Legacy | 182 | | Pixel 3XL | Crosshatch | Legacy | 183 | | Pixel 3a | Sargo | Supported | 184 | | Pixel 3aXL | Bonito | Supported | 185 | | Pixel 4 | Flame | Supported | 186 | | Pixel 4XL | Coral | Supported | 187 | | Pixel 4a | Sunfish | Supported | 188 | | Pixel 4a5g | Bramble | Supported | 189 | | Pixel 5 | Redfin | Supported | 190 | | Pixel 5a | Barbet | Supported | 191 | | Pixel 6 | Oriole | Supported | 192 | | Pixel 6Pro | Raven | Supported | 193 | 194 | Items marked "Supported" are priority items. Items marked "Legacy" are currently second class and may be discontinued at any moment, but testing on them should be done if they are available. tems marked "Discontinued" are pop tarts. Like the eponymous toaster pastries, they're useful for providing energy, but have no nutritional value at all. 195 | 196 | ##### Build number 197 | Your Build number can be found by going to **Settings ➔ About Phone ➔ Build Number**. 198 | 199 | ##### Beta or stable? 200 | It's only useful to test the beta releases. Please don't bother with the stable releases. 201 | 202 | ##### Android release version 203 | Go to **Settings ➔ System ➔ Advanced** and look at the text under **System update settings** to find your Android release version. It should be 10. 204 | 205 | ##### Chromium/Vanadium, version, and webview. 206 | Although internally, Vandium will use some of Chromium's naming, on GrapheneOS, it's always referred to as Vanadium. To find your version, place your finger on Vanadium and hold it down until the tab menu comes up, which should give you an **(i)**. Tap the **(i)** to bring up the App info on it, and scroll all the way to the bottom to find the version number. It may look something like: `81.0.4044.96`. On the Google operating system or AOSP, simply do the same with Chrome, or Chromium, respectively. 207 | 208 | Leave the rest as `monochrome_public_apk as the WebView and browser.` on GrapheneOS, Vanadium is a part of the operating system and provides the system webview. This'll only change if there's a problem with using Vanadium as the webview, which isn't likely in the future. 209 | 210 | #### Filling out the lines 211 | Take note that the CTS reports on the are not black and white and are not strictly pass-or-fail. We'll pull from this we can see from this example: 212 | 213 | ``` 214 | * CtsActivityManagerDeviceTestCases - pass (flaky) 215 | - test module is quite flaky seemingly due to race conditions in how the 216 | tests are implemented, so occasional failures don't necessarily indicate 217 | problems in the OS 218 | - very flaky: android.server.am.ActivityManagerDisplayLockedKeyguardTests#testDismissKeyguard_whileOccluded_secondaryDisplay 219 | ``` 220 | 221 | In this example, while the activity listed as **CtsActivityManagerDeviceTestCases** seems to have passed, it's been listed as "flaky." This could be for a variety of reasons. If you've noticed that after five or more repeated runs, a particular test module is not consistently passing, it's best to call it "flaky" and review in the test results what information seems to recur whenever a test fails. 222 | 223 | **Attention!** - There should only be three possible states for a test: **pass** to indicate it's consistently passing, **flaky** to indicate that the test passes some of the time but not others, and **fail** to indicate that the test is consistently failing to pass. This is to allow the reports to be searched via `grep` which makes things easier for the lead developers. Please use these states, then expand on them in notes to allow them to be searched. 224 | 225 | ``` 226 | * CtsAutoFillServiceTestCases - 4 failures 227 | - failure: android.autofillservice.cts.WebViewActivityTest#testAutofillAndSave 228 | - failure: android.autofillservice.cts.WebViewActivityTest#testAutofillOneDataset 229 | - failure: android.autofillservice.cts.WebViewActivityTest#testAutofillAndSave_withExternalViews_loadWebViewFirst 230 | - failure: android.autofillservice.cts.WebViewActivityTest#testAutofillNoDatasets 231 | ``` 232 | 233 | Note that there are two families of ARM devices: ARMv7 and ARM64. The test cases for these two families are the same, however, tests only tests for your device's architecture will be run. The other will be ignored and not be run by the CTS. 234 | 235 | ### So in a nutshell... 236 | Run the `cts` plan at least five times on your device to ensure as much gets run as possible. Take note of which parts pass and which parts fail. Any modules that fail, re-run them individually and see what information the test gives you. Record that information down in the form. Individual test modules that fail or appear to be flaky should be run multiple times (preferably ten) to see if multiple parts of them fail or different diagnostic information in them gets printed. Record that information down. 237 | 238 | Please stick to the standard. Use multiple spaces for indentation (the GrapheneOS standard is to use four spaces and to avoid using tabs) so your reports end up like the example at https://gist.github.com/thestinger/17fe9aeb371a4ceae2aaac2a603f2798 239 | 240 | ### Hints and tricks 241 | In the future date, if you want to obtain the list of the modules, at the `cts-tf >` prompt, type `list modules` and notice that the modules are listed for both ARM64 and ARMv7. If you want to get only ARM64 modules, you can copy the list into a text file and run `sed -n 'n;p' [file]` or if you'd like ARMv7, you can run `sed -n 'p;n' [file]` to print only the lines with the respective architectures. If you'd like to get rid of the architecture and just list the cts test modules, simply do `awk ' { print $2 } ' [file]` to print only the second column. 242 | 243 | Or if you just want that list, try doing `awk { print "* " $2 " - " } ' [file] | sed -n 'n;p'` to simply get the master bulleted list with trailing dashes and spaces. 244 | 245 | ### Sending in your reports 246 | If you have reports done, discuss with us on the IRC channel. We'll be glad to take them. 247 | 248 | -------------------------------------------------------------------------------- /GrapheneOS-Building-Q&A.md: -------------------------------------------------------------------------------- 1 | # GrapheneOS Building Q&A 2 | This is a little bit about building GrapheneOS. 3 | 4 | ## How long does it take to build GrapheneOS from source? 5 | On a Ryzen 2600 with 32 GB of RAM, it takes roughly 3 hours to build Vanadium, and 2-1/2 hours to build the operating system for the Google Pixel, including the time it takes to build the kernel. 6 | 7 | This does not take into account the time it takes to download the repositories, sync, and download the source code. A good internet connection is recommended. The first time the source trees are downloaded may take close to 100GB, so don't forget to take this into account on your connection. 8 | 9 | ## I want to become a GrapheneOS developer. What should be on my shopping list of things to buy? How much money will I need to spend? 10 | See "Your GrapheneOS Shopping List" in this directory for more details on what you will need or things that may come in handy. Requirements for building GrapheneOS are fairly modest and an acceptable building workstation can be put together for less than the cost of the phones it will be building for. Of course, more powerful computers will result in faster build times and less having to wait and watch stdout scroll past. 11 | 12 | ## Are GrapheneOS builds reproducible? 13 | GrapheneOS is reproducible, and uses multiple levels of digital signing and validation to assure authenticity and integrity. By design, digital signatures cannot be reproduced without the same private keys used to produce them, which necessitates manual comparison of everything except for the signatures. See https://grapheneos.org/build#reproducible-builds for more details. 14 | 15 | ## Are there any recommendations for incorporating Wireguard into the kernel? 16 | Yes. The recommendation is: **don't**. At the present time there's no userspace support for the kernel module to integrate. Apps cannot use the kernel module, since using it requires privileges that only netd has as a part of the AOSP security model. 17 | -------------------------------------------------------------------------------- /GrapheneOS-General-Q&A.md: -------------------------------------------------------------------------------- 1 | # Informal Q&A On GrapheneOS In General 2 | It's just a draft and is some pretty off the top stuff that I've just been putting together off the top of my head mostly, so bear with me for now. 3 | 4 | ## "Will you support my device?" 5 | 6 | Support for other devices is planned, but there are a few requirements for full support from Graphene OS. Rather than aim to try to support many devices, GrapheneOS seeks to support only the devices with the best security, and focus on specific devices to ensure that the most attention can be paid to the quality of the code, review, and testing. A more detailed answer is in the documentation at the entry under device support here: https://GrapheneOS.org/#device-support 7 | 8 | ## "Is it ready to be used as a daily driver?" 9 | Unconditionally yes. 10 | 11 | ## "Why can't GrapheneOS keep supporting devices after they've been EOL'd by Google?" 12 | 13 | Phones are powered by a system-on-chip, which includes all of its devices, such as the graphics processing unit, the cellphone's radio, and wifi and bluetooth chips, and other devices all integrated into a single chip. When Qualcomm releases a system-on-chip, they only agree to support it for a certain amount of time. Support for the system-on-chip includes things such as being delivered firmware updates for the cellphone's radios and graphics processing unit. The firmware is signed and validated with keys that only Qualcomm has, making Qualcomm the only entity that can update the firmware on the chip. Generally, Google negotiates with Qualcomm for a full three years of support, which dictates the lifetime of their phones. 14 | 15 | Security researchers, script kiddies, advanced cybercriminals, and even intelligence agencies constantly discover new exploits on devices, some of which may include devices such as cellphone radios, WiFi antennas, and other components of a mobile phone, and vendor support in the form of firmware updates is required to allow the devices to keep pace with these exploits as they are discovered. Since only Qualcomm is capable of updating the firmware, this essentially means that once Qualcomm's support comes to an end, the security of these devices will no longer be keeping pace with the attacks on them. Even if software mitigations can continue to be backported to the existing kernels that run on the phones, this doesn't fix the problem of the devices themselves becoming vulnerable. 16 | 17 | GrapheneOS supports devices that have strong modem isolation and support SMMU to limit memory access from the peripherals, but even though the peripherals are isolated from the host via IOMMU (the IOMMU virtualizes host memory access, so the host kernel is in full control over what the peripherals attached by DMA may read or write to), if the modem itself is still insecure, the potential exists for a compromised peripheral to deny service and thus compromise its availability or otherwise place itself in an advantageous position on the network even before the data has left the phone. *Merely making the modem external does not address these problems*. As a result, it doesn't make sense to continue backporting security patches from upstream to devices that are no longer supported. Doing so will also limit the amount of developer time that the project has to spend on other devices and advances in other areas. 18 | 19 | The GrapheneOS project was founded to maximize the security that could be achieved via the Android Open Source Project. If the device cannot be used securely, it should no longer be used. 20 | 21 | ## "Why does this project only support Pixels? I want to get away from Google, I don't want to have to buy Google to get away from Google!" 22 | 23 | The irony of having to buy Google handsets to get away from Google is not lost on any of us. Unfortunately, not all Android handsets are created equal. "Android" is a series of compatibility specifications that OEMs need to meet in order to use the name and get the rights to be a part of the ecosystem, and how they meet it is largely left up to the vendors themselves. This leads us to consider the following: 24 | 25 | * Google has been diligent with firmware security features, such as modem and radio isolation, and verified boot. Firmware sources are available (but non-free) for inspection. Additionally, the late-stage qualcomm bootloader which serves as the root of trust for the operating system is open-source. Many other vendors don't bother with any of this. 26 | * The driver source code for the Pixel devices is open source. As drivers form a part of the trusted code base and are a security-critical software item, this makes them a no-brainer. 27 | * Google makes extensive use of open standards and publishes tools and source code, documentation, as well as their toolchains and build system. Google has also gone the extra step of allowing customized Android Verified Boot Keying, which allows for us to utilize full hardware security features with an operating system (or system image) that is not our own. Many vendors don't do this and some even try to fight against it by designing their phones to use proprietary tools they do not publish to the public or don't release source code or support for. For example, Samsung and Sony are actively hostile to running other operating systems on their phones and incorporate E-Fuses into their handsets that will disable features on the handset permanently for the rest of time at the hardware level if the phone's bootloader is ever unlocked, some of which may even be vital security features. 28 | * Google negotiates for three years of vendor support for the system-on-chip that powers the phone, and have a track record of being diligent with both firmware updates and driver updates. Some vendors don't negotiate for more than two, and some never supply firmware nor driver updates and don't even commit to supporting their handsets after the phone has shipped and they've walked away with your money. This is recklessly irresponsible, and GrapheneOS should be focusing on improving the security of the best devices, not picking up after other vendors' lack of care. 29 | * Google Pixel Handsets starting with the Pixel 2 have Anti-Rollback mitigation and Insider Access Protection. The onboard HSM will not allow the firmware of the device to be downgraded to a legitimate previous version, which prevents the device being "restored" to an earlier and vulnerable version of the software or firmware. It also prevents the firmware from being upgraded in the absence of the user's password or pincode. This is designed to deter insider access attacks where an adversary may confiscate your phone, then in the absence of the password, use either legal or extralegal pressure to force the vendor to issue a malicious "update" to the device with validly signed but backdoored firmware. No other vendors offer this at this time. 30 | 31 | GrapheneOS is released as source code and as a result it can be ported to other devices. However, it's up to the community to either maintain these devices, or find and pay other people to. The lead developer, Daniel Micay, would like to work more on deeper and more systematic improvements to GrapheneOS such as kernel-level exploit mitigations, low level code quality improvement, and safer handling of memory, which sets GrapheneOS apart from the other mobile operating systems. In the future, the project would like to take on deeper and more tasks, such as firmware security and even hardware. But there are a limited number of hours in the day, an even more limited number of hours he can spend on this, and maintaining more devices takes away from that. 32 | 33 | Maintaining one device tends to involve a large amount of work, since each device uses its own kernel, its own drivers, its own firmware and many other software and firmware components that are specific to *that one particular device*. This all translates into a lot of work and it is **not** fair to assume only one person who is doing it *on his own dime* will be able to do everything to please the community, and give it away for free. 34 | 35 | In an ideal, perfect world, Daniel Micay would have only one "Reference Implementation" of the operating system that he would maintain on his own, then the rest of the community would either contribute their time and effort to maintain other devices that would adhere to the same standards, or, if the community lacks in-house talent to do so, be able to hire and pay developers to maintain the devices they desire. 36 | 37 | Device support for other devices won't happen if this doesn't, so, the old cliche applies: **pull requests welcome.** 38 | 39 | 40 | ## "I want the project to further decentralize! Github is owned by Microsoft/The Men In Black/Aliens/T.H.E.M/Some Nebulous Government Conspiracy!" 41 | 42 | GrapheneOS is developed using Git to control versioning. Git is a program that is installed to the hard drive of your computer as opposed to being operated as software-as-a-service, and can be made to operate or interoperate over ssh with a server of your choice, or even made to work over and send patches via E-mail. The actual source repositories of the operating system are stored on, inspected on, and worked on, on the hard drives of computers belonging to the developers. Source inspection from the lead developer, compilation and building takes place offline. This is about as decentralized as you can get. 43 | 44 | Github is used as a friendly landing and social networking site by the project and isn't a trusted third party. It provides some nice features such as a WebUI which acts as a frontend to functions Git already has and helps to lower the barriers to entry for people new to the process, gives us cute avatars, social media profiles, and provides an easy issue tracker and bug reporting system and allows for new developers to quickly download and clone a copy of the code. All of these are features that are nice for the project, but it isn't used as an integral or trusted part of the development process. 45 | 46 | 47 | 48 | -------------------------------------------------------------------------------- /GrapheneOS-Security-Q&A.md: -------------------------------------------------------------------------------- 1 | # Informal Q&A on GrapheneOS Security 2 | This guide is intended to be for users that would like to know a bit more about GrapheneOS, and the security enhancements it makes. 3 | 4 | It's just a draft and is some pretty off the top stuff that I've just been putting together off the top of my head mostly, so bear with me for now. 5 | 6 | ## "I've got a great idea for a security measure in GrapheneOS! Why isn't it implemented?" 7 | At this present point in time, GrapheneOS has a number of specific goals for any security measures that it implements: 8 | * To make full use of all hardware security features available for a device, which includes things like Android Verified Boot, hardware-bound encryption, hardware-backed keystore, In/Out Memory Management for modem and radio isolation. 9 | * To build improved memory safety measures and exploit mitigations into the operating system itself. 10 | * Any security measures beyond this that the project takes need to have a clear threat model decided. This means that they must have a practical application and there must be a clear and defined threat vector that is applicable and addressable using a technological solution, and be of a high enough priority to merit assigning limited developer time. See for example "Plausible Deniability." 11 | 12 | 13 | ## "How can I tune GrapheneOS for maximum hardening and privacy and security? Where are the enhanced security and privacy controls?" 14 | 15 | You don't. 16 | 17 | Security measures that GrapheneOS adopts must not simply place the burden onto the user, nor should they be dependent on user judgement. One of the longest standing design goals for the project is that security in GrapheneOS should function transparently to the user and function in such a way that it is unobtrusive, unnoticeable, and automatic. 18 | 19 | As a result the design choices, default connections, and many other settings on GrapheneOS have been very carefully and conservatively set, and security measures should be as transparent to the user as possible, or where user-facing settings are inevitable incorporated into existing user interfaces to make the experience as seamless and intuitive as possible. Buttons, control panels, tunables, knobs and settings are undesirable, as the settings in GrapheneOS should be enforced to safe values and not allowed to to rolled back or downgraded. 20 | 21 | As a result, GrapheneOS lacks a "Security Center" or "Advanced Privacy Controls" menu. This is intentional. GrapheneOS won't bug you about what security measures it's doing nor ask you for your input. Everything in GrapheneOS is already set for maximum privacy and security. Anything else would just be theatrics. 22 | 23 | 24 | ## "What does/will GrapheneOS do about persistent hardware identifiers like your IMEI or phone Serial number?" 25 | Starting with the Android 10 specification, apps can no longer extract the phone's IMEI or Serial Number, SIM Card Serial Number, Subscriber ID, MAC Address or other non-resettable unique device identifiers, even if granted access to `READ_PHONE_STATE`. Apps must have the `READ_PRIVILEGED_PHONE_STATE` (new to Android 10) in order to get access to any of these non-resettable, persistent device identifiers. Apps using the Android 10 API will recieve a `SecurityException` error, and any older apps simply get an empty value if the `READ_PHONE_STATE` permission has been granted to them, or a `SecurityException` error if they don't. MAC Addresses are randomized per WiFi network on GrapheneOS. Apps, even if granted full network access, cannot read nor change the MAC Address. 26 | 27 | GrapheneOS does not utilize Advertising IDs, even though this is resettable. 28 | 29 | `ANDROID_ID` is persistent between application installs but is resettable and under your control. GrapheneOS may be able to improve on this, so if you have the necessary skills to make the improvement, please send it in via pull request on our Github. 30 | 31 | 32 | ## "Why is Vanadium based on Chromium? Isn't Firefox better for privacy?" 33 | 34 | Vanadium builds upon and improves the security and privacy of Chromium rather than try to build on Firefox for a number of reasons: 35 | 36 | Firefox has an "all your eggs in one basket" approach, running as a single process. Outside of its reliance on the Android Sandbox, Firefox on Android makes no attempt to isolate and contain the different websites it handles from each other and adding this after the fact would be much more difficult without completely redesigning Firefox from the ground up. Chromium instead uses a much safer approach where the different websites are kept sandboxed not only from the operating system, but also from each other. Firefox comes with its own web engine, which on GrapheneOS would be redundant and also adds a considerable amount of attack surface that isn't needed. 37 | 38 | Vanadium takes several of its own measures to improve the privacy of Chromium: it does not include telemetry and does not phone home, disables privacy invasive antifeatures such as media routing, site prefetching, Google's safebrowsing, disallows sensor access to prevent device sidechannel fingerprinting via sensor calibration, and even goes the extra mile to prevent websites from reading battery state and using that to fingerprint your device by always reporting battery at 100% and plugged in. All of these features have specific threat models and purposes to reduce the uniqueness of the browser, and aren't simply included to win "feature points". 39 | 40 | 41 | ## "Does GrapheneOS phone home at all? Is there any analytics or telemetry?" 42 | 43 | No. 44 | 45 | From the Usage guide on GrapheneOS: 46 | > "GrapheneOS makes connections to the outside world to test connectivity, detect captive portals and download updates. No data varying per user / installation is sent in these connections. There aren't analytics / telemetry in GrapheneOS." 47 | 48 | (Usage | GrapheneOS, https://grapheneos.org/usage#default-connections, retrieved 29th January 2020) 49 | 50 | GrapheneOS does make some standard connections that regular Android does to retrieve status codes. This is done to detect things like captive web portals and connectivity. Retrieval of status codes do not send Google any identifiable information and is done intentionally for the sole purpose of camouflauging devices running GrapheneOS as regular Android handsets. This helps to combat network-level device fingerprinting. Changing the URLs or switching it off entirely will almost certainly give your device a much more unique presence on the network since it will stand out as not retrieving status codes and make your particular device easier to identify, isolate, and track your device via the network. 51 | 52 | 53 | ## "If I deny an app the 'Sensors' permission what happens? This permission toggle isn't available on regular Android." 54 | 55 | If you deny an application permission to read your phone's sensors, GrapheneOS will zero out sensor input to it and the app will get the impression the phone is lying perfectly flat and perfectly still. 56 | 57 | While your phone's sensors can be used to gather a great many things on your state or activity, some apps actually have a legitimate need to have access to them. Super Tux Kart, for example, uses your phone's tilt sensors to allow you to utilize your phone as your go-kart's steering wheel. Some navigation applications and fitness tracking applications such as pedometers which measure your physical activity use your phone's motion sensors and accelerometers to determine how fast you are going, won't be able to do their job if this permission has been switched off. 58 | 59 | 60 | ## "Does Graphene allow me to nuke my data if say, the phone gets ten incorrect guesses at the pincode?" 61 | 62 | Device Wipe on authentication failure is redundant, unnecessary, and dangerous. GrapheneOS does not need to use it to keep the data safe, and has a very different way of handling brute force attempts at the password than simply deleting the keys. 63 | 64 | Modern Pixel handsets use the Titan M security chip for pin authentication and password authentication. The Titan M contains its own internal clock that the operating system has no influence over and as a result cannot spoof. The Titan chip itself is small (almost the size of a grain of rice) and by nature of its design is extremely difficult to attack. Since the Titan M also is integrated into the disk encryption process, it also stores the tokens used to derive the keys to the files on the SSD and won't release the tokens to the operating system unless it gets the correct passphrase or pin, meaning that any attempts to access the files on the phone's drive need to be made through that specific Titan chip, on that specific phone. This is to prevent offline cracking attempts where the phone is physically cut open, the SSD is removed from the PCB, mirrored via NAND cloning, and the encrypted data on it subjected to guessing attacks run on a much more powerful system that can run more guesses than the phone would otherwise allows. 65 | 66 | During a brute force attack when many attempts may be entered into the phone in an attempt to find the right one, the Titan M will enforce a progressively lengthening time. After the first five attempts, the Titan will shut off access to the tokens for 30 seconds and switch off the fingerprint reader. Even if the operating system is exploited and the clock is bypassed, the Titan M answers only to its own timer housed within the chip and can ignore further attempts to guess the pincode or password. Continuing to attempt to make attempts on the pincode without waiting will result in the Titan punishing the attempt by progressively increasing the timeout for longer and longer periods of time, up to a maximum of only allowing one guess every day. At the time of one day per guess which is reached after 150 incorrect attempts (which would take approximately 2 weeks of timeout to reach), this extends the time it would take to exhaust a 4-number pincode to around six and a half centuries, and extends a two-word passphrase from a 2048-word wordlist into computational infeasibility. 67 | 68 | Because of the safety implications this has of data loss, and the strength of the Titan M being able to enforce this timeout, Data Wipe on Authentication failure is obsolete. This won't protect you if your password is "password" or "1234" or something easily guessable like the year of your high school graduation or your birthday. However, it will bolster the strength of a short, but hard-to-guess pincode or passord to keep your data safe, without needing to keep it in a perpetually precarious situation where it's liable to be accidentally destroyed. 69 | 70 | GrapheneOS also allows you to set passphrases of up to 64 characters. A four-word passphrase generated from entries selected at random from the Pocket Oxford Dictionary is both easily memorable, can be easily typed in, and would require 1.71e16 or approximately seventeen quadrillion years to brute force. 71 | 72 | 73 | ## "Does GrapheneOS offer protection against Stingrays?" 74 | 75 | GrapheneOS always considers the network to be hostile. 76 | 77 | Telephones were invented over a hundred years ago and SMS dates back to the 1980's. It's now 2020 and you should utilize an encrypted instant messaging application like Signal Private Messenger. When you use Signal, an adversary monitoring the network would only be able to see your phone connecting, via TLS to an Amazon AWS instance. Signal chose to utilize AWS because Amazon AWS already hosts more than half of all smartphone backends, making it difficult to block without breaking most of the Internet and difficult to tell apart from other traffic. Signal uses the Intel SGX for contact discovery and routing and sealed sender to mitigate metadata leakage, which helps to combat social graphing, and is relatively easy for non-technical users to install and use without changing any of their use habits. 78 | 79 | Signal is fully tested and fully working on GrapheneOS and a signed apk installer package is available from their website directly, or you can clone the repository and build it yourself. 80 | 81 | If you were to use an encrypted SMS application like Silence, the network operator (or the Stingray operator impersonating them to you) would not only be able to see your number and the phone number of who you are messaging and what time you contacted them, but also see you're using encryption with that other number. Since adoption of encrypted SMS tools is very low and SMS is a security-agnostic protocol that trusts the service provider and all the network inbetween with everything in plaintext, this would make not only you, but also your contact stand out from the crowd. 82 | 83 | 84 | ## "Does GrapheneOS offer protection against evil backdoor basebands?" 85 | 86 | GrapheneOS only elects to support devices that offer the best modem and radio isolation via IOMMU mitigations and policies. IOMMU only allows a device attached to the host memory by direct memory access to read or write to memory values that the driver in the kernel specifically allows it to, and only elects to support devices that have open source drivers which are readily supported by their vendors and updated frequently. 87 | 88 | The firmware for the radios and modems is not state-carrying. GrapheneOS will load the firmware binaries when the operating system boots. Prior to this, the system image (which contains the firmware binaries) will be verified via Android Verified Boot which is keyed to Daniel Micay's signing keys. Should any of the firmware be exploited, it is already limited from the host memory via IOMMU, and rebooting it will restore it to a known good state. 89 | 90 | 91 | ## "Does GrapheneOS offer Disk Encryption? With what cipher?" 92 | 93 | Yes, of course! All modern phones **should** offer strong file based, hardware-bound encryption, rather than full disk software-only encryption. The reason for this is simple: phones aren't laptops. They're left on around the clock more often than not, during which, the hard drive will need to be unlocked in order for the phone to function. Park this in your mind, since there's more on that in the question immediately after the one following this one. 94 | 95 | GrapheneOS makes full use of the hardware-bound encryption in modern Android devices. The Titan M handles the user's pincode or password. Upon getting the correct password, the Titan M will calculate, then release an access token to the phone that the phone in turn can use to derive the keys via a key derivation function which also uses a mathematical proof of uniqueness called a "cryptographic hash" of the first 2,000 bytes of a special partition set aside on the phone's SSD as a safeguard to mitigate data remnance issues. Each file is encrypted with AES-256-XTS, and the filesystem metadata is encrypted with AES-256-HEH on modern handsets (older handsets use AES-256-CTS for the filenames, but these are on the way out). 96 | 97 | 98 | ## "I'm giving my phone to someone else, selling it to a stranger secondhand, or giving it to a recycler for disposal, and I want all the data on it gone. What guarantees do I have of this?" 99 | 100 | When you hit factory reset on your cellphone, the Titan will destroy its access tokens and the phone will change the header partition. Without either the access tokens or if even one bit is changed of the header partition, the key derivation function will produce an incorrect result, and the data on the drive will be lost forever. The key derivation function by virtue of its design cannot be reversed. The data on it will be gone. Forever. No ifs, ands, or buts. 101 | 102 | There is no recovery from this state, so if there's anything on your phone that you really don't want to lose, make sure you have it backed up separately beforehand. This includes changing your 2FA tokens, password manager, exported any bookmarks you don't want to lose, saved any pictures, videos, or movies, anything stored on your phone. 103 | 104 | 105 | ## "Why doesn't Graphene offer Full Disk Encryption? Why File Based Encryption? Why not Both?" 106 | 107 | File Based Encryption has several advantages over Full Disk Encryption: 108 | * It allows work profiles to be made more secure, because when one user is logged out, the keys can be ejected from memory. This isn't doable with full disk encryption because full disk encryption is all-or-nothing. 109 | * When files are not in use, such as if the screen is locked, their keys can be ejected from memory. 110 | * With the use of the Strongbox Key Master on modern Android Handsets (Pixel 3 and later), pictures can be taken and written to the drive encrypted while the screen is still locked, without having to unlock the drive so that files can be written to it. 111 | * The phone can handle updates even while locked and more importantly, the data is at rest. 112 | * It allows some features most people have come to expect out of cellphones, such as direct boot. 113 | 114 | The filesystem metadata on modern GrapheneOS handsets is itself padded to disguise filename lengths, then is encrypted with AES-256-HEH, so adding another layer of encryption on top would be redundant, and unnecessary. It would also break other security features such as direct boot and background updates, making updating and patching more difficult. Since phones spend a majority of their time powered on, the gains of layering one within the other would likely never be realized. It would add more complexity to the entire stack and increase the amount of attack surface and amount of code that would need to be maintained and the amount of places that bugs could hide for very little gain. In short, the tradeoffs of simply "add both" would not be worth the benefits, would break certain features that are more important than file metadata which itself is already encrypted, and would represent a number of steps backward. 115 | 116 | 117 | ## "Can I have a different passphrase to boot the phone and a different passphrase to unlock the disk?" 118 | 119 | Encryption in GrapheneOS uses per-profile keys, where each profile gets a different key to the files on the disk. Some applications additionally support the use of the Strongbox Keymaster API on Android which allows their keys to be ejected from memory whenever the phone's screen is locked, which makes this redundant. 120 | 121 | In the eras past the disk encryption password could be made different from the lock screen password, but this was because back in those eras, Android used a very different way of handling filesystem encryption, and used full disk encryption. Full disk encryption has numerous weaknesses, which include not being able to granularize access and get data at rest (where the encryption could actually provide a useful security measure) when it isn't being in use. 122 | 123 | You can still choose to use a strong passphrase to lock your phone, and then use a fingerprint to unlock it. 124 | 125 | 126 | ## "I don't feel comfortable adding just a fingerprint unlock to my phone, but entering my EFF Diceware Passphrase every time is too cumbersome. Could I have a way to have a pincode with my fingerprint?" 127 | 128 | This feature has been requested for years. Pull Requests are welcome. If you can't code, pay someone else who can; an open source project requires collaboration and contributors. 129 | 130 | 131 | ## "I want to root my GrapheneOS!" 132 | 133 | Don't. 134 | 135 | GrapheneOS is designed to minimize privilege, minimize attack surface, and minimize access. App-accessible root destroys the security model of Android, increases the attack surface, and is mutually exclusive with important security measures such as verified boot. If you have app accessible root on, by design Android Verified Boot would detect any persistent changes you make to the system partition, and simply undo them to revert your system partition to a state where it will pass signature validation. So either this would mean you would need to go without verified boot, or any changes you made as root would end up being reverted the moment you rebooted. 136 | 137 | GrapheneOS is not only utilizes reproducible builds but each GrapheneOS installation on any given device is also bitwise identical, is cryptographically validated by Android Verified Boot, and its authenticity can be proven remotely via Android Remote Attestation to show that the operating system installed is the same operating system that the developers wrote, and Daniel Micay personally inspected, compiled and digitally signed on a system he physically possesses, bought and paid for. 138 | 139 | You're welcome to fork, build and compile and self-sign builds of your own that allow for app-accessible root, but at this point, you're not really running GrapheneOS, and are recieving far fewer of the benefits you would by doing so normally. 140 | 141 | 142 | ## "i2p Bote, Plumble, and some old F-Droid apps that haven't been updated in years suddenly crash as soon as they connect to the network. This behaviour is not observed on the Google Android. Why?" 143 | 144 | These crashes are likely caused by the app being unsafe. A number of the security improvements in GrapheneOS are designed to catch unsafe memory corruption bugs. Although GrapheneOS is designed to try to handle security exceptions gracefully, apps that misbehave and could produce vulnerabilities or exploits are forcefully terminated by the operating system before they could present attack surface or attempt to exploit the operating system. 145 | 146 | More information on how to deal with this is here: https://grapheneos.org/usage#bugs-uncovered-by-security-features 147 | 148 | 149 | ## "I want to trace GrapheneOS source code to the actual builds. How can I do this?" 150 | 151 | GrapheneOS is reproducible. More information on reproducing builds by setting the time and build versions to be the same as release versions is contained here: https://grapheneos.org/build#reproducible-builds 152 | 153 | As you would require the private keys to reproduce the digital signatures on all signed parts of the operating system, you would need to inspect the compiled images yourself prior to putting together the factory image. Android Open Source Project contains tooling to inspect these builds. 154 | 155 | More information on manual inspection will follow at a later date. 156 | 157 | 158 | ## "I'd like GrapheneOS to have a plausible deniability feature, so when I travel across the border I can give away a decoy password!" 159 | 160 | The threat model of GrapheneOS is to protect you from memory corruption vulnerabilities and software exploits, and contain apps you've installed on your device and prevent them from exploiting your operating system. An adversary that has full legal authority to put you into a jail cell filled with rats and not let you out until starve to death or give them the information they want is outside of the threat model of the operating system. 161 | 162 | It isn't practical for GrapheneOS to attempt to do plausible deniability or hidden operating systems for cross-border searchers, as with some rudimentary data forensics it is almost trivially easy to determine if the ciphertext contains a hidden volume encrypted to a different key (see the Veracrypt documentation on hidden operating systems), and maintaining a convincing hidden partition or hidden operating system requires that a user be able to maintain and use it convinicingly enough to stand up to scrutiny. On top of that, if the border services agency is really out to get you, do you actually want to lie to them, and then have them catch you red-handed if they decide to take a closer look at any of your devices and see a discrepancy because the usage patterns in the decoy don't match up with their expectations? If this is truly in your threat model, what are you looking to fool? Only a bored border officer who's going to spend five seconds to go "looks legit" and what happens if they turn over the siezed phone to someone who's going to probe it more thoroughly while you're detained? What happens when this kind of security measure becomes known (and it will become known, since GrapheneOS is extensively documented and sources are publicly available), and it becomes expected that users of these devices will be using this feature? 163 | 164 | A far easier way that requries no long term commitment to lay a convincing decoy trail to protect against this vector, and then hoping your adversary falls for it is to create and store an encrypted backup somewhere accessible to you at a later date, factory reset your device before taking it through customs, and then download and restore your backup once you're through. 165 | 166 | 167 | ## "What security measures does GrapheneOS have against those cell phone unlockers used by the military like Cellebrite, Graykey, etc? What about nation states with unlimited resources?" 168 | 169 | Before we get into this subject, understand that if an adversary has physical control of the hardware and unlimited resources, it's not a matter of whether it will or won't be possible for them to decrypt the cellphone, just a matter of how much time, effort, and money they are able to spend and how many people they are willing to intimidate, kidnap, torture, or murder in order to get what they want. 170 | 171 | Many cellphone extraction systems such as GrayKey and Cellebrite mostly involve extracting the contents of the SSD of an unlocked phone. This alone isn't very interesting and it doesn't mean much if a device is listed as being supported. Cellphone unlocking systems that offer lock bypasses usually involve an exploit on the enclave itself to bypass rate limiting to allow more guesses at the password than the phones are otherwise supposed to allow in that span of time enough to make a brute-force attack on the six-digit pincode feasible, since many users only use a four or a six-digit pincode. 172 | 173 | GrapheneOS allows for passwords of 64 characters, and prefers handsets such as the Pixel 3, which use a separate coprocessor to calculate and release the access tokens to the phone for key derivation. Such implementations offer substantially reduced attack surface reduction and at the present date, no exploits have been publicly documented for them. However, if you consider these exploits to be in your threat model and assume that at a future date one could be discovered, or the HSM in your phone could be delidded and disassembled via the use of lasers and precision robotics, cloned, and then brute force attacks run in parallel (All in all, an extremely targeted attack that could easily end up costing tens of millions of dollars and only work for that particular phone at this point in time), there is an easy defence: utilize the extra security of a long and cryptographically strong passphrase to thwart brute force guessing. 174 | 175 | 176 | ## "Does GrapheneOS have any means to prevent apps installed on the phone from sharing information with each other?" 177 | 178 | There are multiple levels of isolation. First, each app installed within a given user profile is given its own, individual sandbox which it is confined to. Secondly, each user profile is isolated from the others and isolated by the Linux Kernel. This arrangement ensures that even with multiple user profiles on the phone, apps can't use each other as sidechannels or reach from one user profile to the next. To do so would require breaking the Linux Kernel. 179 | 180 | It is possible to get two different apps to interoperate, as is the case with K-9 Mail and OpenKeyChain to allow functionality such as easy sending and recieving of encrypted E-mails. Apps installed into the same profile must both be given permission to interoperate. If this functionality is seen as being undesirable, the apps can be installed into different user profiles, which will make it impossible for them to leak information to each other, or peek into other apps' sandboxes. 181 | 182 | A future goal for GrapheneOS is to expose more of the underlying functionality or improve the user experience around the Android sandboxing system, which could be undertaken when the project has more volunteers. 183 | 184 | -------------------------------------------------------------------------------- /GrapheneOS-Shopping-List.md: -------------------------------------------------------------------------------- 1 | # Your GrapheneOS Shopping List 2 | ## Software 3 | ### Operating System 4 | Building has been done successfully on the following operating systems: 5 | * Debian Buster 10 6 | * Ubuntu LTS 18.04 7 | * Arch Linux 8 | * Fedora 30 9 | * Gentoo (Experimental only, requires modifications) 10 | 11 | Building on Macintosh and Windows is not supported. 12 | 13 | ### Operating System Packages 14 | You should consider installing these packages from your operating system's repositories. Install them first. 15 | * `git` 16 | * Python interpreters. At this moment, Google requires both python 3 and python 2.7, which is named differently on different distros. On Arch, a symlink must be made to link python to python2.7. 17 | * `ninja-build` 18 | * A Java development kit (on Debian, this is `default-jdk`) 19 | 20 | Android uses its own in-tree toolchain that forbids clang, clang++, gcc, and g++. The details can be checked out here: 21 | https://android.googlesource.com/platform/build/soong/+refs/tags/android-10.0.0_r11/ui/build/paths/config.go#76 22 | 23 | #### For building Auditor 24 | If you are building Auditor, you will need (in addition to the above) 25 | * `gradle` 26 | * `maven` 27 | * `ant` 28 | 29 | ### Android Applications 30 | #### Android Studio 31 | You can obtain the Android Studio directly from Google, which will include the Platform Tools for Android Debug Bridge and Fastboot. Since this version is frequently updated it cannot be hotlinked here. 32 | https://developer.android.com/studio/index.html#downloads 33 | 34 | Once you download, unzip, and install it, ensure that it is properly added to your `$PATH` variable. This includes the following locations from where the Android SDK was installed to the following locations. These are the defaults: 35 | * `$HOME/Android/Sdk/tools` 36 | * `$HOME/Android/Sdk/tools/bin` 37 | * `$HOME/Android/Sdk/build-tools/29.0.2` 38 | * `$HOME/Android/Sdk/platform-tools/` 39 | 40 | You can set the locations automatically on each new shell you open with: 41 | ``` 42 | echo "export PATH=$PATH:$HOME/Android/Sdk/tools:$HOME/Android/Sdk/tools/bin:$HOME/Android/Sdk/build-tools/29.0.2:$HOME/Android/Sdk/platform-tools/" >> .bashrc && export PATH=$PATH:$HOME/Android/Sdk/tools:$HOME/Android/Sdk/tools/bin:$HOME/Android/Sdk/build-tools/29.0.2:$HOME/Android/Sdk/platform-tools/ 43 | ``` 44 | 45 | #### Android Platform Tools 46 | **If you obtained Android Studio, you do not need Platform Tools, as it is already included.** 47 | The Android Platform tools include Android Debug Bridge and Fastboot. These utilities are required for installing GrapheneOS, and they are also required for doing development work. 48 | 49 | If you are running Windows or Macintosh, you can obtain the platform tools archive by visiting: 50 | https://developer.android.com/studio/releases/platform-tools 51 | 52 | **Linux users, beware!** 53 | 54 | **Many Linux Distributions package their own versions of Android Debug Bridge and Fastboot. Unless stated specifically here, it is never safe to use them with modern devices running Android. They will often be out of date and will be versioned incorrectly, which may result in them failing to negotiate with the device silently, and *bricking* your device.** 55 | 56 | Don't take the risk. On Linux, you can obtain the latest Platform Tools package, by running `wget https://dl.google.com/android/repository/platform-tools-latest-linux.zip && unzip platform-tools-latest-linux.zip` 57 | 58 | **"I use Arch, btw"** 59 | 60 | Arch uses up to date and correctly numbered versions of the Android Platform Tools and udev rules. If you use Arch, you can simply install the `android-tools` and `android-dev` AUR packages. 61 | 62 | #### Android udev Rules 63 | On Linux, you may find that Android Debug Bridge and Fastboot may be failing to detect your phone, even though it will show up in `lsusb` when plugged in. Some distributions do not adequately maintain their own udev rules for modern devices. You may obtain more up to date udev rules using the command sequence below: 64 | ``` 65 | $ wget https://raw.githubusercontent.com/M0Rf30/android-udev-rules/master/51-android.rules && sudo cp 51-android.rules /etc/udev/rules.d/51-android.rules && sudo udevadm control --reload-rules 66 | ``` 67 | 68 | If you intend to use your workstation remotely and do your work remotely via SSH, you will need to add yourself to the `adbusers` usergroup, with `export MY_USERNAME=$(whoami) && sudo usermod -G adbusers $MY_USERNAME` 69 | 70 | Log off and log back in to ensure the settings take effect. 71 | 72 | #### Android Compatibility Test Suite 73 | You should download the Compatibility Test Suite directly from Google and make sure it is the latest version. You can run the following commands to do it. 74 | 75 | ``` 76 | $ mkdir -p ~/GrapheneOS/CTS/ && cd ~/GrapheneOS/CTS 77 | $ wget https://dl.google.com/dl/android/cts/android-cts-10_r1-linux_x86-arm.zip && unzip android-cts-10_r1-linux_x86-arm.zip 78 | $ wget https://dl.google.com/dl/android/cts/android-cts-media-1.4.zip && unzip android-cts-media-1.4.zip 79 | ``` 80 | 81 | Scripts for copying the CTS test cases is included in the CTS media. Running these scripts requires that you have platform tools configured and working and the platform tools in your `$PATH` 82 | 83 | #### Chromium Depot Tools 84 | To configure and build GrapheneOS, you will need the Chromium Depot tools, and need to have the Chromium Depot tools in your `$PATH` variable in order to properly build. The easiest way to do this is to clone them from the Google. 85 | 86 | ``` 87 | $ mkdir -p ~/GrapheneOS/depot-tools/ && cd ~/GrapheneOS/depot-tools/ 88 | $ git clone https://chromium.googlesource.com/chromium/tools/depot_tools.git 89 | $ echo "export PATH=$PATH:$HOME/GrapheneOS/depot-tools" >> .bashrc && export PATH=$PATH:$HOME/GrapheneOS/depot-tools 90 | ``` 91 | 92 | ## Hardware you will need 93 | ### Your workstation 94 | When shopping around for a workstation, consider the following: 95 | * You will need an Intel or AMD x86_64(amd64) processor. The more cores, and the faster it is, the better. Building the operating system (without building Vanadium, which is required to build GrapheneOS) can take approximately two and a half hours on an AMD Ryzen 2600 6-core system when memory and disk usage is not a bottleneck. Builds may need to be done and tested frequently so consider that time is money and potential savings in time will offset the cost of a more expensive processor. 96 | * At least 16 GB of RAM. As with the CPU, bigger is better. 32 GB is recommended. 97 | * SSD with at least 300GB of free space. The more the better. Buying a 1TB SSD is recommended although it's possible to get away with using 500GB if you are careful, but this is inconvenient. Buy more than what you need. 98 | * Adequate cooling and ventilation, as your CPU will be running at 100% frequency for several hours during doing a full build. 99 | Graphics cards are not required, as the build process does not involve any input from the Graphics card. This allows debugging and testing builds to be outsourced to a headless build server, or even a cloud service, but this is not something I will get into in this page. 100 | 101 | ### The device being developed for 102 | #### Help! I can't spend $400 on a phone! 103 | If you can't afford a phone, that's not a dealbreaker. GrapheneOS can be compiled for and run in an emulator on most modern processors with virtualization extensions. 104 | 105 | #### If you can afford a phone... 106 | Although some applications can be run on the emulator, the devices require maintainers and often require significant amounts of per-device work to be done to take advantage of the security features, exploit mitigations, and hardening specific to each device, so access to the device you intend to develop for is not optional, it is a necessity. 107 | 108 | #### CTS testing rig 109 | When running the Compatibility Test Suite, you should prop the phone up between two objects both the front and rear cameras can focus on simultaneously, as both the front and rear cameras are tested during the camera test cases. A good method is to use a small piece of rubber tape to hold the phone on its side and tape it to something heavy like the bottom of a large saucer or a small pie dish turned upside-down to create a stand, or even making a stand out of something like Lego. 110 | 111 | In order for the photo test cases to work, both the front and rear cameras must be able to focus on their targets. A brightly-coloured target with a high amount of contrast is recommended, and it is important to make sure the surfaces of the targets are not reflective or shiny. 112 | 113 | ## Accessories that may come in handy 114 | 115 | ### A phone 116 | You will want to have a phone that is not your daily driver device for testing and debugging GrapheneOS. As this device may need to be unlocked, relocked, and reset often, it is strongly recommended not to use your daily driver for development. 117 | 118 | ### Second spare phone for running the factory OS 119 | If you are testing builds using the Compatibility Test Suite, it may help to benchmark a device running GrapheneOS against an identical device running the factory operating system. Having an extra phone may also help if you depend on your device as a daily driver. Expect to have to unlock your bootloader often, which makes using the same phone as the one you are working on for daily use problematic. 120 | 121 | For developers doing Auditor or application level development, having a spare phone (even if unsupported) that runs the factory operating system may help with debugging and testing of the app. 122 | 123 | ### Your connection 124 | Expect to download several hundred gigabytes of source and history the first sync and large amounts of bandwidth may be used to sync the source repositories. Plan accordingly when it comes to your Internet use plan. 125 | 126 | ### A debugging cable 127 | The Suzy-Qable that is sold as a "ChromeOS Debugging Cable" can obtain the citadel logs from the Pixel 2 and Pixel 3 series phones, but it does not have the chip which allow it to obtain the kernel uart debugging logs. Google does not sell these Kernel Debugging Cables to the public, leaving the only option to build one yourself out of a USB-C breakout board, a USB C cable, and a USB to Serial TTL Cable. A step by step tutorial including where to purchase the materials is available at https://github.com/Peter-Easton/android-debug-cable-howto I will improve this as time goes on. 128 | 129 | ### A cheap spare laptop 130 | Since running the compatibility test suite can require moving the phone to a well-lit area where it can take photographs from both its front and rear camera and run undisturbed for several hours at a time, it may help with getting a cheap old laptop for running the compatibility test cases. Since the phone does all the hard work, even an old Dual-Core laptop running Linux will do fine as long as it won't break down through the tests. 131 | 132 | ### Well lit area for running compatibility test suite. 133 | Running the compatibility test suite will require a well-lit area with something that both the front and rear cameras can focus on simultaneously which can remain brightly lit for long periods of time. The phone's cameras will need something to focus on, and bright, sharply-contrasting colours are preferred, so flags or brightly-coloured clothes work great for this. Running the test suite can take several hours at a time for only a few tests, and once started should not be interrupted. 134 | 135 | The phone must be propped up (Simply taping your phone to a clipboard works well for this) inbetween the targets, as both the front and rear cameras need to focus on something at the same time. 136 | -------------------------------------------------------------------------------- /GrapheneOS-Usage-Q&A.md: -------------------------------------------------------------------------------- 1 | # GrapheneOS Usage Q&A 2 | This has some general questions and answers to GrapheneOS. 3 | 4 | ## What app store do you recommend? 5 | A first-party app store may be in the works in the future, but for now, you will need to find your own. Some users have found luck with Aurora. 6 | 7 | At this moment, F-Droid is not recommended. This is due to F-Droid having accumulated large numbers of apps that are now unmaintained and target much older versions of the Android API all the way back to before Android 6, and not warning the user that the apps are written and compiled for older versions of Android. Obsolete apps that target older versions of the API will almost certainly not run correctly on modern versions of the factory versions of Android or on GrapheneOS. Since developers do not release directly via F-Droid, but rather, F-Droid functions as a trusted third party to deliver the updates and signed builds rather than updates being published directly by the developers, F-Droid has a much slower update cycle, often taking years to update their apps or simply not updating them at all and leaving a large collection of obsolete, old, or abandoned apps in the F-Droid repositories. 8 | 9 | ## What is the best and most secure instant messaging application you can get on GrapheneOS? 10 | Signal Private Messenger. Please either compile the app from source and self-sign your build, or obtain the signed apk available on Signal.org. Signal is working fine and is extensively tested on GrapheneOS. 11 | 12 | ## What's the best for taking pictures with GrapheneOS? 13 | GrapheneOS has its own Camera app which makes use of the latest CameraX libraries in Android. Despite being early release as of November 2021, its image quality is very nearly on par with Google's Camera app and it is very reliable, with support for integrated QR Code Scanning and both still images and video, as well as high definition. More details are included in the official usage guide. 14 | 15 | ## What prevents me from loading a counterfeit application? 16 | GrapheneOS observes the Android security model of application installation. When an app is first installed, its developer's certificate included in the apk installation bundle is pinned via a trust-on-first-use mechanism, and the app is validated to that particular certificate. Future updates installed to the phone must be signed with the same certificate for the rest of the app's life, and Android will not permit the certificates to be changed as long as the app is installed. Other developers cannot present updates for that given app without them being signed by the key to the certificate that was present at the time of installation. This decentralized signing model is an integral part of the overall Android security model by allowing the infrastructure to be distrusted and not tying the means to authenticate updates to a single set of keys given to a trusted third party, the way Debian's apt system functions. 17 | 18 | The question then becomes finding a genuine copy of the first app to install without a preauthenticated back-channel to the developers, which is why at this moment GrapheneOS is considered not production ready, as not everyone will have a preauthenticated back-channel to their app developers, and not everyone will know how to use it. 19 | 20 | ## Can I have MicroG with signature spoofing? 21 | No, MicroG is not supported. Signature spoofing is not supported either, due to the pandora's box of attack surface that it presents. You would have dramatically better privacy simply using factory Android with Google in it rather than employ signature spoofing. 22 | 23 | GrapheneOS implements compatibility shims which allow Play Services to be optionally installed on a phone running GrapheneOS post-install, run in a per-profile basis case-by-case, at the discretion and under the control of the user in a non-invasive and privacy preserving way that does not allow Play Services to act invasively. A better source for information is the official usage guide here: https://grapheneos.org/usage#sandboxed-play-services 24 | 25 | ## I'm getting some issues with alarms functioning. Alarms for reminders aren't going off, or apps aren't displaying notifications properly. 26 | This is generally encountered on apps from F-Droid and is a problem with the application itself and not GrapheneOS. This behaviour is symptomatic of the app itself been written and compiled for a much older version of the Android API and the functionality it depended on has been depreciated by upstream. This also happens on the factory versions of Android. 27 | 28 | Please contact the app developer and ask them to update the API, and if you obtained it from F-Droid, contact the F-Droid developers to update the software. Apps should be coded to use the `setExactAndAllowWhileIdle` functionality in the alarm documentation, at https: https://developer.android.com/reference/android/app/AlarmManager.html#set(int,%20long,%20android.app.PendingIntent) 29 | -------------------------------------------------------------------------------- /Miscellanea/GrapheneOS-in-Inkscape.svg: -------------------------------------------------------------------------------- 1 | 2 | 18 | 20 | 25 | 30 | 36 | 42 | 43 | 49 | 56 | 57 | 58 | 84 | 86 | 87 | 89 | image/svg+xml 90 | 92 | 93 | 94 | 95 | 96 | 100 | 107 | 111 | 121 | 125 | 132 | 139 | 140 | 141 | 151 | 152 | 157 | 167 | 171 | 178 | 185 | 186 | 187 | 197 | 198 | 203 | 213 | 217 | 224 | 231 | 232 | 233 | 243 | 244 | 249 | 259 | 263 | 270 | 277 | 278 | 279 | 289 | 290 | 295 | 305 | 309 | 316 | 323 | 324 | 325 | 335 | 336 | 341 | 351 | 355 | 362 | 369 | 370 | 371 | 381 | 382 | 383 | 384 | -------------------------------------------------------------------------------- /Miscellanea/README.md: -------------------------------------------------------------------------------- 1 | # GrapheneOS Miscellanea 2 | This is a collection of various miscellanea relating to GrapheneOS that doesn't really fit anywhere else at this moment. 3 | 4 | -------------------------------------------------------------------------------- /Old FAQ Draft/README.md: -------------------------------------------------------------------------------- 1 | # Old FAQ Draft 2 | This draft was submitted a while back but was slightly too heady to work on all at once. I'm leaving it here for now in its original html templated form, because there's still content in here we might use. These are where my old drafts are. 3 | 4 | Some of it needs to be updated and some of it may need to be worked on since it's somewhat old. 5 | -------------------------------------------------------------------------------- /Old FAQ Draft/faq-safe.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | FAQ | GrapheneOS 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 41 |
42 |

43 | Frequently Asked Questions 44 |

45 | 46 |

47 | Table of contents 48 |

49 | 97 | 98 |

99 | Day To Day Usage 100 |

101 | 102 |

103 | "Is it ready to be used as a daily driver OS?" 104 |

105 |

Resoundingly yes, Graphene OS is stable and feature-rich enough to be utilized as a daily 106 | driver operating system with only one consideration: an app store (F-Droid, Yalp, Google Play) 107 | is not included by default to allow the user the choice. An app store can be added by simply 108 | downloading, verifying and installing the required .apk. 109 |

110 | 111 |

112 | "Do I need to unlock the bootloader to update or flash again?" 113 |

114 |

No. Your phone will automatically download and install the updates when they are released, 115 | provided an internet connection is available. The update images are provided for those who 116 | need to download them off of the device for any reason.

117 | 118 |

Updates are digitally signed by Daniel Micay and verified by the device. Unlocking to update 119 | is not needed.

120 | 121 |

122 | "Can I set the update client to only download on WiFi?" 123 |

124 |

Yes, under Settings -> System -> Advanced -> System update Settings -> Permitted networks, 125 | set it for unmetered networks only to prevent the update client from using up your cellular data 126 | plan.

127 | 128 |

129 | What does the operating system come with?" 130 |

131 |

"Out of the box", the operating system comes with an app for SMS messages and a Phone app, a 132 | search app, Vanadium Browser, Auditor, Mail, Calendar, Photo Gallery, Calculator, Camera, and a 133 | File Browser. More apps can always be installed as desired.

134 | 135 |

136 | "What apps will GrapheneOS run?" 137 |

138 |

GrapheneOS will run most apps for Android. Most apps from F-Droid will run. GrapheneOS will 139 | run proprietary apps such as Spotify and some banking apps if they are loaded from .apk so long as 140 | they do not have a hard dependency on the absent Google Software Frameworks.

141 | 142 |

Apps that are written unsafely or attempt to violate the security policies that GrapheneOS has put 143 | in place will be halted immediately, and a notification that the application has stopped working 144 | displayed to the user.

145 | 146 |

147 | "Will Signal Private Messenger work?" 148 |

149 |

Yes, Signal Private Messenger works great on GrapheneOS.

150 | 151 |

152 | "Do you support long passphrases on GrapheneOS as an unlock 153 | mechanism?" 154 |

155 |

Yes, long passphrases consisting of many dictionary words (using the 156 | "Correct Horse, Battery Staple" approach) work perfectly 157 | fine. The limit is 64 characters.

158 | 159 |

160 | "What security tuning or tweaking does GrapheneOS require 161 | off the bat for security or privacy enhancements?" 162 |

163 |

None. GrapheneOS is designed to be secure by default and requires no tweaking nor custom 164 | tuning.

165 | 166 |

167 | "Do you provide root?" 168 |

169 |

No, root is not provided. Root is discouraged in a security-focused environment to minimize 170 | access, privilege, reduce the attack surface of the applications, and reduce the consequences 171 | of user error as much as possible.

172 | 173 |

174 | "Does GrapheneOS support VPNs and VPN apps?" 175 |

176 |

Yes. Orbot, OpenVPN for Android, the userspace implementation of WireGuard, and the Private 177 | Internet Access VPN app have all been tested and reported working. VPNs can be configured 178 | under Settings -> Network & Internet -> Advanced -> VPN.

179 | 180 |

181 | "I want to use Trezor with my Phone, will it work?" 182 |

183 |

Yes, Trezor Model Ts are tested and working with GrapheneOS.

184 | 185 |

186 | "Can I use Yubikeys with GrapheneOS?" 187 |

188 |

Yes, Yubikeys are tested and working with both NFC and connected by USB.

189 | 190 |

191 | "Can I use tethering and hotspot?" 192 |

193 |

Absolutely. Hotspot and tethering have been tested and work fine.

194 | 195 |

196 | Device support 197 |

198 | 199 |

200 | "Will you support my device?" 201 |

202 |

Support for other devices is planned, but there are a few requirements for full support from 203 | Graphene OS. Rather than aim to try to support many devices, GrapheneOS seeks to support only 204 | the devices with the best security, and focus on specific devices to ensure that the most 205 | attention can be paid to the quality of the code, review, and testing.

206 | 207 |

A more detailed answer is in the documentation at the entry under 208 | device support.

209 | 210 |

211 | "Will you support the Pixel 3a? 212 |

213 | 214 |

Yes. The Pixel 3a works fine.

215 | 216 |

217 | "What will I need to know before I purchase a 218 | supported device?" 219 |

220 | 221 |

Devices purchased for running GrapheneOS should be bootloader unlocked. Devices that 222 | are sold by Verizon are bootloader locked and cannot be unlocked to allow them to be 223 | flashed.

224 | 225 |

226 | Installing GrapheneOS 227 |

228 | 229 |

230 | "I've flashed the operating system, and now every time my phone 231 | boots, it presents me with a yellow screen and warns about my phone having a different 232 | operating system installed. Why is this?" 233 |

234 |

This is normal and expected behaviour, as the phone is now running a different operating 235 | system than the factory one installed by the manufacturer. If you see this screen, it is a 236 | good sign, as it indicates that the Android Verified Boot is doing its job to 237 | verify the software, even though it is different than the factory image.

238 | 239 |

Device Integrity Monitoring can be used to further attest 240 | to the authenticity of the installed operating system. 241 | 242 |

243 | I've flashed the operating system, and now every time my 244 | phone boots, it presents me with an ominous-looking orange screen saying 'software integrity 245 | not guaranteed.' What's happening?" 246 |

247 |

If you see this orange screen, the phone is telling you that the boot loader has been left 248 | unlocked. This allows persistent changes to be written to the operating system at will. 249 | Unlocking the bootloader is one of the steps taken during installation of the operating system, but 250 | it is crucially important that as soon as the installation has been finished, the bootloader is 251 | locked again immediately. Your phone should never be used if your bootloader is unlocked; doing 252 | so switches off Verified Boot.

253 | 254 |

Visit the installation guide 255 | on locking the bootloader to find out how to fix this issue.

256 | 257 |

258 | "How difficult is the installation?" 259 |

260 |

Full factory images are included complete with the flash-all scripts. A 261 | step-by-step walkthrough is available on the 262 | install guide. You will need to be familiar with the commandline.

263 | 264 |

265 | "How do I get Android Debug Bridge?" 266 |

267 |

Linux, Mac, and Windows users should always follow the same process and obtain Android Debug 268 | Bridge directly from the 269 | official sources. 270 | No software needs to be installed, the program simply may be run via the commandline from 271 | where it is unzipped to.

272 | 273 |

Linux users should not utilize the version of Android Debug Bridge packaged by 274 | their distro. Not only are these versions often out of date, but often have their versions 275 | numbered according to the distro, rather than the official source. 276 | Utilizing an out-of-date version of Fastboot may brick your device.

277 | 278 |

279 | "I'm on Linux. './adb devices' returns 280 | a warning about no permissions, or Fastboot hangs at 'Waiting for device'. Help!" 281 |

282 |

You will need the correct udev rules to allow adb to communicate with the devices or to run 283 | adb as root. The workflow for adding the correct adb rules for your device will likely be specific 284 | to your distro, so they are not listed here.

285 | 286 |

287 | When I type in './flash-all' it hangs. What is 288 | happening?" 289 |

290 |

Your /tmp partition may be full or too small. Ensure you see the 291 | installation guide. 292 | 293 |

294 | 301 | 302 | 303 | -------------------------------------------------------------------------------- /Old FAQ Draft/faq.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Frequently Asked Questions | GrapheneOS 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 41 |
42 | 43 |

44 | Frequently Asked Questions 45 |

46 |

47 | Table of contents 48 |

49 | 114 | 115 |

This section provides some rudimentary answers to frequently asked questions about GrapheneOS. 116 | It is intended to only give some matter of brief, accessible, non-intimidating answers to a few 117 | questions about GrapheneOS and the projects associated with it and where possible, provide links 118 | to where more exhaustive answers can be found.

119 | 120 | 121 |

122 | About GrapheneOS

123 | 124 | 125 |

126 | "Will you support my device?" 127 |

128 |

Support for other devices is planned, but there are a few requirements for full support from 129 | Graphene OS. Rather than aim to try to support many devices, GrapheneOS seeks to support only 130 | the devices with the best security, and focus on specific devices to ensure that the most 131 | attention can be paid to the quality of the code, review, and testing. 132 | 133 |

A more detailed answer is in the documentation at the entry under 134 | device support.

135 | 136 |

137 | "Will you support my OnePlus Device?" 138 |

139 |

Please see device support. OnePlus devices do not meet 140 | the minimum requirements for support on GrapheneOS, and cannot be supported until they do.

141 | 142 |

143 | "I read that the Pixel 3a and 3a XL will have all the 144 | features you want. Will you support it? 145 |

146 |

Yes.

147 | 148 |

149 | "Do you sell phones with GrapheneOS preloaded?" 150 |

151 |

No. GrapheneOS is not a business, but rather a research and engineering project. Your 152 | easiest bet to get a phone with GrapheneOS is to purchase one of the officially supported 153 | devices as a bootloader-unlocked phone and simply follow the 154 | installation guide. Compiling from source is not 155 | required to run GrapheneOS. The installer script will automate the process of flashing the OS 156 | onto the phone.

157 | 158 |

159 | "What will I need to know before I purchase a 160 | phone?" 161 |

162 |

Devices purchased for running GrapheneOS should be bootloader unlocked. Devices that 163 | are sold by Verizon are bootloader locked and cannot be unlocked to allow them to be 164 | flashed. Err on the side of caution: prior to purchasing, ask the seller if the phone has been 165 | bootloader unlocked for flashing.

166 | 167 |

168 | "Is it ready to be used as a daily driver OS? What do you mean 'not 169 | production ready?'" 170 |

171 |

Resoundingly yes, Graphene OS is stable and feature-rich enough to be utilized as a daily 172 | driver operating system. Each release is throughly tested and stable. The base install is 173 | fairly minimal, which is why it has been listed as not production ready. 174 |

175 | 176 |

177 | I bought a Pixel 1 back when the project was called 178 | AndroidHardening or was sold under a now-defunct company branding and would like to 179 | run GrapheneOS. What does 'Legacy' support mean?" 180 |

181 |

Because Pixel 1s lack some of the security features that set the Pixel 2 and 3 apart, such as 182 | the hardware-backed keystore, insider access protection, and remote attestation, they will not 183 | have all the security features of the newer devices that do. As time goes on, it becomes 184 | increasingly likely that the vendor will cease to provide firmware patches and updates for these 185 | devices. Because of this, the Pixel and Pixel XL would not normally not meet the criteria for 186 | support from GrapheneOS, but have both been included because the project supported them in the 187 | past, and will continue to support them until their obsolescence as a migration strategy. They 188 | are marked as "Legacy" for these reasons.

189 | 190 |

Former users of Android-Hardened or other former incarnations of the project may download 191 | the installers at the releases page under 192 | <>Marlin (for Pixel XL) or 193 | <>Sailfish (for Pixel) and 194 | follow the installation instructions to install 195 | it on their existing devices. Nexus 5X and 6P phones are no longer supported.

196 | 197 |

198 | "What is the difference between LineageOS and 199 | GrapheneOS? Why would I choose GrapheneOS over LineageOS?" 200 |

201 |

"GrapheneOS is a privacy and security research and engineering project above all." 202 | With GrapheneOS, security hardening and privacy come first and all available development time 203 | goes toward improvements in those areas while supporting only devices carefully chosen for 204 | their security and features such as Verified Boot and Remote Attestation. In the future, the 205 | operating system and user experience may be further locked down as a safeguard against malware, 206 | user error, and 207 | social engineering.

208 | 209 |

LineageOS focuses heavily on permissiveness to allow the user to tinker, and widespread 210 | device support, including many older devices, for which firmware and driver updates are no 211 | longer available or no longer maintained. LineageOS also does not support Android Verified Boot, 212 | which is seen as desirable to allow users (or anyone else who has access to the phone) to make 213 | changes as they please. As the goals of a strongly restricted and secure environment and very 214 | careful device selection to select only the devices which have the best security, versus 215 | permissiveness for user customizeability and widespread compatibility are mutually exclusive, 216 | GrapheneOS should not be considered to be a competitor to LineageOS. The two are meant for 217 | different purposes, and different audiences.

218 | 219 |

More information on the project and its roadmap is available at the 220 | writeup for development. 221 | 222 |

223 | "What about Purism's Librem 5? How is GrapheneOS different from 224 | Librem 5/PureOS?" 225 |

226 | 227 |

The Librem 5 builds on a proprietary ARM SoC and other proprietary components of which the 228 | firmware source code is not open. In contrast to a modern smartphone operating system which runs 229 | the applications in their own contained environments, it utilizes the Linux software stack 230 | running the GNOME desktop environment. The desktop software stack (in this case, consisting of a 231 | rebranded but otherwise copied-verbatim version of Debian) considers all the apps running in the 232 | same space to be trustworthy and offers no application isolation. The Librem 5 does not at this 233 | moment appear to support verified boot, hardware-backed keystore and encryption and no technical 234 | information or source code has surfaced on IOMMU setup and mitigations.

235 | 236 |

These design choices and vague promises of a "separate baseband" with the lack of any real 237 | technical information on memory management suggest a haphazard and insecure design, and running 238 | the desktop software stack represents many steps back for privacy and security. Daniel Micay has 239 | discussed this on the 240 | /r/linux subreddit.

241 | 242 |

GrapheneOS on the other hand achieves its security via strong application isolation, improved 243 | memory management, IOMMU setup, SELinux security policies, and the project seeks to combine the 244 | security features and hardening of the operating system with devices that support Verified Boot, 245 | remote attestation, and hardware-bound encryption.

246 | 247 |

248 | Will you support the Purism Librem 5? 249 |

250 |

As per the question on support of devices, to reiterate, devices that will be considered 251 | eligible for GrapheneOS support must have several important things: verified boot, hardware- 252 | backed keystore, hardware-bound encryption, full support for ARM SMMU or IOMMU, and ongoing 253 | vendor support in the form of firmware and driver updates. The Purism Librem 5 has none of 254 | these and cannot be supported.

255 | 256 |

257 | "What License is GrapheneOS distributed under?" 258 |

259 |

264 | 265 |

266 | "Is GrapheneOS a spiritual successor or a fork of a mobile 267 | operating system named after a type of American Pit Viper?" 268 |

269 |

No. The project predates that and traces its roots to an independent security/hardening 270 | project that was started by Daniel Micay many years ago. At one point, phones that were pre- 271 | installed with Daniel's work were sold under a different branding that has since lapsed. 272 | GrapheneOS is the original project that predates this branding and is being continued as a 273 | research and engineering project.

274 | 275 |

276 | Is or was GrapheneOS a fork of LineageOS or CyanogenMod?" 277 |

278 |

No, it is not a fork of LineageOS or CyanogenMod, and never has been. It is a research and 279 | engineering project focused on improving the security and privacy qualities of the Android Open 280 | Source Project and utilizing mobile devices that support the best security.

281 | 282 | 283 |

284 | Installing GrapheneOS 285 |

286 | 287 |

288 | "How difficult is the installation? I've never flashed a phone 289 | before." 290 |

291 |

It is the same difficulty as as flashing your phone back to the factory operating system. It 292 | is much easier than installing LineageOS. Daniel Micay has included an automated installer 293 | script that will do the heavy lifting for you, and a step-by-step walkthrough is available on 294 | the project website. You will need to be familiar 295 | with the commandline and be able to follow instructions to utilize Android Debug Bridge. 296 | Remember to follow the instructions and lock your bootloader afterward!

297 | 298 |

299 | "I have had my phone for a while and have been 300 | running the factory operating system, but would like to install GrapheneOS. Will I lose my 301 | data?" 302 |

303 |

By design, when your phone is unlocked to allow for flashing of the boot loader to install the 304 | operating system onto it, as a safety precaution, your phone will immediately reset itself. This 305 | will cause all data stored on the phone to be lost forever. This is not a bug. Instead, it's a 306 | very important security precaution done to prevent an attack where someone may physically sieze 307 | and unlock the bootloader, install mallware or modify the operating system to steal your password 308 | next time you enter it, then return it to you as if nothing has happened.

309 | 310 |

To prevent this, you can back up your files saved on your shared storage by connecting it to a 311 | trustworthy USB storage device located in a physically secure and trustworthy environment such as 312 | your private home to move your photos and shared storage to it, and back up your apps using Android 313 | Debug Bridge, which includes a backup utility specifically for backing up your 314 | application data, which you can restore in place later.

315 | 316 |

Signal Private Messenger includes its own backup system which allows recovery of your verified 317 | contacts. See "Signal" below.

318 | 319 |

320 | "I've downloaded the latest version of adb, set my phone to 321 | developer mode and turned USB debugging on, but when I plug it in and run ./adb 322 | devices it returns a warning about no permissions, or Fastboot hangs at Waiting 323 | for device. Help!" 324 |

325 |

If you are on Linux, you will need the correct udev rules to allow adb to communicate with the 326 | devices or to run adb as root. Running adb and/or fastboot as root is not recommended, and the 327 | proper way to do it is to set udev rules to allow adb and fastboot to talk to the phone.

328 | 329 |

The workflow for adding the correct adb rules for your will vary by your operating system, 330 | although all of them are somewhat similar. Void Linux has a tutorial at the 331 | Void Linux Wiki. 332 | Arch Linux has documentation at the Arch Linux Wiki under 333 | Adding udev Rules. 334 | 335 |

336 | When I type in flash-all it hangs. What is 337 | happening?" 338 |

339 |

Your /tmp partition may be full or too small. Ensure you see the section 340 | for how to fix this problem. 341 | 342 | 343 |

344 | Security in GrapheneOS 345 |

346 | 347 |

348 | "What is the importance of verified boot and 349 | attestation?" 350 |

351 |

If an attacker has successfully exploited and gotten privileged (root) access on your device, 352 | Android Verified Boot (also called AVB) is designed to prevent a root-level compromise from 353 | persisting and be able to revert the system to a known good state next reboot utilizing error 354 | correction codes until it passes the signature validation. This would require an attacker to 355 | compromise it a second time after a reboot, before they can continue to do nasty things to 356 | your phone.

357 | 358 |

Remote Attestation adds more to this by utilizing some of the hardware security features in 359 | modern phones to detect if unauthorized changes have occurred. In conjunction with each other, 360 | these offer some means to guard against tampering with the operating system. Remote attestation 361 | in the future may be utilized to detect a compromise, and Android Verified Boot to revert 362 | one in the event it has happened.

363 | 364 |

A more detailed overview of verified boot is available at the official documentation about 365 | Android Verified Boot. 366 | 367 |

368 | "I have been told about a 'hardened malloc' specific to the 369 | project. What is it?" 370 |

371 |

The hardened malloc is a memory allocator for the kernel which is designed to protect against 372 | memory corruption vulnerabilities. The one used in GrapheneOS is an all-new design developed by 373 | Daniel Micay, although it is similar in design to OpenBSD's malloc. More detailed and technical 374 | information on the purpose and design of the hardened memory allocator, as well as building it 375 | and what it can do can be found at the manifest 376 | at the Github page.

377 | 378 |

379 | "What is the cipher used to encrypt data on the drive?" 380 |

381 |

The file data is encrypted with AES-256 in XTS mode. Depending on the device, the filenames 382 | are encrypted with AES-256-CTS, or AES-256-HEH. On the Pixel 3 and 3 XL, the Titan M is used to 383 | verify the lock screen password as well as well as derive the symmetric keys to decrypt the 384 | information stored on the solid state drives. Keys are of 256-bit length. The Advanced 385 | Encryption Standard cipher is a thoroughly modern, well-tested cipher that has withstood 20 386 | years of public cryptanalysis and may be used with confidence.

387 | 388 |

File-Based Encryption (FBE) has several advantages over Full-Disk Encryption (FDE). Access to 389 | the unlocked files can be granularized to allow certain profiles on the phones to be given 390 | access to only what they need to access, without giving access to the entire drive and everything 391 | on it as would be the case with Full-Disk Encryption. This also allows the keys to be kept out 392 | of memory when they are not in use and to limit the amount of access that profiles have to the 393 | files. Layering of File-Based Encryption inside of Full Disk Encryption has been discussed by 394 | Daniel Micay but has been determined not to be practical nor offer much appreciable security 395 | benefit for the increased complexity and attack surface.

396 | 397 |

398 | "What is the Titan M? Why is it so important? How does GrapheneOS use it?" 399 |

400 |

The primary selling point of the Titan M hardware security module is the Strongbox Keymaster, 401 | which allows secret keys to be created, stored and used within the chip, where even root on the 402 | operating system cannot extract them. The physically separated chip offers significantly less 403 | attack surface than ARM Trusted Execution Environment. Auditor on GrapheneOS starting with 404 | version 11 of the Auditor App uses the Strongbox Keystore API for verifying the operating system 405 | if it is present. This security feature has extensive functionality and could be used for secure 406 | payments, public key cryptography, or allowing apps to use the Titan M to save data to the drive 407 | encrypted while the phone is locked, without needing to risk exposing the keys. For example, one 408 | application that this would benefit from would be to allow the phone to take pictures without 409 | needing to handle the keys to the drive. The chip is physically hard-wired to the buttons on the 410 | phone, so user input to it cannot be spoofed by a malicious app or a compromised operating 411 | system.

412 | 413 |

It provides 'insider attack protection' which requires the owner to authenticate to the chip 414 | using a password that is chosen by the owner, before the chip will allow the firmware of the 415 | device to be updated. This is intended to dissuade a situation similar to the 2015 Apple v. 416 | FBI case, where a malicious actor could confiscate the device, find an exploit to gain 417 | control of the operating system, then use legal or extralegal pressure to force Google to issue 418 | a rogue firmware update that would disable the security features. Since the phone cannot accept 419 | the updates without the owner's password, this removes the vendor from being a third party in 420 | that particular attack vector.

421 | 422 |

The Titan M is also used for verifying of the user's password and for drive encryption. The 423 | chip creates and stores a secret token. The chip will not calculate and release the secret token 424 | that the phone will use to derive the keys to the drive until it gets the correct password. 425 | Since the chip uses its own internal timer built into it, it can enforce a progressively 426 | lengthening timeout to deter brute force attacks more reliably than relying on the strength of 427 | the password and a work factor such as a key derivation function alone. This also presents a 428 | safer alternative to keeping the keys in a continually precarious state and erasing them should 429 | ten incorrect guesses at the pincode be made. Unlike the factory image, GrapheneOS supports the 430 | use of long passphrases to allow for both security measures of a cryptographically strong 431 | passphrase and hardware bound encryption to be used together, combining hardware-backed 432 | encryption with a cryptographically strong passphrase.

433 | 434 |

The Titan M is incorporated into the boot process by storing the last good version of the 435 | operating system within itself and not allowing the phone to be downgraded to an earlier 436 | revision to disable or roll back security protections.

437 | 438 |

Factory Reset Protection to discourage steal-and-sell attacks where an attacker steals the 439 | phone, changes the IMEI and resets the operating system in order to resell it as if it were a 440 | legitimately purchased secondhand device is not yet implemented on GrapheneOS, but is also one 441 | of the features it supports and may be implemented in the future.

442 | 443 |

444 | "Does GrapheneOS have any protections from Baseband 445 | Exploits?" 446 |

447 |

GrapheneOS selects devices that allow for baseband isolation via IOMMU which is capable of 448 | limiting direct memory access from the devices, and utilizes open source device drivers which 449 | can be verified for their correctness. Additionally, the radios (cellular, Wi-Fi, Near Field 450 | Contact, Bluetooth) are stateless. The operating system will load the binary firmware each time 451 | it boots, and the devices will validate the firmware. If they ever become compromised, rebooting 452 | the phone should reset them to the previous state, and verified boot should restore the operating 453 | system to the state it was in when it was signed and the Android Verified Boot key was 454 | provisioned.

455 | 456 |

Secondly, should they ever turn evil, the IOMMU is designed to limit the access they have to 457 | host memory, so the devices such as the phone's radios and modems, SSD, or graphics processor 458 | cannot simply read or write to host memory at will unless the driver allows it to, and only to 459 | locations the driver is specifically coded to allow.

460 | 461 |

462 | "How does GrapheneOS compare to the latest iPhone with iOS 463 | or Samsung Knox/Stock Android/Google Android/Qubes-OS/Windows Server with Microsoft Integrity 464 | Control/Hardened Gentoo/[insert my favourite security OS here]?" 465 |

466 |

This is a very complex and multifaceted, very technical discussion and is outside the scope of 467 | a 30-second answer page, so Daniel Micay has written a brief collection of his thoughts on the 468 | subject on the project subreddit 469 | which may be able to provide a bit of perspective.

470 | 471 |

472 | "Do you support long passphrases on GrapheneOS as an unlock 473 | mechanism?" 474 |

475 |

Yes, long passphrases consisting of many dictionary words (using the 476 | "Correct Horse, Battery Staple" approach) work perfectly 477 | fine. The limit is 64 characters.

478 | 479 |

480 | "I would like to have [afwall/XPrivacyLua/Xposed/some 481 | other security app]. How could I go about doing that?" 482 |

483 |

You don't.

484 | 485 |

By design, Android assumes that the third-party apps running on it are untrustworthy and must 486 | be confined to their own self-contained environments. This allows the operating system to 487 | enforce its own policy over them. These "security" apps such as Xprivacy and afwall are little 488 | more than security theatre, or to work, require more privilege over other apps. This is mutually 489 | exclusive with the goals of application isolation.

490 | 491 |

Exposure of root access to an application or to allow one app to break out of its isolation 492 | is defective by design, and is harmful to the security and privacy of your phone. GrapheneOS is 493 | implements its own networking permissions via a privileged extension which substantially 494 | reduces the attack surface.

495 | 496 |

497 | "What security tuning or tweaking does GrapheneOS require 498 | off the bat for security or privacy enhancements?"

499 | 500 |

None. GrapheneOS assumes a "secure and private by default" approach.

501 | 502 |

503 | "Do you provide root?" 504 |

505 |

No, root is not provided. Root is discouraged in a security-focused environment to minimize 506 | access and privilege as much as possible. The defaults and policies have been very carefully 507 | and very deliberately set by a developer and security researcher with many years of experience 508 | and for specific reasons. Changing them will make your device less secure, not more.

509 | 510 |

Granting root permission to any app will mean that the moment that app is exploited, the 511 | entire operating system will be compromised, and the exploited app can read then the data out of 512 | the other apps that it normally wouldn't be able to without root. Android already distrusts third- 513 | party apps, which represents a massive increase in the amount of security that the operating 514 | system can provide when running programs that may not be trustworthy.

515 | 516 |

Verified Boot will attempt to undo any of the changes that you make to the operating system 517 | to roll it back to the last known good image that was signed and verified by the developers. 518 | This means in order to have persistent changes made as root, you would need to disable Verified 519 | Boot and leave your bootloader unlocked. Essentially, root access on GrapheneOS undoes most of 520 | the hardening and security work that has gone into it and is at odds with the project goals.

521 | 522 |

523 | Could I use a fingerprint combined with a pin-code to unlock my 524 | phone as a form of second-factor authentication? 525 |

526 |

This feature has been requested frequently, but will need community contributions to be added. 527 |

528 | 529 | 530 | 531 |

532 | Day to Day Use 533 |

534 | 535 |

536 | "Do I need to unlock the bootloader to update or flash again?" 537 |

538 |

No. All software releases are signed by Daniel Micay's software release keys, then are sent 539 | out over the air from the update server. Your phone will automatically download and install 540 | updates as they are released. You may choose whether or not to have the phone reboot after the 541 | update has been installed automatically.

542 | 543 |

544 | What does the operating system come with?" 545 |

546 |

"Out of the box", the operating system comes with an app for SMS messages and a Phone app, a 547 | search app, Vanadium Browser, Auditor, Mail, Calendar, Photo Gallery, Calculator, Camera, and a 548 | File Browser.

549 | 550 |

Disabling the default apps is not recommended, as other apps may depend on them.

551 | 552 |

553 | Will the Google Camera be available on Graphene OS? 554 |

555 |

The Google Camera application which uses software compositing to take pictures that are of 556 | much higher quality than the phone's Megapixel rating would otherwise do without are non-free, 557 | and cannot be included in GrapheneOS at this time. In the future, it is likely several of the 558 | dependencies that Google Camera uses will be removed from the OS to further increase the security 559 | and privacy of the platform, and will preclude the use of Google Camera.

560 | 561 |

562 | "What apps will GrapheneOS run?" 563 |

564 |

GrapheneOS will run most apps for Android, with the exception of some very old Android apps 565 | that may have been written for obsolete versions of Android and are written insecurely or make 566 | unsafe calls. Most apps from F-Droid will run. GrapheneOS will run proprietary apps such as 567 | Spotify and some banking apps if they are loaded from .apk so long as they do not have a hard 568 | dependency on the absent Google Software Frameworks. Some apps that are dependent on Google 569 | Software Frameworks may run, but may not display notifications until the apps are opened.

570 | 571 |

Apps that make unsafe calls or attempt to violate the security policies that GrapheneOS has put 572 | in placewill be halted immediately by the operating system, and a notification that the application 573 | has stopped working delivered to the user as if the app crashed. Generally, apps that exhibit 574 | this behaviour tend to be for very old or obsolete versions of Android.

575 | 576 |

577 | "Will Signal Private Messenger work?" 578 |

579 |

Yes, Signal Private Messenger has been extensively tested and is working fine on GrapheneOS. 580 | If you already have Signal installed on your existing device, prior to flashing it, you may opt 581 | to migrate your existing Signal keys using the Backup function in the application under settings. 582 | This will save your Signal data to the phone storage encrypted with a 30-digit passcode which is 583 | generated randomly and only displayed to the user once. It includes not only your chat histories, 584 | but also your cryptographic keys, so when you restore, you won't have to start over with no 585 | verified contacts.

586 | 587 |

If you have set a registration lock, be sure that you have not forgotten your registration 588 | lock pincode prior to flashing the device, as it will ask you for the registration pincode when 589 | you install and set up the application on your new device. Make sure that the backup is copied 590 | into the directory you obtained it from when you start Signal for the first time on the new 591 | device. If you do not restore your old backup, you will not have the option to do so later.

592 | 593 | 597 |

Unfortunately not, it is a part of the boot loader.

598 | 599 |

600 | I installed F-Droid as an app store. But F-Droid asks me 601 | to manually tap "Install" every time I update an app. Why is this?" 602 |

603 |

The F-Droid Privileged extension which bypasses the security checks to allow for unattended 604 | application installs is not installed. In the future a different application store may be 605 | implemented.

606 | 607 |

608 | "Does GrapheneOS support VPNs and VPN apps?" 609 |

610 |

Yes. Orbot, OpenVPN for Android, the userspace implementation of WireGuard, and the Private 611 | Internet Access VPN app have all been tested and reported working. GrapheneOS implements its 612 | own means to utilize VPNs under Settings -> Network & Internet -> Advanced -> VPN.

613 | 614 |

615 | "I want to use Trezor with my Phone. Will you support that?" 616 |

617 |

Yes, Trezor Model Ts are tested and working with GrapheneOS.

618 | 619 |

620 | "I use Yubikeys for E-Mail Encryption or GPG signing. Will they work?" 621 |

622 |

Yes, Yubikeys work by both USB and NFC with OpenKeyChain and K-9 Mail for GPG Mail Encryption, 623 | Signing and Decryption. No additional configuration is required. Download and import your PGP 624 | Public Key Blocks (aka OpenPGP Digital Certificates), tap the option to add secret keys from a 625 | token, follow the steps onscreen and they will be detected and linked automatically.

626 | 627 |

628 | "I want to use Solokeys for U2F with my Phone. Have they been tested?" 629 |

630 |

Sorry, they haven't been working yet. Keep checking back!

631 | 632 |

633 | Will you support Signature Spoofing so I can use 634 | [insert favourite app here] from MicroG?" 635 |

636 |

While it could be done at the cost of requiring the user to build the OS from source and 637 | insert signature spoofing functionality at that time, signature spoofing is not supported. It 638 | destroys the application security model by allowing the apps to bypass signature checks, which 639 | could open up the possibility for a single app to install malware to the phone. Both security 640 | and privacy-wise, you would be better off using Google's OS than spoofing signatures.

641 | 642 |

643 | "Will you support tethering and hotspot?" 644 |

645 |

Absolutely. Hotspot and tethering have been tested and work fine.

646 | 647 |

648 | "Can I set the update client to only download on WiFi?" 649 |

650 |

Yes, under the Seamless Update App, set it for unmetered networks only to prevent the update 651 | client from using up your cellular data plan.

652 | 653 |

654 | "Why a derivative of Chromium? Why not Firefox?" 655 |

656 |

GrapheneOS uses its own version, Vanadium. The included browser is used for webview and 657 | adding other browsers will add an increase in attack surface. Vanadium will have more hardening 658 | work done to it that will require integration with the operating system. Chromium was chosen as 659 | a base for security reasons for its better sandboxing and architecture.

660 | 661 |

A more detailed answer is available from Daniel Micay on the 662 | project subreddit 663 | which discusses issues such as browser fingerprinting issues common to both Tor Browser and 664 | Firefox, sandboxing, sidechannel attacks, and why Chromium was chosen to be the base for 665 | Vanadium and as GrapheneOS' browser.

666 | 667 | 668 | 669 |

670 | Local Verification With Auditor 671 |

672 | 673 |

674 | "I think I may be getting a false positive. What could be 675 | causing that?" 676 |

677 |

There are a number of reasons that the auditor app could fail.

689 | 690 | 691 | 692 |

693 | Remote Verification with the Attestation Server 694 |

695 | 696 |

697 | "I don't have a second phone. How will I audit 698 | myself?" 699 |

700 |

You can use the attestation server, which is also 701 | operated by the project. You will need an E-mail address you trust. Periodically, at a time 702 | interval set by you, the attestation server will ping your device and issue it a challenge it 703 | must respond to using the hardware-backed remote attestation. If the device fails to check in 704 | after the timer is up, or the operating system has been tampered with and the remote attestation 705 | fails, the attestation server will send you an E-mail to warn you that the phone has for any 706 | reason failed the audit.

707 | 708 |

You should make sure that the E-mail account you receive your attestation notifications on is 709 | not the same E-mail account accessible from your phone.

710 | 711 | 712 | 713 |

714 | Bugs, Troubleshooting, Feedback and Community 715 |

716 | 717 |

718 | "After I flash the operating system on my Pixel 2 or 719 | Pixel 3 and switch it on, I cannot access the app info or widgets by tapping and holding the 720 | icons." 721 |

722 |

This is a known bug which is common for the first boot after flashing. The current 'fix' is to 723 | simply reboot the phone a second time.

724 | 725 |

726 | "I have a [question/feedback/great idea/fan mail] for GrapheneOS! Where 727 | could I discuss it?" 728 |

729 |

GrapheneOS maintains a number of community outlets. To get in touch with the project directly, 730 | head to the contact page.

731 | 740 |

741 | 742 |

743 | "I own a Pixel 3. The camera app on it sometimes lags 744 | when I take a picture, or crashes when I switch between the front and rear camera or vice- 745 | versa. What gives?" 746 |

747 |

This is also a known bug, as the camera app is borrowed from the Android Open Source Project 748 | camera app and lacks many of the Google Camera software improvements. A somewhat ugly workaround 749 | is to close, then restart the camera app after changing from the front to the rear camera. If 750 | other applications dependent on the camera stop working with the camera, close and restart them. 751 | A new camera app will be found soon, as the one included is just an interim measure. This should 752 | not affect the security of the rest of the phone but occasionally may be inconvenient.

753 | 754 |

755 | "I found a bug. How do I report it?" 756 |

757 |

Bugs may be reported for their respective projects at the 758 | Github page by filing an issue with the 'bug' tag. 759 |

760 | 761 |

762 | "I'm on Sprint, flashed GrapheneOS and my phone will no 763 | longer connect to the cell network! Help!" 764 |

765 |

Sprint, Google Fi, Verizon and some mobile networks require proprietary drivers to be 766 | installed in the operating system. These drivers occupy highly privileged positions in the 767 | operating system and present a security (read: service provider backdoor) hazard. GrapheneOS 768 | does not include them for this reason. These networks are not compatible with GrapheneOS.

769 | 770 |

771 | "I use Carrier XYZ. Will GrapheneOS support 772 | that?" 773 |

774 |

If your carrier does not require proprietary and privileged drivers to operate with their 775 | network, GrapheneOS will work with it so long as your handset supports the frequency your 776 | carrier uses. This is set by the baseband processor in your cellphone's software-defined 777 | cellular radio, and is not set by the operating system.

778 | 779 |

780 | "I've flashed the operating system, and now every time my phone 781 | boots, even though I locked the boot loader, it presents me with a yellow screen instead of 782 | the orange one and warns about my phone having a different operating system installed. Has 783 | my OS been tampered with? Why is this?" 784 |

785 |

This is normal and expected behaviour, as the phone is now running a different operating 786 | system than the factory one to the one installed on the phone by the manufacturer. If you see 787 | this screen, it is a good sign, as it indicates that the Android Verified Boot is switched on 788 | and working.

789 | 790 |

If you successfully verified the installer you downloaded, and verified that the keys that 791 | signed it really were Daniel Micay's keys, simply skip the warning, as everything is working as 792 | it was originally intended to. If you have doubts about the integrity of the operating system, 793 | utilize the Auditor App for remote attestation to verify whether or not it worked. The Auditor 794 | App utilizes the phone's hardware remote attestation features to detect compromise or 795 | unauthorized changes to the OS and report them if they are detected.

796 | 797 |

798 | I've flashed the operating system, and now every time my 799 | phone boots, it presents me with an ominous-looking orange screen and a cryptic warning 800 | about 'software integrity not guaranteed.' What's happening?" 801 |

802 |

If you see this orange screen, the phone is telling you that the boot loader has been left 803 | unlocked, which disables security measures such as Android Verified Boot. This allows persistent 804 | changes to be written to the operating system at will. During the installation process of 805 | GrapheneOS, unlocking the bootloader is a prerequisite to allowing the installer to run, but it 806 | is crucially important that as soon as the installer has completed, the bootloader should be 807 | locked again immediately. Your phone should never be used if your bootloader is unlocked; doing 808 | so nullifies all the security benefits of having Verified Boot, and is very unsafe!

809 | 810 |

Visit the installation guide 811 | on locking the bootloader to find out how to fix this issue. Each time the bootloader is 812 | locked or unlocked, as a safeguard the phone will be reset and all the data stored on the phone's 813 | drive, such as photos, E-mails, text messages, saved passwords, and your Two-Factor 814 | Authentication Tokens will be lost forever. If you have accidentally started using a phone with 815 | an unlocked bootloader and saved data to it that you do not want to lose, you should save the 816 | data by either utilizing the adb backup or adb pull utilities from 817 | Android Debug Bridge to retrieve the files from the phone.

818 |
819 | 826 | 827 | 828 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # GrapheneOS-Knowledge 2 | This is a short description of some of the knowledge I've collected on GrapheneOS and some common questions I've been asked and my answers to them. 3 | 4 | Something I should mention off the bat right now is that **this repository is a rough draft.** Much of the information in it is very work-in-progress, and some of it needs to be looked at. This repository is meant more as a launchpad to invite feedback and pass scrutiny before being sent to the project itself. Some of it could be inaccurate, but it's better that the inaccurate information remain on an obscure and heavily disclaimered backwater git repo than be posted in public venues. 5 | 6 | I'm planning to put them into a more cohesive FAQ later. 7 | -------------------------------------------------------------------------------- /Twitter and Reddit/README.md: -------------------------------------------------------------------------------- 1 | # Daniel and CopperheadOS 2 | This is a collection of links around the conflict. 3 | 4 | ## The biggest ones 5 | Daniel's subreddit post on the subject 6 | 7 | https://old.reddit.com/r/CopperheadOS/comments/apk5p8/sockpuppet_accounts_being_used_to_spread_libel_by/ 8 | 9 | ### Twitter 10 | https://twitter.com/DanielMicay/status/1171171187248041984 11 | > "Copperhead was a former sponsor of the project, and agreed to support it as an independent open source project under my control. Copperhead never owned the code. It was not written for them and was never assigned to them. This was part of a very explicit arrangement I required." 12 | 13 | > "Unfortunately, the CEO of Copperhead (James Donaldson) is a scam artist with a criminal background. He ended up breaking the terms of agreements and attempting to seize control and ownership of the project, including attempting to compromise the security of the people using it." 14 | 15 | > "He seized control over the infrastructure, stole all the donations and began his attempts to destroy the project which are still ongoing today. He's spreading lies about the project and myself on a daily basis and still attempting to do whatever he can to continue causing damage." 16 | 17 | > "James was only ever interested in using the project and myself to line his pockets with money through whatever means possible. Copperhead was run in a highly unethical and irregular way. He pursued and signed deals with criminal organizations and tried to sell out to governments." 18 | 19 | > "Near the end of Copperhead's involvement, James was pursuing a deal with a US military contractor. He told me he needed to provide access to infrastructure and signing keys so they could "audit" them. It was a ridiculous request that I obviously refused." 20 | 21 | > "James and one of his associates were scheming to trick the police into seizing my personal hardware by claiming it was stolen company property in an attempt to get the signing keys, which wouldn't have worked anyway. I was leaked this information by someone involved with them." 22 | 23 | ### The account takeovers 24 | https://twitter.com/DanielMicay/status/1070352677542879232 25 | > "I need help getting in contact with a Reddit administrator and someone at Twitter able to help. They've made uninformed decisions that are continuing to cause substantial harm to my open source privacy/security work. They took easily disproved lies from Copperhead at face value." 26 | 27 | https://twitter.com/DanielMicay/status/1070367159405047808 28 | > "The open source work was not done for Copperhead under either work contracts or an employment agreement. There was no copyright assignment, and I never granted any formal licenses to them. It was also explicitly agreed that the projects were independently controlled / owned." 29 | 30 | ### Tax claims 31 | https://twitter.com/DanielMicay/status/1229548605054296067 32 | > "It really sucks having the government expecting me to pay taxes on income that I didn't earn. Not only are they taking Copperhead's fraudulent filing at face value, but adding it to the amount that I already paid for the same source of income is just totally screwed up." 33 | 34 | 35 | ### Further reading from Daniel Micay on his Twitter Page 36 | 37 | #### The situation with the Twitter Account: 38 | https://twitter.com/DanielMicay/status/1157966881682350080 39 | > "Twitter's security engineering and 2-factor authentication is a sham. They literally handed my project's previous account to an scammer despite it being tied to my email and phone number with my app and security key 2FA. They know they're in the wrong and have delayed for a year." 40 | 41 | https://twitter.com/DanielMicay/status/1070369294209273856 42 | > "It used my email and phone number, for years. I moved from a http://copperhead.co email to a http://gmail.com email before the events leading up to things falling apart too. The action Twitter took was rolling it back to the past email to allow Copperhead to seize it." 43 | 44 | ##### How the accounts were stolen 45 | https://twitter.com/DanielMicay/status/1062439759534903296 46 | > "James not only stole the majority of the donations but also the Twitter account representing my projects and security research / engineering. I had renamed it and he tricked Twitter support into handing over my account to him and claims it's a corporate account which it wasn't." 47 | 48 | https://twitter.com/DanielMicay/status/1062445479835783168 49 | > "Twitter support rolled back the email address to the one used months prior (daniel.micay@copperhead.co) for them and then James was able to seize control via grabbing control of all the http://copperhead.co infrastructure since he registered the domain on his personal account." 50 | 51 | #### Being pushed out of the project 52 | https://twitter.com/DanielMicay/status/1068641901157511168 53 | > "The update notes at https://copperhead.co/android/docs/updates falsely claim that the new incarnation of CopperheadOS has been updated to the latest security patch levels. However, that isn't the case. In reality, it hasn't received the full August, September, October or November security patches." 54 | 55 | ##### Donaldson and the project 56 | https://twitter.com/DanielMicay/status/1095054976991268866 57 | > "They've been falsely claiming that I was kicked out of an open source project before my involvement in Android hardening, which is completely untrue. I left that project on my own accord and remain on good terms with most of the people involved, with a couple notable exceptions." 58 | 59 | ##### On Copperhead 60 | https://twitter.com/DanielMicay/status/1093157375207530496 61 | > "By the way, @_copperj has strategically blocked me on Twitter after I debunked misinformation and lies that he was spreading in replies to his tweets. I'm unable to easily see what he's saying and I cannot directly respond to it. I checked from a logged out browser though." 62 | 63 | https://twitter.com/DanielMicay/status/1068641901157511168 64 | > "The update notes at https://copperhead.co/android/docs/updates falsely claim that the new incarnation of CopperheadOS has been updated to the latest security patch levels. However, that isn't the case. In reality, it hasn't received the full August, September, October or November security patches." 65 | 66 | ##### Further dealings 67 | https://twitter.com/DanielMicay/status/1063169110949822464 68 | > "Please help get the word out about what has happened with Copperhead. They're tricking people into buying an insecure product misrepresented as hardened. It isn't even updated to Android 9 and lacks full security updates. Pixels don't receive full security updates via Android 8." 69 | 70 | https://twitter.com/DanielMicay/status/1063173913167880192 71 | > "They're attempting to bully me into giving them a 10 year exclusive commercial license for my code: https://twitter.com/DanielMicay/status/1062458169903869952. At the moment, their usage is not legal. Companies buying licenses from them DO NOT HAVE A COMMERCIAL LICENSE as Copperhead cannot provide one to them." 72 | 73 | ##### Bitcoin 74 | https://twitter.com/DanielMicay/status/1062432377480208384 75 | > "I've had enough of this and I need your help getting back these donations: 76 | > 77 | > https://twitter.com/DanielMicay/status/1062395757263646720 78 | > 79 | > This is theft. Even when the people who donated contact him and demand that donated to support me get passed along, James falsely claims it was donated to support the business." 80 | 81 | https://twitter.com/DanielMicay/status/1036769302358048768 82 | > "Regular reminder that I had no license, copyright or employment agreement with Copperhead. The open source projects are mine and always have been. James Donaldson (@_copperj) is falsely claiming Copperhead owns the sources to the projects I started before the company existed..." 83 | 84 | ###### Reddit on the bitcoins 85 | https://old.reddit.com/r/CopperheadOS/comments/brtljy/stolen_donations/ 86 | 87 | ##### Copperhead and copyright 88 | https://twitter.com/DanielMicay/status/1033834699599179776 89 | 90 | https://twitter.com/DanielMicay/status/1057031286999502849 91 | > "Copperhead is falsely claiming copyright of my code: 92 | > 93 | > https://github.com/CopperheadOS 94 | > 95 | > Everyone buying a device from them or licensing the code from them is in violation of my licenses. 96 | > 97 | > I had no work contracts, employment agreement or copyright / licensing agreement with Copperhead." 98 | 99 | https://twitter.com/DanielMicay/status/1033835883374333952 100 | > "He has quite literally pursued business deals with multiply companies and individuals tied to criminal networks that were later arrested due to their phone business. Check out the articles on some of them by @josephfcox. Copperhead with James in control is completely compromised." 101 | 102 | 103 | ### Further Reading: 104 | 105 | #### Hacker News: Copperhead has imploded 106 | https://news.ycombinator.com/item?id=17289536 107 | 108 | #### Address to the subreddit 109 | https://old.reddit.com/r/CopperheadOS/comments/8qdnn3/goodbye/ 110 | 111 | #### Copy of the takeover letter 112 | https://github.com/yegortimoshenko/copperhead-takeover 113 | --------------------------------------------------------------------------------