Compatibility regressions with anti-tampering SDKs used by apps are resolved - GrapheneOS Discussion Forum

Loading...

This site is best viewed in a modern browser with JavaScript enabled.

Something went wrong while trying to load the full version of this site. Try hard-refreshing this page to fix the error.

Compatibility regressions with anti-tampering SDKs used by apps are resolved

GrapheneOS

We solved the recent regression in compatibility with a small subset of banking apps. It was caused by a Zimperium anti-tampering SDK checking the Linux kernel mount ID for /system/framework/framework.jar and banning it being above 900. Our new secure spawning was tripping it.

Our new secure spawning implementations runs the same code run by the Zygote after exec to improve compatibility. Many apps which didn't work before are now compatible. However, that tripped this mount ID check by recreating a mount namespace. It doesn't need that part so we've simply removed it.

Our new secure spawning also added a per-app toggle. Alongside this, we made is possible to disable secure spawning and hardened_malloc at the same time. This requires an extra zygote with hardened_malloc disabled which we spawned on-demand. It has to be spawned at boot instead for low mount IDs.

Our new secure spawning implementation has better app compatibility. This made it possible for the V-KEY V-OS Mobile App Protection anti-tampering SDK to run instead of crashing and it began blocking GrapheneOS. We've solved this problem by simply blocking their code from running for the time being.

Our new secure spawning improved overall app compatibility despite these 2 anti-tampering SDKs causing new issues with it. We've solved the regressions and are currently building a new release with the improvements. It will be available in around 12 hours. App compatibility will be better than ever.

You can see the relevant changes here:

https://github.com/GrapheneOS/platform_frameworks_base/pull/410

https://github.com/GrapheneOS/platform_system_core/pull/43

Social media threads:

https://bsky.app/profile/grapheneos.org/post/3mqpeckbb6k2w

https://x.com/GrapheneOS/status/2077465815645888977

https://grapheneos.social/@GrapheneOS/116925427491681935