Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Termux support #338

Closed
pawamoy opened this issue Dec 3, 2018 · 19 comments
Closed

Termux support #338

pawamoy opened this issue Dec 3, 2018 · 19 comments

Comments

@pawamoy
Copy link

pawamoy commented Dec 3, 2018

I'm trying to run Tomb in Termux.

I have been able to install pinentry, gnupg, cryptsetup and zsh:

pkg install root-repo
pkg install pinentry gnupg cryptsetup zsh

I then got Tomb's source code, cd into it and ran make install successfully.

Now, trying to run tomb --version, I get:

/data/data/com.termux/files/usr/bin/tomb:68: failed to load module: zsh/mapfile
tomb [E] Missing required dependency sudo.  Please install it.

If in Termux, sudo should not be used. I don't know how to fix the zsh/mapfile failure yet.

Would you want to support Termux anyway? Could be great to have tombs on my phone 😉

@Narrat
Copy link
Collaborator

Narrat commented Dec 3, 2018

should not or cannot?
General problem is the fact, tomb uses programs which generally require privilege escalation.
There are discussions regarding getting rid of sudo (like #322), but it isn't that easy.

And regarding the mapfile error. Maybe they set a compile time option and didn't include it for arm packages or it's to old (when was it added?). What version is the termux zsh?

@pawamoy
Copy link
Author

pawamoy commented Dec 4, 2018

Cannot! I actually updated some of my scripts to detect if we are in Termux and set a SUDO variable to the empty string in that case. Then instead of plain sudo I use $SUDO and it seems to works well 🙂.

As a workaround on termux I put a dummy sudo script in /data/data/com.termux/file/usr/bin which simply runs exec "$@".

About privilege escalation, I think it won't be a problem in Termux, as long as the required packages are available as termux packages.

But anyway, there are 2 others requirements that I couldn't yet install: mkfs.ext4 and e2fsck. I will check in termux-packages if their porting is planned.

Finally, the zsh version is zsh 5.6.2 (arm-unknown-linux-androideabi). I don't know zsh so if there is a way to get more info about the compilation options that were used, or anything else, just let me know how to get those and I'll report back.
Also: /data/data/com.termux/files/usr/bin/zsh: ELF 32-bit LSB pie executable, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /system/bin/linker, stripped

@pawamoy
Copy link
Author

pawamoy commented Dec 4, 2018

I opened package requests on termux-packages: https://github.com/termux/termux-packages/issues/3115 and termux/termux-packages#3116.

@Narrat
Copy link
Collaborator

Narrat commented Dec 4, 2018

Regarding the filesystem, you can theoretically switch to one, were packages are available in termux. Theoretically because you would need to change your existing tombs :D
Oh? So everything in termux runs as root? Okay

The zsh version is the most recent. So the age cannot be the problem. Is there a /data/data/com.termux/file/usr/lib/zsh/5.6.2/zsh/mapfile.so (or at whatever location the stuff is installed to)?

@pawamoy
Copy link
Author

pawamoy commented Dec 4, 2018

Oh? So everything in termux runs as root? Okay

I think it's more of the opposite: everything runs without the need of root, inside the Termux container. Actual root access requires to root the phone, then installing additional package like termux-sudo or something like that.

As an example, the openssh package is preconfigured to use the port 8022 for SSH. Other FTP or WebServer packages are preconfigured to use ports 8021 and 8080. Because to use ports below 1024, users would need to root their phone.

I can only find /data/data/com.termux/files/usr/share/zsh/5.6.2/functions.

About the filesystem, it is still possible to apt install proot in Termux and run chroot to mimic a normal Linux filesystem.

@Narrat
Copy link
Collaborator

Narrat commented Dec 4, 2018

Ah, I see. Makes sense.

I'm curious why the modules aren't included. Maybe just because of size or are there problems on ARM? Well, let's see what happens to the request. I noticed other open issues regarding missing zsh stuff.

About the filesystem, it is still possible to apt install proot in Termux and run chroot to mimic a normal Linux filesystem.

Not sure if we are on the same page :D I meant you could change the filesystem inside the tomb

Edit: Just as a note https://github.com/termux/termux-packages/blob/master/packages/zsh/build.sh#L32
Currently those modules seems to be available

@pawamoy
Copy link
Author

pawamoy commented Dec 4, 2018

Not sure if we are on the same page :D

Ah, yeah, sorry ^^

I noticed other open issues regarding missing zsh stuff.

Yep I saw that too, and other zsh module requests were fulfilled so I have good hope 🙂

@jaromil
Copy link
Member

jaromil commented Dec 6, 2018

Hi there! nice try, wonder if will work, did it myself 3 years ago or so usin zshaolin, a statically compiled cryptsetup and a rooted android, with very poor results (limited functionalities and very slow i/o). Maybe now something changed. Some info that may help:

  • there is my old attempt (without backported changes) in tomb/extras/android
  • android does not support dynamic linking at runtime, only at compiletime with ndk libs: this is their way to avoid LD_PRELOAD attacks 😒 and part of their "security model" so either the zsh extensions are compiled in either they will never be loaded
  • I doubt is at all possible to run formatting operations on a non-rooted phone

all that aside, if we come to a reasonable switch that avoids sudo dependency making it an optional default, I'd be up to include it in tomb.

@pawamoy
Copy link
Author

pawamoy commented Dec 6, 2018

either the zsh extensions are compiled in either they will never be loaded

You're right, we need to add mapfile at compile time, where @Narrat pointed it.

cryptsetup is already ported, and e2fsprogs too, but still waiting to be merged.

I hope cryptsetup, mkfs.ext4 and others will be able to run without rooting my phone :'(

@jaromil
Copy link
Member

jaromil commented Dec 26, 2018

ACK on porting these tools! very cool. Keep us posted please!

@pawamoy
Copy link
Author

pawamoy commented Dec 26, 2018

Maybe you saw it but the mapfile module was added to zsh 🙂
termux/termux-packages#3116

Still waiting for e2fsprogs to be merged at termux/termux-packages#2880!

Once it's done I will start experimenting and report back.

@pawamoy
Copy link
Author

pawamoy commented Jan 3, 2019

I installed the precompiled e2fsprogs debian package on my phone (link available in mentioned issue/PR) to run some tests. Results are... encouraging?

Here are the logs. I added notes (as quotes) between some parts.

u0_a127@localhost ~ $ tomb --version
  Tomb 2.5 - a strong and gentle undertaker for your secrets

   Copyright (C) 2007-2017 Dyne.org Foundation, License GNU GPL v3+
   This is free software: you are free to change and redistribute it
   For the latest sourcecode go to <http://dyne.org/software/tomb>

   This source code is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
   When in need please refer to <http://dyne.org/support>.

  System utils:

/data/data/com.termux/files/usr/bin/sudo: line 2: exec: -V: invalid option
exec: usage: exec [-cl] [-a name] [command [arguments ...]] [redirection ...]

I fixed the above error by tweaking my dummy sudo script. Script is added at the end of this comment.

main:301: command not found: findmnt

I guess the command findmnt should have been installed with the e2fsprogs deb package, and it was not for some reason.

  cryptsetup 2.0.6
  pinentry-curses (pinentry) 1.1.0
Copyright (C) 2016 g10 Code GmbH
License GPLv2+: GNU GPL version 2 or later <https://www.gnu.org/licenses/>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

  gpg (GnuPG) 2.2.12 - key forging algorithms (GnuPG symmetric ciphers):
  /data/data/com.termux/files/usr/bin/gpg
 IDEA 3DES CAST5 BLOWFISH AES AES192 AES256 TWOFISH CAMELLIA128 CAMELLIA192 CAMELLIA256

  Optional utils:

  gettext not found
  dcfldd not found
  /data/data/com.termux/files/usr/bin/shred
  steghide not found
  /data/data/com.termux/files/usr/bin/resize2fs
  tomb-kdb-pbkdf2 not found
  qrencode not found
  swish-e not found
  unoconv not found
  /data/data/com.termux/files/usr/bin/applets/lsof
u0_a127@localhost ~ $ tomb dig -s 20 hello.tomb
tomb  .  Commanded to dig tomb hello.tomb
tomb (*) Creating a new tomb in hello.tomb
tomb  .  Generating hello.tomb of 20MiB
20+0 records in
20+0 records out
20971520 bytes (21 MB, 20 MiB) copied, 3, 5 MB/s
-rw------- 1 u0_a127 u0_a127 20M Dec 31 23:58 hello.tomb
tomb (*) Done digging hello
tomb  .  Your tomb is not yet ready, you need to forge a key and lock it:
tomb  .  tomb forge hello.tomb.key
tomb  .  tomb lock hello.tomb -k hello.tomb.key
u0_a127@localhost ~ $ tomb forge hello.key
mkdir: cannot create directory '/.gnupg': Read-only file system
touch: cannot touch '/.gnupg/pubring.gpg': No such file or directory

I think some variable was empty here, resulting in root paths.

tomb  .  Commanded to forge key hello.key with cipher algorithm AES256
tomb [W] This operation takes time. Keep using this computer on other tasks.
tomb [W] Once done you will be asked to choose a password for your tomb.
tomb [W] To make it faster you can move the mouse around.
tomb [W] If you are on a server, you can use an Entropy Generation Daemon.
512+0 records in
512+0 records out
512 bytes copied, 219, 0 kB/s
tomb (*) Choose the password of your key: hello.key
tomb  .  (You can also change it later using 'tomb passwd'.)
_sudo:2: command not found: gettext

At this point execution froze, and I eventually hit control-C. Same happened again below.

^Ctomb [E] Fatal error creating the temporary directory: /data/data/com.termux/files/usr/tmp/zsh
u0_a127@localhost ~ $ ls -al
drwx------  4 u0_a127 u0_a127 4.0K Dec  3 21:30 Tomb-2.5
drwx------ 18 u0_a127 u0_a127 4.0K Dec 30 01:23 e2fsprogs-1.44.4
-rw-------  1 u0_a127 u0_a127 7.3M Dec  5 23:00 e2fsprogs-1.44.4.tar.gz
-rw-------  1 u0_a127 u0_a127 471K Dec  5 22:31 e2fsprogs_1.44.4_arm.deb
-rw-------  1 u0_a127 u0_a127    1 Jan  1 00:10 hello.key
-rw-------  1 u0_a127 u0_a127  20M Dec 31 23:58 hello.tomb

It seems the key file was created but is only 1 byte long.

u0_a127@localhost ~ $ tomb lock -k hello.key hello.tomb
tomb  .  Commanded to lock tomb hello.tomb
_sudo:2: command not found: gettext

^Ctomb [W] Loop mount of volumes is not possible on this machine, this error
tomb [W] often occurs on VPS and kernels that don't provide the loop module.
tomb [W] It is impossible to use Tomb on this machine under these conditions.
tomb [E] Operation aborted.
u0_a127@localhost ~ $ ll

```console
u0_a127@localhost ~ $ tomb lock -k hello.key hello.tomb
tomb  .  Commanded to lock tomb hello.tomb
_sudo:2: command not found: gettext

^Ctomb [W] Loop mount of volumes is not possible on this machine, this error
tomb [W] often occurs on VPS and kernels that don't provide the loop module.
tomb [W] It is impossible to use Tomb on this machine under these conditions.
tomb [E] Operation aborted.

I don't like this final warning 😢

That's it. I can easily re-run it with verbose/debug options if you would like me to!

My dummy sudo script:

#!/usr/bin/env bash

while [ $# -ne 0 ]; do
  case $1 in
    --) shift; break ;;
    -*) shift ;;  # ignore all sudo options
  esac
done

exec "$@"

@Narrat
Copy link
Collaborator

Narrat commented Jan 3, 2019

Great working
findmnt is normally part of util-linux. gettext comes with gettext :D
But no support for loop kinda kills the thing :/

@pawamoy
Copy link
Author

pawamoy commented Jan 3, 2019

  • gettext installed with pkg install gettext
  • on my Debian 9, findmnt seems to come from the mount package. util-linux is installed in Termux, but no trace of findmnt. mount is not (yet?) installable in Termux.

Anyway, as you say, no loop support... Maybe @jaromil would have something to add on this matter?

I'm currently reading about Loop Device Support in Android. If I get anything interesting I'll tell you 🙂

Update: I might need to root my phone indeed. Or buy a new one :O

@jaromil
Copy link
Member

jaromil commented Jan 4, 2019

Nothing to add really... my understanding of Android is that is a very restrictive environment. They have reasons for that which I may share, but they have ways to do that which I do not agree with. However we are left with the tyranny of the few and not even f-droid sided with us when for zshaolin I compiled its own toolchain, so I do not see much future on running Tomb on android rly, be it the loopback limitation or anything else imposed at a toolchain level. Even if it would work on one version, it would be unreliable across different versions. Nowadays I simply do not consider Android a system that can handle my secure files, nor a system worth to develop apps on (zshaolin is basically discontinued). Sorry for the pesimistic remark, but that's what I think today, glad if anyone manages to change my mind because I did have some fun for a couple of years developing zshaolin and porting tomb to it...

@pawamoy
Copy link
Author

pawamoy commented Jan 4, 2019

Sorry for the pesimistic remark

No problem at all. I didn't know of zshaolin, it seems you did quite the work to bring a decent shell to android indeed, just like termux!

If I understood correctly what I read, it's still possible to have Loop Device Support on Android, but as you said, not reliably (not on all devices/OSes). I'll continue to try, maybe on friends' phones, also by rooting mine (if it's not already since I changed the OS). I simply cannot mimic my desktop environment on android if it is without Tomb.

@jaromil
Copy link
Member

jaromil commented Feb 20, 2019

@jaromil
Copy link
Member

jaromil commented Feb 20, 2019

take my android rant above with a grain of salt :^P if this thing works its great, I'll also consider keeping tombs on the phone. perhaps we can also pack an easy GUI later.

@pawamoy
Copy link
Author

pawamoy commented Apr 13, 2020

Closing since I don't think it will be possible before some (lengthy) time.

@pawamoy pawamoy closed this as completed Apr 13, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants