[Android Software Development] barryflanagan:
Running Linux-on-Android as non root

Long post, but bear with me - I think it will be worth it!

If there is one thing that really bugs me is that the vnc and the desktop run as root. This is not just the case with this project, but all the other chroot solutions I have looked at. It's just plain wrong, and a security nightmare. There must be a better way!

So, after a good bit of hacking around I have worked out how to make things right. I am now happily running my 12.04 ubuntu as my own self, rather than root. Everything appears to work fine, although I still have the issue with Firefox crashing and Chromium not showing any text.

I have documented my changes and created a script which, if run within the chroot shell, will set things up so that you can run your desktop as the "ubuntu" user - I chose this user because it is already installed and it will allow the images to be distributed with a default user ready to run.

I'll attach the system changes part as a file as well so you can run it directly within your ubuntui chroot. Save it to your /sdcard and then inside the chroot just type "sh /sdcard/runasubuntu.txt"

NOTE I did this on the 12.04 Ubuntu Full v1 image. I am sure it will work the same on any of the other Ubuntu images (and the Debian one with little adjustment) but I have not tested it.

#

# SYSTEM CHANGES

#

# In the chroot shell, run the following commands. Lines beginning with # are

# comments, anything else should be run in the chroot root terminal.

#

#

# There are some directorys and things which are not set up correctly.

# We need to fix these

# These two files need to be world writable (standard on Linux)

chmod a+rw /dev/null

chmod a+rw /dev/ptmx

# /tmp and /dev/shm need the sticky bit set and be world rwx (again, standard on Linux)

chmod 1777 /tmp

chmod 1777 /dev/shm

# Get sudo working for user ubuntu (needs to be suid root in order to work)

# Again, this is standard

chmod +s /usr/bin/sudo

# The below are special groups in Android which allow a user to have Net and BT access

# No idea whether any BT stuff will work, but no harm!

#

# the user should be added to those groups 3001 (bt), 3002 (bt-net), 3003 (inet), 3004 (net raw):

# But first we need to create the groups in the chroot

groupadd -g 3001 android_bt

groupadd -g 3002 android_bt-net

groupadd -g 3003 android_inet

groupadd -g 3004 android_net-raw

# For some reason the /var/run/dbus directory is missing. Once it is there, the dbus socket

# does get correctly created, although dbus does not appear to fully work still. Still, no harm having

# it right. I also added the messagebus user to the Android groups, because permissions to use

# sockets appear to be tied to the android_inet group.

mkdir /var/run/dbus

chown messagebus.messagebus /var/run/dbus

chmod 755 /var/run/dbus

usermod -a -G android_bt,android_bt-net,android_inet,android_net-raw messagebus

# Edit /etc/fstab so that the shm dev gets mounted. shm also does not appear to work

# correctly even though the kernel is compiled with it enbled. However, you can see it

# being used by certain apps

echo "shm /dev/shm tmpfs nodev,nosuid,noexec 0 0" >> /etc/fstab

#

# Change ubuntu user so we can log in as this user.

#

# first, make a copy of the /root/.vnc directory to /home/ubuntu and make it all owed

# by ubuntu

cd /root

tar cf - .vnc |(cd /home/ubuntu ; tar xf -)

chown -R ubuntu.ubuntu /home/ubuntu

# Give the ubuntu user a password (you will need this in order to use sudo)

echo

echo "We need to give the ubuntu user a password"

echo

echo "Please enter the new password below"

echo

passwd ubuntu

# Now, add to the admin group so this user can use sudo

usermod -a -G admin ubuntu

# Finally, we need to add the ubuntu user to the special Android groups, so that this user has

# permission to access the Internet and other sockets.

usermod -a -G android_bt,android_bt-net,android_inet,android_net-raw ubuntu

## End of SYSTEM CHANGES ##

#

# CHANGES to /root/init.sh

#

# Inside the ubuntu chroot, edit the file /etc/init.sh and make the changes below

#

# Add the following line to init.sh under the "Tidy up" section to remove the reboot-required

# flags from /var/run which get created sometimes when you do an update. It stops the

# notice coming up in the panel telling you a reboot is required.

rm /var/run/reboot-required* > /dev/null 2>&1

# Rather than having root run the vncserver, we are going to change this so that

# the vncserver is run by the user ubuntu. To do this, edit the line containing

# "vncserver :0 -geometry $REZ" to be:

su ubuntu -l -c "vncserver :0 -geometry $REZ"

# Change the line at the bottom of init.sh containing "vncserver -kill :0" to be

su ubuntu -c "vncserver -clean -kill :0"

#... this will remove the /home/ubuntu/.vnc/localhost* files at the end of the session

## END of init.sh Changes

That's it! Now if you exit out of the ubuntu chroot, and then run "sh ubuntu.sh" again, you will be logged in as the ubuntu user instead of root!

I have tested this by taking a fresh ubuntu.img and applying the script and it worked fine. Very interested in feedback and whether it works for anyone else, or breaks anything!

I think this would be a very good addition to the Linux on Android images.