[Galaxy S 4 Developer Discussion [Developers-Only]] Absolon:
Hi,

I try to be as brief as I can but I'm known to write "walls of text". Please, I really try to write differently but it always ends up with at least one A4...

I need some input from you who have vastly more knowledge then me, I have a few pondering's that I need to ask if they hold or not.

As you know I'm "rusty" in my knowledge so I have been reading up. Especially on SELinux.

I have a Note 3 that is plain vanilla and 2 days ago I got an "SELinux rules update #16". Didn't know how to take a screen pic of it. Sorry.

Did anybody else get that? I didn't even saw that there was a way to turn it on/off.

I know that SELinux is a bunch of text-files. It's making a MAC-solution for the kernel and can hinder you from accessing parts in system-space.

If can control all vital functions in user-space, including fs, files, sockets, network, processes and run own processes without disclosing them to

you as a user. They are simple text-rules. Pretty straight forward.

Made a "wall of text" -- > http://xdaforums.com/showpost.php?p=48287600&postcount=1392 again.

I'm sorry if I c/p some from that, you can just sift it through if you feel for it

This is from their own White-paper on Knox:

Secure Boot requires the device boot loader, kernel, and system software to be cryptographically signed

by a key verified by the hardware. Secure Boot uses X.509 certificates and public keys which are embedded

into the boot loader of the device. A secure hash of the certificates is fused into hardware Read-Only

Memory (ROM) at the time of manufacture. The Secure Boot loader will only continue if the authorized

secure signed binaries are present. Next, Secure Boot verifies the cryptographic signature of the Linux

kernel and system image before handing control to the OS.

So they boot-loader contains the SELinux and it won't boot if it's not verified for a cert in your phone.

This has been planned for a long time.

Since I don't have any I9505 but and I9506 (that only has one bootloader so far. Knoxed) I need to ask a few questions to see if my assumptions hold or not.

Q1: Is it true that if you upgrade to a Knox-bootloader never can downgrade?

Q2: If you trip the Knox-flag can you do that or is it still impossible?

Q3: Can you while already having a Knox-bootloader downgrader WITHIN the Knox-bootloaders?

Good and bad

Bad: They can have your Prog->serial that you signed in your store->You. Sinister, as I think Knox is this is bad.

Good: It's still a PROM. There might be some way to read from it. Next year Knox is totally integrated on a chip, black boxed, WITH E-FUSE.

Then we are toast and can all buy a HTC...

If Q1 holds then you always have a boot with SELinux. The bootloader fit's a kernel just fine, right?

I get a strange error on my phone. It's saying I have space left on my device but when I try to download from Play it says I'm out of space.

Q4: Is this a know bug? Is this software? Have anyone had it before Knox?

I took and started to read a bit on Wikipedia. It's good sometimes for quick info: Selinux,

So it's a container basically. I also stumbled over this baby: NSA SEAndroid

So this leads me to some other questions.

Q5: Could it be possible that the device is virtualized?

Q6: Do we have some programs that can go deep into the system and pick up system info?

Q7: Does all custom kernels work after the Knox (with the flag tripped of course). Where are they loaded? The bootloader or somewhere else?

It's hard to know if you ARE virtualized but not impossible so there need to be some comparison between a pre-knox and knoxed device. I don't own any.

So I ask here is anyone does?

Q7: Has someone verified that it refuses to boot the pre-Knox bootloaders with or without trippning the flag?

Because it would make perfect sense. We have the hardware for it for sure. They are still chit-chatting about their bootloaders and warranty and that is

something I don't have to care about since I have written permission to flash away, as much I want from my cell-provider.

So I don't know if this is just a wild theory of mine or not but I started to wonder why the enforcement and the total lockout when it comes to the bootloader.

If what they also say in the White paper is true then there is no way that we CAN make a non-Knox boot, can we?

Privacy wise this is also a catastrophe. They can connect the device directly to you, with targeting, for instance, a grouping of some kind. Good or bad.

Up to the ones that controls the phone, right?

So sorry for maybe obvious questions but I though that here, if anywhere, if the place to asked them.

Oh, another thing, I stumped over this one when I was researching why my Windows was desperately making contact with the standard 6to4 replay

that there is a written about. I see that it does that over and over (among trying to make a tunnel through ICMP when you turn on Skype). Caught them on that.

This one: Geoip Locator

How does it show at your place? I've turned off all my localisation platforms. Hard. I even run behind a VPN.

But when I run it in Chrome (where I should have it turned off and are behind a VPN it's waaay to close).

In FF you can turn it off with the about:config --> geo.* and put the value to false the the address to localhost.

But I did the same in Chrome but it's still leaking.

When it comes to IE. If you have your "Localisation policy" set to "ON" you can turn it off in IE. If you disable it it's greyed out (I have Win 8.1).

Think I'll soon move to BSD totally....

All the best,

Abs