The Importance of Open Source in Root

Root. It's a word we're mostly familiar with here. Despite the ever-increasing attempts by Google to make it harder to achieve and use (and most likely this will continue, with the predicted convergence of the heavily locked-down ChromeOS and Android platforms), rooting remains incredibly popular on XDA.

Indeed, an entire ecosystem has formed around it, and apps which make use of the elevated access offered by root to realise customisations and modifications which would otherwise be prevented by Android's security model.

Many years of changes made to Android to make gaining root more difficult

When customisation of Android first began to gain traction in 2008 and 2009, the first "real" customisable Superuser solution was by Retired Recognized Developer, ChainsDD. This allowed people to control which apps had access to root, and which ones didn't, through a graphical user interface, which was the precursor of what we know today. The source code of the application and su binary are still available if you want to take a look at it.

 Fast forward, and step through many years of changes made to Android to make gaining root more difficult, both for malicious software, and for users, a lot has changed. Indeed, it's currently necessary (at least on Android 6.0) to make changes to a device's kernel ramdisk (boot.img), meaning that root on a device without an unlocked bootloader is something you likely won't be seeing root any time soon.

Nonetheless, until recently, your root option was pretty much SuperSU. Which was a big improvement upon the older root solutions, which didn't handle the new and modern complexities like SELinux policies and constraints. The only problem was that SuperSU was (and is) closed-source, non-free software. As the gatekeeper to what amounts to absolute control over your phone, this is something which really ought to be open source, and auditable. Until now though, most people just trusted XDA Senior Recognized Developer, Chainfire, to do the right thing.

The problem reared its head, though, when (during the Android I/O announcement of the new Nexus handsets), Chainfire announced the acquisition of SuperSU by an unknown, and unrelated third party. The problem here is that for something as important as root access, it's really important that users trust it – imagine if your Superuser application was configured to allow certain apps to have silent access to root, without you knowing. The developer could do this for their own applications, or for other developers that paid for this access. Nothing suggests this has happened or would happen, but it remains a possibility for a closed source Superuser solution. Alternatively, it could start to show intrusive adverts. You'd really have little option to block those, since it has root access!

"Regardless of which root solution you do use, having a fully open source version available is incredibly important"

Fortunately though, in the spirit of XDA, a group of users have converged to attempt to create a true, modern, Superuser solution, which will be fully open source, and developed by the community. This, once completed, will give users a choice between using a proprietary root solution from a new company of unknown reputation, and one which is open and transparent, and developed by the community.

A choice never hurts anyone, and when it comes to root access, having more than one choice is essential for your security and privacy

Regardless of which root solution you do use, though, having a fully open source version available, as a strong alternative to any commercial or proprietary offerings, is incredibly important. It actually will benefit users of the proprietary one as well — the mere presence of a viable alternative is essential in ensuring that the developers and new (unknown and currently untrusted) owners of SuperSU act in the public interest. With no alternative, there's nowhere to go if they act with impunity. On the other hand, with a strong open-source alternative, there's a strong incentive to act in the interests of users, rather than risk significant reputational damage, and see an exodus of users elsewhere.

For that reason, I encourage anyone with the relevant skills to get involved in the open source project. To have a community-led, high-quality Superuser solution, which is based on entirely open-source software, will be beneficial to the whole community, including those who want to keep using SuperSU. A choice never hurts anyone, and when it comes to root access, having more than one choice is essential for your security and privacy. Development is in the early stages, and is ongoing on Github, with the patches to the boot images being discussed in the issues section of this repository, and the Superuser app itself being developed in this repository.

Why not get involved in the discussion or get involved in the development, by joining the discussion thread on the forums? Let's make a truly community-led, open-source, auditable Superuser solution, and ensure there's always going to be the option to use entirely open-source software to gain and control root access on your phone.

 

source: xdadevelopers