rooted-graphene

Verified boot does indeed make this more complicated, but it's totally possible to build Graphene with your own signing key and get full control over the OS that way (i.e. https://github.com/schnatterer/rooted-graphene). Looking at their public statements on the matter, it seems like the problem isn't exactly that they treat the user as a potentially hostile actor so much as that they treat the system UI and persistent storage as a potentially hostile actor (though I admit from a practical perspective that's nearly the same thing): https://www.reddit.com/r/GrapheneOS/comments/13264di/is_root... I wonder how they'd feel about something like protected confirmation to enable sudo: https://source.android.com/docs/security/features/protected-...

All of this has already been explained to fsflover in detail numerous times, but for any onlookers here are some of the project's thoughts on the subject of hardware attestation: https://grapheneos.social/@GrapheneOS/116550899908879585 https://attestation.app/about On the subject of root, it completely breaks the security model of the OS, and for very valid reasons they have no interest in having official installations with widely varying security models. They also have no opposition to people creating their own forks to do so, and they publish comprehensive build instructions: https://grapheneos.org/build Lo and behold: https://github.com/schnatterer/rooted-graphene

Ah, you're right: https://github.com/schnatterer/rooted-graphene I stand corrected. Still, as you say, less point in it since it breaks their security model.

As someone who cherishes the power of root privs, I'd still like to make a point for alternative solutions that came up like distros such as GrapheneOS or CalyxOS or non-root filtering options via VPN. If it weren't for backups I could manage my everyday life without root. For all other cases I would root and later unroot my phone via an OTA update :D https://github.com/schnatterer/rooted-graphene/ Hopefully GrapheneOS deliver on their promise to provide a better backup solutions than seedvault.