divestos-build VS ubuntu-touch

DivestOS is my project.

Here are the nearly 200 kernel CVE patches applied on top of what Lineage provides for Pixel 2 series: https://gitlab.com/divested-mobile/divestos-build/-/blob/mas...

Plus it just provides updates quicker, such as the recent WebP CVE was first fixed in DivestOS before other aftermarket systems. https://divestos.org/pages/news

And provides rapid out-of-band WebView updates: https://divestos.org/misc/ch-dates.txt

See my other notes here: https://divestos.org/pages/patch_levels#osSecurity

And also this independent table: https://eylenburg.github.io/android_comparison.htm

See my issue at https://gitlab.com/divested-mobile/divestos-build/-/issues/18.

I'm pretty sure my DivestOS is far more free than Lineage and still completely usable: - https://divestos.org/pages/network_connections - https://gitlab.com/divested-mobile/divestos-build/-/blob/master/Scripts/Common/Deblob.sh

hammerhead died on 15.1 because no one could get Bluetooth to reliably work on later versions.

The support is in the form of all the features, the (system) updates, and kernel patches like this: https://gitlab.com/divested-mobile/divestos-build/-/blob/mas...

Developer told me how to add it back, but you will need to change the code a little and compile it (https://gitlab.com/divested-mobile/divestos-build/-/issues/18)

eg. https://gitlab.com/divested-mobile/divestos-build/-/blob/master/Scripts/LineageOS-18.1/CVE_Patchers/android_kernel_oneplus_msm8996.sh

In the case of taimen/walleye, besides the base system hardening, there are over ~70 additional CVE patches to the kernel: https://gitlab.com/divested-mobile/divestos-build/-/blob/master/Scripts/LineageOS-19.1/CVE_Patchers/android_kernel_google_wahoo.sh

I've had another report of this and I've reverted what is likely the cause, new builds will be up in a few hours. https://gitlab.com/divested-mobile/divestos-build/-/commit/dc392b17b6d5661246c98277809475a74565ad3a

This is already fixed, pending the next builds: https://divestos.org/index.php?page=news-future https://gitlab.com/divested-mobile/divestos-build/-/commit/7a168302cfb14a516ec744daff31cfa11bc1d50f

Ubuntu Touch, for example, does not support Full Disk Encryption, when Android has moved on from Full Disk Encryption to File-Based Encryption. Android utilises SELinux in enforcing mode for Mandatory Access Control even for root/superuser processes. Sandboxing with Flatpak cannot compare to the OS-level app sandboxing done on Android and iOS. Permission management on Flatpak is good, but still not as advanced as Android or iOS. On phones, (real) Linux is quite easily outclassed in security when compared to Android.

For those seeking a change https://ubports.com/

It still uses many of the Android components via Halium on traditional Android devices which end up unpatched and for devices not with a mainline kernel use outdated vendor kernels. https://github.com/ubports/ubuntu-touch/issues/1566

I'd suggest taking a look at contributing to existing efforts like UBPorts

Ubuntu Touch doesn't even have encryption and ships kernels with many known security issues: https://github.com/ubports/ubuntu-touch/issues/178

Fyi, the project isn't dead, it is just not developed by Canonical anymore: https://ubports.com/

There is already Ubport https://ubports.com/ project that is supporting Ubuntu for smartphones and guides you to compile debian with all the phone functionalities. Some parts of modem abstraction layer on the Linux (below radio Interface layer) will still be not openesource and i would say it won't be easy to get this source.