- Ukuqaliswa kohlelo lokubonakala oluyi-granular oluthatha indawo ye-monolithic security patch ngokuhlaziywa okusekelwe kwizakhi.
- Ikhono lokuhlola ubuthakathaka obuthile ngokuhlanganiswa nesizindalwazi se-OSV kanye nokulandelela ama-CVE.
- Ukulungiswa kokuxhumana phakathi kwabakhiqizi nezinhlelo zokusebenza ngokusebenzisa uMhlinzeki Wezokuphepha ukuze kuphathwe izibuyekezo ze-OTA.
Ukugcina ifoni ye-Android iphephile kulezi zinsuku, empeleni, kuyindaba ebuhlungu ngempela. Njengoba uhlelo lwe-ecosystem seluyinkimbinkimbi, abathuthukisi babevame ukuthembela kumethrikhi evamile ebizwa ngokuthi i-Security Patch Level (SPL), okwakufana nokuzama ukuthola ukuthi indlu iphephile yini ngokubheka kuphela usuku lokuvuselelwa okukhulu kokugcina, ngaphandle kokwazi ukuthi ukhiye womnyango wangemuva usaphukile yini.
Ukuze kuxazululwe lesi sikhala solwazi, imitapo yolwazi ye -AndroidX Security State kanye ne-Security State Provider isifikile . Lawa mathuluzi ashintsha umdlalo, anikeza ukubonakala okuningiliziwe kuwo wonke amagumbi esistimu, okwenza isofthiwe ikwazi ukumelana nokuhlaselwa futhi ivumela izinhlelo zokusebenza ukuthi zenze izinqumo ezihlakaniphile ngokusekelwe ebufakazini bangempela, hhayi nje ekucabangeni, ngaleyo ndlela kusungulwe imodeli yokungathembani nhlobo.
Sala kahle ku-single patch: inkathi yobuningi
Inkinga enkulu ngokuthembela ku-SPL eyodwa ukuthi i-Android manje isibuyekezwa kancane kancane ngenxa yezibuyekezo zesistimu ye-Project Mainline kanye ne-Google Play. Ukuze kulungiswe lokhu kuphazamiseka, imitapo yolwazi emisha ihlukanisa ukuphepha ibe yizinsika ezintathu: uhlelo lokusebenza oluyinhloko (olubuyekeziwe emoyeni), amamojula esistimu (alethwa nge-Google Play), kanye ne -Linux kernel , okuyisisekelo sayo yonke into futhi ilinganiswa kusetshenziswa izinguqulo ze-LTS kunezinsuku zokukhishwa zanyanga zonke.
Kuzo zonke lezi zingxenye, kungabhekwana nezimo ezintathu ezahlukene, okunikeza isithombe esiphelele salesi simo:
- I-SPL Yedivayisi (DSPL): Ibonisa ukuthi yini efakiwe futhi esebenza kudivayisi ngaleso sikhathi, ngaphandle kokudinga uxhumano lwe-inthanethi.
- I-SPL eshicilelwe (PSPL): Imelela inguqulo yakamuva kakhulu eshicilelwe ngokusemthethweni ebhukwini lezokuphepha le-Android.
- I-SPL (ASPL) etholakalayo: Kwembula ukuthi ngabe kukhona yini isibuyekezo esivele silandiwe noma esilungele ukufakwa ngendlela yokuxhumana phakathi kwezinqubo (i-IPC).
Ukulawulwa kobungozi kanye nokuhlolwa kwe-CVE
Enye yezinto eziyigugu kakhulu ukuhlanganiswa nesizindalwazi se- Open Source Vulnerability (OSV) . Akusekho ukuqagela okuhilelekile ekunqumeni ukuthi i-patch yenyanga ethile iyalungisa yini ubuthakathaka obuthile; manje kungenzeka ukulandelela ama-CVE athile ngokuhlelekile .
Lokhu kuyigugu elimsulwa lezinhlelo zokusebenza ze-fintech, zebhange, noma zezempilo, njengoba zingakhawulela ukudluliselwa kwenani eliphezulu noma ukufinyelela kudatha ebucayi uma zithola ukuthi kukhona ubuthakathaka obukhulu be-Bluetooth noma be-NFC obusasebenza kudivayisi. Isibonelo, amaphutha afana nokubhala okungaphandle kwemingcele ku-libimagecodec.quram.so kungavumela abahlaseli abakude ukuthi basebenzise ikhodi engahleliwe, baphendule idivayisi endala ibe yi- backdoor ibe amanethiwekhi ezinkampani.
Implementación técnica y flujo de trabajo
Ukuze lokhu kuqalise ukusebenza, unjiniyela kumele engeze ukuncika androidx.security:security-state:1.1.0 kufayela lakho le-Gradle. Ukuqalisa kulula futhi kudinga umongo we-Android, yize isivinini singathuthukiswa ngokudlulisela umbiko wobuthakathaka ngefomethi ye-JSON ngqo kumakhi. I-SecurityPatchState.
Umsebenzi wokuhlola ngokuvamile uhlukaniswe ngezinhlobo ezintathu zokuhlola:
- Ukuqinisekiswa okuvumelanayo: Zisetshenziswa ukuhlola i-DSPL lapho uhlelo lokusebenza luqala bese luqhathaniswa nosuku oluyisisekelo oluyimpoqo.
- Imibuzo engavumelani: Ngokusebenzisa
fetchAvailableSecurityPatchLevelUhlelo lokusebenza lungazisa umsebenzisi ukuthi kukhona isibuyekezo esilindile bese lumqondisa kabusha kuzilungiselelo. - Ukuhlolwa okujulile: cunt
queryAllAvailableUpdatesUngahlaziya ubusha bedatha bese uthola ukuthi yimuphi umhlinzeki wokuvuselela ophendulayo.
Kubalulekile ukuqaphela ukuthi ukwesekwa kuyahlukahluka kuye ngenguqulo yesistimu. Ngenkathi i-Android 11 kanye neyakamuva inikeza ukwesekwa okugcwele, i-Android 10 ayinayo ukwesekwa okusemthethweni kwe-kernel, futhi ezinguqulweni ezingu-9 nangaphambilini, lapho amamojula e-Project Mainline ayengekho khona, uhlelo lubuyisela usuku lwe -Unix (1970-01-01) ngokuzenzakalelayo.
Indima yoMhlinzeki Wezokuphepha kanye nezici ezintsha ku-Android 17
Ukuze lonke lolu hlelo lusebenze, othile kufanele amemezele ukuthi izibuyekezo ziyatholakala. Yilapho umhlinzeki we-Security State engena khona , ebeka izindinganiso zendlela amaklayenti okubuyekeza abika ngayo ku-ASPL. Ngaphambilini, ulwazi lwe-OTA lomkhiqizi ngamunye lwaluvalelwe kuma-silos azimele; manje, noma yiluphi uhlelo lokusebenza olugunyaziwe lungafinyelela idatha kungakhathaliseki ukuthi uhlobo luni lwefoni.
Ngaphezu kwalokho, i-Android 17 yethule intuthuko enamandla kubakhiqizi (ama-OEM) ngefayela le-Supplemental Patches XML . Lokhu kubavumela ukuthi bamemezele ukulungiswa kwabo kokuphepha okusetshenzisiwe ngaphandle kokulinda ukukhishwa kwe-SPL yomhlaba wonke, okuqinisekisa ukuthi imizamo eqhubekayo yokulungisa iyaqashelwa ngokushesha nokuthi idivayisi ayibonakali isengozini ngisho nangemva kokuba isivikelwe.
Amanye amathuluzi ohlelweni lwezokuphepha lwe-AndroidX
Ngale kwesimo sesistimu, kunezinye izingxenye ezibalulekile. Umtapo wolwazi we-security-crypto ubalulekile ekuphatheni okhiye kanye nokubethela amafayela noma ama-SharedPreferences. Nakuba ezinye izinguqulo ze-JetSec seziphelelwe yisikhathi, kungcono ukungasebenzisi ngokweqile isitoreji sedatha ebucayi, njengoba imodeli ye-sandbox ye-Android kanye nokubethela okusekelwe kumafayela sekuvele kuqinile kakhulu.
Okunye okuphawulekayo yi- security-app-authenticator , eyenza kube lula ukuqinisekisa ukuthembeka kohlelo lokusebenza ngokusekelwe ebunikazini balo bokusayina. Isebenzisa i-XML enamagama ephakheji kanye nobunikazi, umtapo wolwazi uqinisekisa ukuthi izinhlelo zokusebenza ezisemthethweni kuphela ezingasebenzisana nezingxenye zesistimu ezibalulekile.
Ukushintshela ekuhlolweni okuningiliziwe kwezinga lezingxenye, ikhono lokuhlola ama-CVE nge-OSV, kanye nokulungiswa kwezibuyekezo ze-OTA kwenza i-AndroidX Security State ibe yindinganiso yegolide yokuphepha kweselula okuthuthukisiwe. Ngokuhlanganisa la mathuluzi, imisebenzi ebalulekile iba namandla, futhi abasebenzisi bokugcina bahlala bevikelwe ezinsongweni zakamuva endaweni yedijithali.