mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-11 13:07:49 +01:00
Krzysztof kuhy Rudnicki
2d4d2a2eb2
The network layer was the wrong place for this. Tested remotely today: opening RethinkDNS and switching off its device blocklists un-blocked YouTube in a few taps, and no device owner API can stop that -- an on-device filter app always owns its own rules. App hiding is different. 'pm unhide' from adb shell throws a SecurityException and the package stays hidden; only the device owner can reverse it, and reaching that costs a factory reset. So the block moves there, scoped to an explicit allowlist and the home geofence. Both whitelists are rewritten from the apps that actually exist on this phone. The old ones described the rooted Blackview. Every browser is excluded now, so at home a link does not open at all -- confirmed as intended. LAUNCHER_PACKAGE was still the Blackview's launcher, which is not installed here. The exporter refused to render the policy twice over it -- precisely what that check is for. The network layer stays a soft deterrent by choice: pinned and uninstall-blocked, but without lockdown, and its blocklists remain switchable. Private DNS is implemented but ships disabled. stunnel logged zero connections from the handset across two pin attempts, so the router does not forward 853. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014DqEd1uUhyT52KjaNeLanC
20 lines
2.1 KiB
JSON
20 lines
2.1 KiB
JSON
{
|
|
"title": "Move the YouTube block from the network layer to app hiding",
|
|
"objective": "The network layer was demonstrated bypassable on-device: opening RethinkDNS and switching off its blocklists un-blocks YouTube in a few taps, and no Device Owner API can freeze another app's internal settings. App hiding has no such hole -- `pm unhide` throws a SecurityException even from adb shell, and only the device owner can reverse it. Rebase enforcement on an explicit allowlist of the apps that must work, hidden by the home geofence, with the network layer demoted to an explicitly-labelled soft deterrent.",
|
|
"acceptance_criteria": [
|
|
"WHITELIST and NIGHT_WHITELIST contain exactly the apps the user named, mapped to package ids verified against `pm list packages -3` on the device.",
|
|
"Every browser is excluded from both lists, so no link opens while at home.",
|
|
"LAUNCHER_PACKAGE names a launcher that is actually installed; the exporter's launcher check passes.",
|
|
"The computed hide set is inspected on the PC before any pass runs, and contains no app needed for banking, calls, or SMS.",
|
|
"An enforcement pass on the device leaves newly-allowed apps hidden=false and non-allowlisted apps hidden=true.",
|
|
"Private DNS ships disabled while its host is unreachable, rather than pinning a resolver that would leave the phone with no DNS."
|
|
],
|
|
"out_of_scope": [
|
|
"Removing the in-app release path. A device owner with no escape hatch turns any single failure into a permanently bricked phone holding the user's banking and mObywatel.",
|
|
"VPN lockdown, switched off at the user's request in this pass.",
|
|
"Making RethinkDNS's own blocklists unswitchable, which Android provides no mechanism for.",
|
|
"Opening a public port for the DoT resolver; the router does not forward 853 and the exposure was reverted."
|
|
],
|
|
"verifier": "python -m pytest python_pkg/focus_policy/ (130 tests, 100% branch); gradlew :app:testDebugUnitTest; flutter test; the exporter's own launcher/allowlist guards; and on-device `dumpsys package <pkg> | grep hidden=` for both the allowed and the hidden sets after a pass."
|
|
}
|