1503d660d2
The approach of using 100vh interacts poorly with how Chromium and Safari calculate the viewport height on mobile. They include their navigation bar as part of the viewport height from the start to avoid dynamic changes to the viewport site.
156 lines
11 KiB
HTML
156 lines
11 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en" prefix="og: http://ogp.me/ns#">
|
|
<head>
|
|
<meta charset="utf-8"/>
|
|
<title>GrapheneOS</title>
|
|
<meta name="description" content="GrapheneOS is a security and privacy focused mobile OS with Android app compatibility."/>
|
|
<meta name="theme-color" content="#212121"/>
|
|
<meta name="msapplication-TileColor" content="#ffffff"/>
|
|
<meta name="viewport" content="width=device-width, initial-scale=1"/>
|
|
<meta name="twitter:site" content="@GrapheneOS"/>
|
|
<meta name="twitter:creator" content="@GrapheneOS"/>
|
|
<meta property="og:title" content="GrapheneOS"/>
|
|
<meta property="og:description" content="GrapheneOS is a security and privacy focused mobile OS with Android app compatibility."/>
|
|
<meta property="og:type" content="website"/>
|
|
<meta property="og:image" content="https://grapheneos.org/opengraph.png"/>
|
|
<meta property="og:image:width" content="512"/>
|
|
<meta property="og:image:height" content="512"/>
|
|
<meta property="og:image:alt" content="GrapheneOS logo"/>
|
|
<meta property="og:url" content="https://grapheneos.org/"/>
|
|
<meta property="og:site_name" content="GrapheneOS"/>
|
|
<link rel="icon" type="image/vnd.microsoft.icon" href="/favicon.ico"/>
|
|
<link rel="mask-icon" href="/safari_pinned_tab_icon.svg" color="#000000"/>
|
|
<link rel="stylesheet" href="/grapheneos.css?13"/>
|
|
<link rel="manifest" href="/manifest.webmanifest"/>
|
|
<link rel="canonical" href="https://grapheneos.org/"/>
|
|
</head>
|
|
<body>
|
|
<nav>
|
|
<ul>
|
|
<li class="active"><a href="/">GrapheneOS</a></li>
|
|
<li><a href="/install">Install</a></li>
|
|
<li><a href="/build">Build</a></li>
|
|
<li><a href="/usage">Usage</a></li>
|
|
<li><a href="/releases">Releases</a></li>
|
|
<li><a href="/source">Source</a></li>
|
|
<li><a href="/donate">Donate</a></li>
|
|
<li><a href="/contact">Contact</a></li>
|
|
</ul>
|
|
</nav>
|
|
<div id="content">
|
|
<h1 id="grapheneos">
|
|
<a href="#grapheneos">GrapheneOS</a>
|
|
</h1>
|
|
<p>GrapheneOS is an open source privacy and security focused mobile OS with Android
|
|
app compatibility.</p>
|
|
<p>Official Releases are available on the <a href="/releases">releases page</a> and
|
|
installation instructions are on the <a href="/install">install page</a>.</p>
|
|
<p>See the <a href="https://github.com/GrapheneOS">GitHub organization</a> for sources
|
|
of the OS and various standalone sub-projects including the cutting edge
|
|
<a href="https://github.com/GrapheneOS/hardened_malloc/blob/master/README.md">new
|
|
hardened memory allocator</a> and other projects.</p>
|
|
<p>The official GrapheneOS releases are supported by the
|
|
<a href="https://github.com/GrapheneOS/Auditor/releases">Auditor app</a> and
|
|
<a href="https://attestation.app/">attestation service</a> for hardware-based
|
|
attestation. For more details, see the <a
|
|
href="https://attestation.app/about">about page</a> and <a
|
|
href="https://attestation.app/tutorial">tutorial</a>. You can also extend these with
|
|
support for your own builds.</p>
|
|
<p>The sources are available via the
|
|
<a href="https://github.com/GrapheneOS/platform_manifest">manifest on GitHub</a>.</p>
|
|
<h2 id="early-stage-of-development">
|
|
<a href="#early-stage-of-development">Early stage of development</a>
|
|
</h2>
|
|
<p>GrapheneOS is a privacy / security research and engineering project that has been
|
|
under way for over 5 years. It recently became rebranded as GrapheneOS and is taking a
|
|
different direction based on obtaining funding for the research and development work
|
|
as a non-profit open source project rather than being a company. The reborn project is
|
|
still in a very early stage and lots of the past work on privacy and security has not
|
|
yet been restored for the new incarnation of the OS.</p>
|
|
<p>The grapheneos.org site is very new and is currently being put together. It will
|
|
have lots of additional documentation and tutorials in the future along with coverage
|
|
of various software, firmware and hardware privacy/security topics.</p>
|
|
<p>GrapheneOS is being supported with funding and developers from various companies
|
|
and other organizations interested in contributing to this shared base for a feature
|
|
rich private and secure mobile operating system able to run many existing
|
|
applications. It will take more time to organize and deploy these resources in order
|
|
for the project to have a strong development team with proper infrastructure behind
|
|
it.</p>
|
|
<h2 id="roadmap">
|
|
<a href="#roadmap">Roadmap</a>
|
|
</h2>
|
|
<p>Details on the roadmap of the project will be posted on the site in the near
|
|
future. In the long term, it aims to move beyond a hardened fork of the Android Open
|
|
Source Project. Achieving the goals requires moving away from relying the Linux kernel
|
|
as the core of the OS and foundation of the security model. It needs to move towards a
|
|
microkernel-based model with a Linux compatibility layer, with many stepping stones
|
|
leading towards that goal including adopting virtualization-based isolation.</p>
|
|
<p>The initial phase for the long-term roadmap of moving away from the current
|
|
foundation will be to deploy and integrate a hypervisor like Xen to leverage it for
|
|
reinforcing existing security boundaries. Linux would be running inside the virtual
|
|
machines at this point, inside and outside of the sandboxes being reinforced. In the
|
|
longer term, Linux inside the sandboxes can be replaced with a compatibility layer
|
|
like gVisor, which would need to be ported to arm64 and given a new backend alongside
|
|
the existing KVM backend. Over the longer term, i.e. many years from now, Linux can
|
|
fade away completely and so can the usage of virtualization. The anticipation is that
|
|
many other projects are going to be interested in this kind of migration, so it's not
|
|
going to be solely a GrapheneOS project, as demonstrated by the current existence of
|
|
the gVisor project and various other projects working on virtualization deployments
|
|
for mobile. Having a hypervisor with verified boot still intact will also provide a
|
|
way to achieve some of the goals based on extensions to Trusted Execution Environment
|
|
(TEE) functionality even without having GrapheneOS hardware.</p>
|
|
<p>Hardware and firmware security are core parts of the project, but it's currently
|
|
limited to research and submitting suggestions and bug reports upstream. In the long
|
|
term, the project will need to move into the hardware space.</p>
|
|
<h2 id="device-support">
|
|
<a href="#device-support">Device support</a>
|
|
</h2>
|
|
<p>In the current early stage of the project, GrapheneOS provides production releases
|
|
for the Pixel, Pixel XL, Pixel 2, Pixel 2 XL, Pixel 3, Pixel 3 XL, Pixel 3a and Pixel
|
|
3a XL. It will support other devices in the future, but devices are carefully chosen
|
|
based on their merits rather than the project aiming to have broad device support.
|
|
Broad device support is counter to the aims of the project, and the project will
|
|
eventually be engaging in hardware and firmware level improvements rather than only
|
|
offering suggestions and bug reports upstream for those areas. Much of the work on the
|
|
project involves changes that are specific to different devices, and officially
|
|
supported devices are the ones targeted by most of this ongoing work. GrapheneOS also
|
|
has source level support without device-specific hardening for the Android emulator,
|
|
HiKey, HiKey 960 and also generic targets providing basic support for many other
|
|
devices.</p>
|
|
<p>Devices need to be meet the standards of the project in order to be considered as
|
|
potential targets. In addition to support for installing other operating systems,
|
|
standard hardware-based security features like the hardware-backed keystores, verified
|
|
boot, attestation and various hardware-based exploit mitigations need to be available.
|
|
Devices with support for alternative operating systems as an afterthought will not be
|
|
considered. Devices need to have proper ongoing support for their firmware and
|
|
software specific to the hardware like drivers in order to provide proper full
|
|
security updates too. Devices that are end-of-life and no longer receiving these
|
|
updates will not be supported.</p>
|
|
<p>In order to support a device, the appropriate resources also need to be available
|
|
and dedicated towards it. Releases for each supported device need to be robust and
|
|
stable, with all standard functionality working properly and testing for each of the
|
|
releases.</p>
|
|
<p>Hardware, firmware and software specific to devices like drivers play a huge role
|
|
in the overall security of a device. The goal of the project is not to slightly
|
|
improve some aspects of insecure devices and supporting a broad set of devices would
|
|
be directly counter to the values of the project. A lot of the low-level work also
|
|
ends up being fairly tied to the hardware.</p>
|
|
<p>Some of the GrapheneOS sub-projects support other operating systems on a broader
|
|
range of devices. Device support for Auditor and AttestationServer is documented in
|
|
the <a href="https://attestation.app/about">overview of those projects</a>. The
|
|
<a href="https://github.com/GrapheneOS">hardened_malloc</a> project supports nearly
|
|
any Linux-based environment due to official support for musl, glibc and Bionic along
|
|
with easily added support for other environments. It can easily run on non-Linux-based
|
|
operating systems too, and supporting some like HardenedBSD is planned but depends on
|
|
contributors from those communities.</p>
|
|
</div>
|
|
<footer>
|
|
<a href="/"><img src="https://grapheneos.org/logo.png" width="512" height="512" alt=""/>GrapheneOS</a>
|
|
<ul id="social">
|
|
<li><a href="https://twitter.com/GrapheneOS">Twitter</a></li>
|
|
<li><a href="https://github.com/GrapheneOS">GitHub</a></li>
|
|
</ul>
|
|
</footer>
|
|
</body>
|
|
</html>
|