You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Licensed under the Apache License, Version 2.0 (the "License");
5
+
# you may not use this file except in compliance with the License.
6
+
# You may obtain a copy of the License at
7
+
#
8
+
# http://www.apache.org/licenses/LICENSE-2.0
9
+
#
10
+
# Unless required by applicable law or agreed to in writing, software
11
+
# distributed under the License is distributed on an "AS IS" BASIS,
12
+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13
+
# See the License for the specific language governing permissions and
14
+
# limitations under the License.
15
+
#
16
+
#
17
+
18
+
# if this fails with a warning about java version incompatibility, add a parameter after ./gradlew to change the java home, to a version that works: -Dorg.gradle.java.home=/Library/Java/...
19
+
20
+
./gradlew antipiracy:assembleRelease --warning-mode all
21
+
./gradlew rooting:assembleRelease --warning-mode all
22
+
./gradlew integrity:assembleRelease --warning-mode all
# Licensed under the Apache License, Version 2.0 (the "License");
5
+
# you may not use this file except in compliance with the License.
6
+
# You may obtain a copy of the License at
7
+
#
8
+
# http://www.apache.org/licenses/LICENSE-2.0
9
+
#
10
+
# Unless required by applicable law or agreed to in writing, software
11
+
# distributed under the License is distributed on an "AS IS" BASIS,
12
+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13
+
# See the License for the specific language governing permissions and
14
+
# limitations under the License.
15
+
#
16
+
#
17
+
18
+
# if this fails with a warning about java version incompatibility, add a parameter after ./gradlew to change the java home, to a version that works: -Dorg.gradle.java.home=/Library/Java/...
19
+
20
+
./gradlew antipiracy:assembleRelease --warning-mode all && ./gradlew antipiracy:publishReleasePublicationToSonatypeRepository
21
+
./gradlew rooting:assembleRelease --warning-mode all && ./gradlew rooting:publishReleasePublicationToSonatypeRepository
22
+
./gradlew integrity:assembleRelease --warning-mode all && ./gradlew integrity:publishReleasePublicationToSonatypeRepository
Copy file name to clipboardexpand all lines: docs/pages/modules/rooting/reference.md
+74-5
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,7 @@
1
1
# Reference
2
2
3
+
## Configurations
4
+
3
5
The complete rooting configuration is as follows.
4
6
5
7
```kotlin title="Complete Rooting settings"
@@ -23,20 +25,87 @@ private val rooting = KevlarRooting {
23
25
}
24
26
```
25
27
26
-
27
28
!!! warning
28
29
Bear in mind, this kind of configuration is exhaustive and should be used just in a few cases where you *really* need to detect all of those conditions.
29
-
Only including what your application's security environment requires is a key step in properly configuring the library.
30
+
Only including what your application's security environment requires is a key step in properly configuring the library and having an efficient detection mechanism.
31
+
32
+
33
+
You can also use the pre-configured scan settings if your configuration is common:
-`KevlarRooting.Defaults.Standard`: Complete scan, no explicit root access request:
42
+
- Targets: `root()`, `magisk()`;
43
+
- Status: `emulator()`, `testKeys()` and standard `selinux()`.
44
+
-`KevlarRooting.Defaults.JustRooting`: Only targets `root()` and `magisk()`, no explicit root access request;
45
+
-`KevlarRooting.Defaults.JustRootingExplicit`: Only targets `root()` and `magisk()`, with explicit root access request;
46
+
-`KevlarRooting.Defaults.JustEmulator`: Only `emulator()` and `testKeys()`;
47
+
-`KevlarRooting.Defaults.Empty`: No scan;
48
+
30
49
50
+
## Attestation types
31
51
32
-
Unlike other Kevlar modules, here you can actually require two different types of attestation: you have `attestateTargets` and `attestateRooting`.
52
+
Unlike other Kevlar modules, here you can actually request two different types of attestation: you have `attestateTargets` and `attestateRooting`.
33
53
Once you require the attestation through any of those two methods, any discrepancies between your expected configuration (w.r.t. the invoked attestation type) and the actual device status will be reported back to you.
34
54
35
55
```kotlin
36
56
withContext(externalDispatcher) {
37
-
val targetAttestation = rooting.attestateTargets(context)
38
-
val statusAttestation = rooting.attestateStatus()
57
+
val targetAttestation:TargetRootingAttestation= rooting.attestateTargets(context)
58
+
val statusAttestation:StatusRootingAttestation= rooting.attestateStatus()
59
+
}
60
+
```
61
+
62
+
This is done because the checks are completely independent, and so they can be run independently (basing on your needs), or together and in parallel.
63
+
64
+
They return their own attestation, each containing the security environment discrepancies it was instructed to scan for. (e.g. root access will be included in `TargetRootingAttestation`, while emulator will be in `StatusRootingAttestation`; granted they have been included in the kevlar configuration and they appear in the runtime systems)
65
+
66
+
??? example "Asynchronous scans"
67
+
```kotlin
68
+
withContext(externalDispatcher) {
69
+
val targetAttestation = rooting.attestateTargets(context)
70
+
}
71
+
72
+
withContext(externalDispatcher) {
73
+
val statusAttestation = rooting.attestateStatus()
74
+
}
75
+
```
76
+
77
+
78
+
## Reference
79
+
Here is a list of all the flags and their specification:
80
+
81
+
⚠️ Work In Progress, you can find the code responsible for executing the system checks [here](https://github.com/kevlar-kt/kevlar/blob/master/rooting/src/main/kotlin/com/kevlar/rooting/attestator/TargetsAttestator.kt)
82
+
83
+
### Targets
84
+
85
+
All of the following flags constitute the targets configuration, which can be requested through `rooting.attestateTargets(context)`, returning a `TargetRootingAttestation`, which can be either `Clear`, `Blank`, `Failed`. In the latter, you have access to the list of targets that you specified in your configuration and that have actually been detected on the host system.
86
+
87
+
#### Root Access
88
+
89
+
Root access checks are enabled through the following flag:
This will run a series of checks to determine whether the `su` binary is present on the host system, without calling `su` directly (as that would imply that your application actively asks for root access as a form of detection, which is a very aggressive technique)
100
+
101
+
If you need to do so, you can enable this additional check by telling kevlar it is allowed to invoke the `su` binary directly, via `allowExplicitRootCheck()`.
0 commit comments