rkozik1989 4 days ago

Phones typically have 2 operating systems: one to handle telephonic functions like managing tower connections and separate operating system for user applications. The security implication here is that the telephonic operating system has access to the same system resources as the application operating system at the same time, right? The problem is your data is always available in plaintext to the telephonic OS because it has to be stored somewhere before it gets encrypted, so assuming graphene OS doesn't handle both functions its not a perfectly closed loop system.

▲ bramhaag 4 days ago | parent | next [-]

  > The security implication here is that the telephonic operating system has access to the same system resources as the application operating system at the same time, right?

It shouldn't. As per https://grapheneos.org/faq#baseband-isolation:

  > The baseband is isolated on all of the officially supported devices. Memory access is partitioned by the IOMMU and limited to internal memory and memory shared by the driver implementations. The baseband on the officially supported devices with a Qualcomm SoC implements Wi-Fi and Bluetooth as internal sandboxed processes rather than having a separate baseband for those like earlier devices.

	▲	DANmode 4 days ago \| parent [-]
		IOMMU The way it should have been all along.

▲ ignoramous 4 days ago | parent | prev | next [-]

> Phones typically have 2 operating systems

A separate OS runs the security chip (like Titan). Another could be running in EL3 (Trusted Execution Environment), yet many could be running in Realms (mutually untrusted VMs). The later stage bootloaders and some firmware (ex: GPUs) themselves could be considered OSes in their own right.

▲

w3ll_w3ll_w3ll 4 days ago | parent [-]

Also, the SIM card has its own operating system.

	▲	embedding-shape 4 days ago \| parent [-]
		Also, most smartphones today have at least one browser installed, they're basically their own tiny little OSes at this point.

▲ surajrmal 4 days ago | parent | prev | next [-]

No, shared peripherals need to go through a central arbiter for access. In the case of things like storage the AP's OS, eg android, provides that roll. This is also true for the OS that runs under the trustzone. Be careful about spreading rumors without validating them.

▲ megagpt1 4 days ago | parent | prev [-]

Most devices have a large number of operating systems. The camera also has one, and the storage has one if it's eMMC. The WiFi/BT chip has one. The AP has at least two, because of trustzone.

People bring up the baseband (ie. cell modem) having its own OS because someone gave a talk on it at defcon or something, but it's just one of many.