anbox-install/README.md

# Anbox installation

This repository contains recommended Anbox configuration to run the program as securely as possible.

Many users misconfigure Anbox to run in privileged mode which permits real root access for Android system processes to a Linux system. Configuration in this repository contains proper settings to run Anbox in _unprivileged mode_, thus better protecting your Linux system from possibly malicious Android processes.

Additionally, this repository provides feature-patched Android OS image file for Anbox, and several other improvements.

`PKGBUILD` file is Arch Linux specific file. Otherwise, you can use rest of the files on any Linux distribution.

## Anbox installation

Anbox installation steps are roughly described in [Installation Steps](installation-steps.md).

## Anbox files

Many files have originally been provided by [anbox-git AUR package](https://aur.archlinux.org/packages/anbox-git/). However, small changes have been made.

### Changes and additions

#### # [anbox-bridge.network](anbox_files/anbox-bridge.network) (systemd-networkd file)

- Added `[Network]` entry `ConfigureWithoutCarrier=yes`

- Added IPv4 broadcast address `192.168.250.255` into `[Address]` section

- Removed `IPMasquerade=yes` entry from `[Address]` section. Depending on your network topology, you may want to keep this option. I don't need or use it.

#### # [anbox-container-manager.service](anbox_files/anbox-container-manager.service) (Systemd service file)

- Changed `[Service]` entry `ExecStart=...` from

```
ExecStart=/usr/bin/anbox container-manager --daemon --privileged --data-path=/var/lib/anbox
```

to

```
ExecStart=/usr/bin/anbox container-manager --daemon --data-path=/var/lib/anbox
```

- Multiple security-related additions

- Added `[Unit]` entries

```
Wants=lxc.service
After=lxc.service
```

#### # [anbox-session-manager.service](anbox_files/anbox-session-manager.service) (Systemd service file)

- Added `[Service]` entry `Environment=ANBOX_FORCE_SERVER_SIDE_DECORATION=true`

#### # [subuid](anbox_files/subuid) & [subgid](anbox_files/subgid)

LXC container user and group mapping files `/etc/subuid` and `/etc/subgid` for Android OS container.

#### # anbox-session-manager (shell script)

Simple wrapper script to be added into desktop startup program configuration. This is a simple work around script. If `anbox-session-manager` Systemd service is launched _before_ X11 session, launching the X11 session fails for unknown reasons. This script ensures that X11 session is launched _before_ `anbox-session-manager` Systemd service.

Place into `/usr/local/bin/` folder.

----------

#### Patch files

- [patch_audio01_timing.patch](anbox_files/patch_audio01_timing.patch) & [patch_audio02_pass-messenger.patch](anbox_files/patch_audio02_pass-messenger.patch)

  - Details: [GitHub: Anbox PR #1034 - Implement audio timing](https://github.com/anbox/anbox/pull/1034)

- [patch_bytesize-to-bytesizelong.patch](anbox_files/patch_bytesize-to-bytesizelong.patch)

  - Details: [GitHub: Anbox PR #1480 - rpc: use ByteSizeLong from protobuf](https://github.com/anbox/anbox/pull/1480)

- [patch_cm-helpmenu-unhidden.patch](anbox_files/patch_cm-helpmenu-unhidden.patch)

  - Details: personal patch to unhide `container-manager` options in Anbox executable help menu

- [patch_cm-privileged-warn.patch](anbox_files/patch_cm-privileged-warn.patch)

  - Details: personal patch to add `not recommended` note into `--privileged` parameter description

- [patch_python3.patch](anbox_files/patch_python3.patch)

  - Details: [GitHub: Anbox issue - Python 2 is EOL: comment by karuboniru](https://github.com/anbox/anbox/issues/1478#issuecomment-638055086)

- [patch_remove-unknown-opt.patch](anbox_files/patch_remove-unknown-opt.patch)

  - Details: personal patch to remove unknown compilation time G++ option

## Android OS files

Contains Android OS image file with additional patches. Base Android version is `7.1.1_r13`. The compiled image source code is purely based on [Android Open Source Project codebase](https://android.googlesource.com/).

On Arch Linux, you can use [anbox-image AUR package](https://aur.archlinux.org/packages/anbox-image/) as reference to install this custom Android image. Or just simply copy the image into `/var/lib/anbox/`, overriding the original Android OS image file `android.img`.

### Additional features:

- Server-side decoration support

- Audio timing fix for stream videos

- Default Gallery app no longer pauses video playback when changing focus to another Android application

- Avoid unnecessary Linux kernel warnings by removing unused Android-native features

----------

### Patch files

Compiled Android OS image file `android.img` with the following patches applied:

- [patch_audio01_timing.patch](androidOS_files/patch_audio01_timing.patch) & [patch_audio02_pass-messenger.patch](androidOS_files/patch_audio02_pass-messenger.patch)

  - Details: as above

- [patch_gallery2_no-activity-checks.patch](androidOS_files/patch_gallery2_no-activity-checks.patch)

  - Details: remove video & audio pause functionality from default Android OS system application `com.android.gallery3d` as the pause functionality does not fit into Linux desktop environment when running multiple Android applications simultaneosly.

- [patch_initcgroups.patch](androidOS_files/patch_initcgroups.patch)

  - Remove unnecessary cgroups and related mount points from containerized Android OS system. Remove cpusets.

    - Both options generate unnecessary Linux main system kernel `dmesg` output and both options fail.