cfengine-android

Android devices are now everywhere. Tablet is the new laptop and everybody in your company has a smartphone. We also find Android in non mobile environments like interactive kiosk, infotainment systems, ...

How can we identify, manage and configure those devices?

Even if Android use a linux kernel, it is very different from a GNU/Linux system, the C library is not fully POSIX, the filesystem hierarchy is not standard, and most of the configuration is done through a Java API and sqlite files.

However those challenges can be solved. In this talk we will see how robust and well known technologies like CFEngine and Rudder can help you to manage those new devices.

This talk was done at cfgmgmtcamp.eu 2014
Slides 1-29 contains speacker note
Slides 30-58 are normal slides (download the file to see them correctly)

Transcript

1. CFEngine on
   Android
   

   View Slide

2. Summary
   Conf Management
   for Android?
   CFEngine /
   Rudder
   03 04
   01
   Android?
   02
   Android !=
   GNU/Linux
   

   View Slide

3. Android ?
   01
   

   View Slide

4. Android ?
   I suppose you already know android :-)
   You find it in many Consumer devices like phone and tablet.
   OS made by Google, opensource (Apache Licence)
   Many manufacturers: build devices and customize the OS
   Google make sure that devices are “compatible” (CTS)
   Do you need configuration tools for your pocket device?
   

   View Slide

5. People bring their own devices at work (or work devices at home)
   Access to corporate network resources, contains sensitive data.
   => need to apply security policy
   Localisation / wipe
   Tracking / inventory
   Bring Your Own Device
   BYOD
   Android ?
   

   View Slide

6. Android is used on every kind of devices.
   eg: bus shelter at Paris. 3 Android screens, interactive application
   for the city (tourist info, find shop at 11pm, ...)
   Those devices are connected by ethernet, static ip, UPS, … => not
   mobile but more like server
   => Need to update the software, change configuration (ssh keys,
   fix bug in libssl, ...)
   Mobile Devices
   NOT
   Android ?
   

   View Slide

7. Android is found on many type of embedded devices.
   Google has bought Nest => android on Internet of Things
   => security issue, how to update and patch those devices?
   Fridge sending spam (http://www.bbc.co.uk/news/technology-
   25780908)
   Bruce schneier wrote an essay to explain that embedded devices
   are often shipped with old open source packages and no way for
   the user to update them.
   https://www.schneier.com/essay-468.html
   Internet of Things
   Android ?
   

   View Slide

8. NEED
   CONFIGURATION
   MANAGEMENT
   Android ?
   

   View Slide

9. A bit of background story
   At genymobile, we build customized android version of professional
   usage (eg: bus shelter, professional tablet)
   We took the source code from google (AOSP) and customize it and
   add / remove feature (ethernet support, proxy, snmp), be able to
   run a (legacy) binary as root, improve security, ….
   I am a software engineer not a sysadmin :-)
   Customer ask us how to manage the rom we provided, no real
   solution out of the box
   How hard it can be? Android is just another linux, just install your
   favorite configuration management tool
   Add features
   AOSP
   Dev Ops?
   Management?
   Customize
   Genymobile
   Android ?
   Genymobile Story
   

   View Slide

10. Android is not GNU/Linux
    02
    

    View Slide

11. How android is different?
    Let see (quickly) :
    * Linux kernel (patched)
    * libc: bionic, not fully posix.
    * Many opensource componant: sqlite, ssl, webkit, …
    * Some are google made: X11 => surfaceflinger, gstreamer =>
    Mediaframework
    * can run binaries but all the OS / Framework is written in java:
    API oriented with configuration stored in sqlite db
    ex: change keyboard layout
    * Gnu/Linux: edit xorg.conf /restart X
    * Android: API call, sqlite store + framework send messages to all
    applications
    Android is not Gnu / Linux
    Android Challenge
    

    View Slide

12. Not FHS !
    In data an application can only see its own folder
    Android is not Gnu / Linux
    Android Challenge
    un-partitioned => kernel, ramfs (contains /)
    / => initscript + conf, cannot be modified
    /system => RO, can be remounted RW (need root access)
    /bin => daemon + toolbox (less than busybox)
    /lib => libssl.so, libsqlite.so
    /framework => *.jar
    /data => RW, application data + user configuration, accounts, …
    (need root)
    /data/data/myapp => user application
    File System
    

    View Slide

13. No package management for the system (you cannot update a lib)
    PM is for application only (playstore)
    To update the OS you need to use OTA:
    * download a zip file with the new OS or a binary patch
    * reboot in recovery mode, flash the zip
    * reboot with the new system
    Android is not Gnu / Linux
    Android Challenge
    

    View Slide

14. No python, no ruby (at least not easy)
    Mobile devices: no much ram, need to take care of cpu usage =>
    battery
    Limit the choice of tools
    HAVE NOT -:(
    Android is not Gnu / Linux
    Android Challenge
    

    View Slide

15. We can do native C or java
    with limitation (not posix, …)
    CHOICE :-)
    Android is not Gnu / Linux
    Android Challenge
    

    View Slide

16. What exists?
    Conf Management for Android
    03
    

    View Slide

17. Google is targeted to “mass market”. Make money with ads,
    playstore, and android drive user to google products
    No enterprise offers (!=RIM)
    Android has a Device Administrator API.
    If you set an app to be you Device Administrator, it can do the
    following
    http://developer.android.com/guide/topics/admin/device-admin.html
    Password
    Management
    Conf Management for Android
    Google: Device Administrator API
    Remote
    Wipe
    Force
    Encryption
    

    View Slide

18. Some manufacturer have private API to manage their device =>
    buy the phone AND the MDM solution
    => classic tied
    Other use various hack + user help (popup if a forbidden app is
    installed)
    Private API
    Conf Management for Android
    Manufacturer / Solution provider
    Hack
    

    View Slide

19. Can we do better with CFEngine
    CFEngine + Rudder
    04
    

    View Slide

20. Native code: light, efficient, written in C => good match for Android
    Need to solve some compilation issue
    Add support for android (android::) + techniques
    ⇒
    patch sent upstream (or in progress)
    Native code
    CFEngine + Rudder
    CFEngine
    Porting
    patches
    Android
    Support
    

    View Slide

21. CFEngine: native daemon, run in the linux / shell land
    Configuration: managed by android in the java land
    CFEngine + Rudder
    CFEngine
    

    View Slide

22. Jni: C code that call java function
    Java helper: launch java “command line tool” from linux (see
    command am on android)
    Rom helper:
    CFEngine + Rudder
    CFEngine
    JNI
    Java Helper
    Rom Helper
    

    View Slide

23. Create your own Android version:
    * permission: need to run as root. Can root the device and install
    sudo to launch cfengine, not a clean solution
    Write your rom and create a clean daemon launched
    in the init script
    * management: Android state can be exported as files and
    CFEngine is good at managing files. Solve the communication
    issue (eg package whitelist / blacklist)
    * Add the feature you need and let cfengine manage it (eg: proxy)
    Can be scary, but is the only way to master your device: your are
    free to update it and push security fix if needed.
    Use The
    ROM!
    CFEngine + Rudder
    ROM
    

    View Slide

24. User Friendly
    CFEngine + Rudder
    Rudder
    Inventory Reporting
    

    View Slide

25. You have two part in rudder, the server is a web interface to
    manage all the nodes. The client is cfengine + techniques +
    inventory agent: fusionInventory or OCSInventory
    When an agent start, it send a inventory to the server. Then you
    can search for agents based on the inventory (hostname, mac,
    operating system, processor type, …)
    The search result can be used to create groups of nodes.
    CFEngine + Rudder
    Rudder
    

    View Slide

26. Create a directive: ie a “configuration element”.
    For example, this directive make sure your node use the version 42
    of the Android operating system.
    Directive template are created in order to be easy to use: here you
    select only the version number, the server name, and the time to
    update.
    A non expert operator can easily use the directive and change
    some parameters.
    The role of the expert team is to create the directive (in cfengine3
    language)
    CFEngine + Rudder
    Rudder
    

    View Slide

27. Finally you apply directives to groups of node.
    “I want every Android devices from this group to be in this version
    of the system”
    You can check the compliance: if your devices are responding to
    the directive.
    CFEngine + Rudder
    Rudder
    

    View Slide

28. os behaviour: add a proxy, bring up vpn with geo data, ….
    OTA Update
    Package Management
    Blacklist
    Geofencing
    Remote Wipe
    Policy enforcement
    os behaviour
    Features
    CFEngine + Rudder
    

    View Slide

29. * cfengine is portable
    * you can build it with your rom
    * help you to manage your android with your features
    Thank You for your time !
    Questions ?
    Email: ccabessa@genymobile.com
    G+: https://www.google.com/+CedricCabessa
    Slides: https://speakerdeck.com/cedriccabessa/cfengine-android
    Cédric Cabessa
    

    View Slide

30. CFEngine on
    Android
    

    View Slide

31. Summary
    Conf Management
    for Android?
    CFEngine /
    Rudder
    03 04
    01
    Android?
    02
    Android !=
    GNU/Linux
    

    View Slide

32. Android ?
    01
    

    View Slide

33. Android ?
    

    View Slide

34. Bring Your Own Device
    BYOD
    Android ?
    

    View Slide

35. Mobile Devices
    NOT
    Android ?
    

    View Slide

36. Internet of Things
    Android ?
    

    View Slide

37. NEED
    CONFIGURATION
    MANAGEMENT
    Android ?
    

    View Slide

38. Add features
    AOSP
    Dev Ops?
    Management?
    Customize
    Genymobile
    Android ?
    Genymobile Story
    

    View Slide

39. Android is not GNU/Linux
    02
    

    View Slide

40. Android is not Gnu / Linux
    Android Challenge
    

    View Slide

41. Android is not Gnu / Linux
    Android Challenge
    un-partitioned => kernel, ramfs (contains /)
    / => initscript + conf, cannot be modified
    /system => RO, can be remounted RW (need root access)
    /bin => daemon + toolbox (less than busybox)
    /lib => libssl.so, libsqlite.so
    /framework => *.jar
    /data => RW, application data + user configuration, accounts, …
    (need root)
    /data/data/myapp => user application
    File System
    

    View Slide

42. Android is not Gnu / Linux
    Android Challenge
    

    View Slide

43. HAVE NOT -:(
    Android is not Gnu / Linux
    Android Challenge
    

    View Slide

44. CHOICE :-)
    Android is not Gnu / Linux
    Android Challenge
    

    View Slide

45. Conf Management for Android
    03
    

    View Slide

46. Password
    Management
    Conf Management for Android
    Google: Device Administrator API
    Remote
    Wipe
    Force
    Encryption
    

    View Slide

47. Private API
    Conf Management for Android
    Manufacturer / Solution provider
    Hack
    

    View Slide

48. CFEngine + Rudder
    04
    

    View Slide

49. Native code
    CFEngine + Rudder
    CFEngine
    Porting
    patches
    Android
    Support
    

    View Slide

50. CFEngine + Rudder
    CFEngine
    

    View Slide

51. CFEngine + Rudder
    CFEngine
    JNI
    Java Helper
    Rom Helper
    

    View Slide

52. Use The
    ROM!
    CFEngine + Rudder
    ROM
    

    View Slide

53. User Friendly
    CFEngine + Rudder
    Rudder
    Inventory Reporting
    

    View Slide

54. CFEngine + Rudder
    Rudder
    

    View Slide

55. CFEngine + Rudder
    Rudder
    

    View Slide

56. CFEngine + Rudder
    Rudder
    

    View Slide

57. OTA Update
    Package Management
    Blacklist
    Geofencing
    Remote Wipe
    Policy enforcement
    os behaviour
    Features
    CFEngine + Rudder
    

    View Slide

58. Thank You for your time !
    Questions ?
    Email: ccabessa@genymobile.com
    G+: https://www.google.com/+CedricCabessa
    Slides: https://speakerdeck.com/cedriccabessa/cfengine-android
    Cédric Cabessa
    

    View Slide