ich_iel

Fairphone 4 doesn't provide proper privacy/security patches, which is the most bare minimum requirement for a device.

https://support.fairphone.com/hc/en-us/articles/4405858220945-FP4-Fairphone-OS-Release-Notes

They released the November 2022 security patch meant to be published on November 7th on December 19th instead. Bear in mind they receive early access to these security patches not available to GrapheneOS.

Please note that the monthly security patches described on that patch are only a subset of the Android security patches. Android divides up the security patches into the mandatory patches listed in the Android Security Bulletin and recommended patches listed in the Pixel Update Bulletin. The latest monthly, quarterly or yearly Android release contains the recommended patches. The mandatory patches are backported to the older releases.

As an example, this is the mandatory subset of the December security patch not shipped for the Fairphone 4:

https://source.android.com/docs/security/bulletin/2022-12-01

Most of the 2022-12-05 patches require the vendor to release an update.

This is the Pixel Update Bulletin for December 2022:

https://source.android.com/docs/security/bulletin/pixel/2022-12-01

The first sections not marked as Pixel are recommended patches for other devices. The section marked as Pixel are largely applicable to other devices with either a Snapdragon SoC, Exynos SoC or a separate Qualcomm/Samsung cellular modem. The Pixel Update Bulletins provide a lot more patches than what other vendors are required to fix to claim the latest patch level. This means the patch level elsewhere doesn't mean as much as you think, and it means almost nothing on alternate operating systems setting it incorrectly.

As far as I can tell, the fairphone 4 does have a secure element. The Qualcomm SM7225 chip the phone uses lists that it has a "trusted execution environment", "platform security foundations", "secure processing unit" and "type-1 hypervisor", these are slightly different terminology, but appear to be all the things graphene are always saying would be needed.

TrustZone, virtualization that's not usable by us (we can use the virtualization support on the Pixel 6 and later, but not Snapdragon support since that's for Qualcomm and must be licensed by an OEM for their particular usage) along with marketing buzzwords are not a secure element. Qualcomm SPU is a secure element, but does not implement the required functionality. The functionality implemented by the TEE (TrustZone, not a secure element) and SPU depend on the OEM. Fairphone hasn't filled in the functionality that's expected. Qualcomm doesn't provide it out-of-the-box.

I had a quick look at qualcomm's exploit disclosures for the SOC, and admittedly there are a lot, but all I could find were firmware exploits that have presumably been patched. I couldn't find anything related to fundamental problems with the underlying hardware that would make it insecure. Would you mind linking to whatever active hardware exploits in the Qualcomm SM7225 chip you know of?

Qualcomm and Android security bulletins are published monthly. There are usually firmware security patches every month. There are also usually patches to Qualcomm's proprietary libraries. On the Fairphone 4, all the userspace SoC support would be for Android 11, and while still usable for Android 13 not at all ideal and with major caveats.

The update schedule of the fairphone shouldn't matter for discussions about potential for graphene given that all the software would be replaced anyway, besides perhaps the firmware, but if the patches are available it should be easy to apply them from the upstream with OS support. I haven't seen any evidence of fairphone 4 shipping security critical firmware updates late btw, but I'm not going to contest it since it would be irrelevant anyway.

That's not at all correct. The firmware would come from them which is a substantial portion of the security patches and no less important. The software would largely come from them too whether the components are open or closed source.

The evidence of them shipping security patches late is right there on their site. They ship each monthly Android security patch significantly late, and those are just the mandatory Android security patches, not the recommended patches. The Android security patches are just a baseline and often include upstream fixes months late or longer. Shipping these on time is a low bar, not a high bar, especially if a vendor is only shipping the mandatory ones and not all recommended patches. Fairphone is missing literally years of recommended patches due to being based on Android 11. This does matter when using another OS because you are still going to be using their vendor code, via Treble. Since their vendor code isn't updated to Android 13 QPR1, the most straightforward way to support it is via Treble, meaning the vendor portion of userspace will not have recommended patches and hardening beyond Android 11. On Pixels, we can built a lot of vendor ourselves since it matches the OS version, and we can freely replace components case-by-case.

I can't find any sources for exploit disclosures surrounding fairphone's secure boot implementation. It's possible you're referring to the general misnomer that "devices other than pixels don't support relocking the bootloader", if so then it should be pointed out that fairphone 4 does. If there's something else specific please link the CVE.

Their verified boot implementation is incomplete and broken. This has been confirmed by us and multiple independent search researchers. This has to work in order for it to be relevant. It's also missing features. Most vulnerabilities don't get a CVE assigned, that's simply not how the real world works.

Not trying to shill for fairphone or anything, I can't even buy their products in my country, and I only did like 5 minutes of research, but it seems like a perfectly valid candidate to me.

It is not a valid candidate, and as you said you only did 5 minutes of research. You had an answer you wanted and you looked for bits of information to try to confirm what you wanted to see.

This phone doesn't come close to meeting our requirements. The SoC is also old and has already gone through a lot of Qualcomm's 4 year guaranteed support for the SoC. Compare it to the recently launched Pixel 6a with 5 years of support guarantee from launch. That also means something much different for the Pixel 6a, which receives every monthly security patch on time. It also receives every monthly, quarterly and yearly release of AOSP on time which bring the recommended privacy/security patches and other improvements. We need this software support. We could make some sacrifices but not shipping even the mandatory ASB patches almost 2 months late every month.

Giving people something branded as GrapheneOS but which doesn't come close to providing the basics that are expected goes against what we believe in doing. We cannot support this device and call it GrapheneOS.