search

boxeehacks / boxeehack

Hack that enables root access to the Boxee Box, provides a new updated Skin with some improved features, and a number of services to access the box such as telnet access
MIT License
365 stars 148 forks source link

Spoof App Signatures much like Boxee Server #115

Open CraigOMN opened 11 years ago

CraigOMN commented 11 years ago

There has been talk of creating a local server to serve as the Boxee login for the box. How about creating a App Signature server that would allow unsigned Apps to be loaded onto the box.

If an App is loaded onto the box from any repository, the signature verification phase could be spoofed into looking at a local server, which could always pass a valid signature.

I don't know if the SDK would be required for this part of the software.

If it could be managed, perhaps 3rd party apps like Plex may be able to be loaded as Apps.

Please mark as a Enhancement.

boxeehacks commented 11 years ago

This is a good suggestion. And will pick this up at some time, since we need to have a future-proof path for getting apps on the boxee box after the Boxee servers shut down as well...

However currently any developer can get ANY app signed and on the box. The limitation with something like Plex is not the signature, but simply that apps on boxee box cannot run any code they like, the functionality itself is limited. So even though this signature thing will be picked up, something like Plex can still not run, until we have a way to compile a new version of the Boxee executable specifically for the box; this is currently not possible due to missing parts of the Intel SDK which is needed to do anything that produces anything visual on the screen (other than the functionality that's already in the Boxee executable)...

CraigOMN commented 11 years ago

It was my understanding that Boxee was in charge of signing apps. If an app were to find or be used to exploit the box, I assume Boxee would take exception to signing the app.

Maybe I don't totally understand the signing process.

diff3 commented 11 years ago

Not sure if this is related, but in the file run_boxee.sh change export PYTHON_SANDBOX=1 to export PYTHON_SANDBOX=0

and make sure you boot boxee with the modded run_boxee.sh

Now with the sandbox turned off Boxee Box program can run os.system commands again

I did an example with unboxed http://forums.boxee.tv/showthread.php?t=63248&p=284203#post284203