change request: make com.termux.permission.RUN_COMMAND permission enforcement optional

[ilyapashuk]

change request: make com.termux.permission.RUN_COMMAND permission enforcement optional

[agnostic-apollo]

The permission is hardcoded in AndroidManifest.xml and cannot be checked or removed dynamically and separate build would be required to remove it.

termux-tasker/app/src/main/AndroidManifest.xml

Lines 65 to 69 in 10cc047

	<receiver
	android:name=".FireReceiver"
	android:exported="true"
	android:process=":background"
	android:permission="${TERMUX_PACKAGE_NAME}.permission.RUN_COMMAND">

If google services aren't available for you, get a direct purchase license for one time payment of $4 from joao's patreon.

https://tasker.joaoapps.com/faq-ov.html#de

The plugin permissions model of automation apps is completely broken and allows any app to send commands to privileged plugins, I plan on working on a new design in future that won't require a permission, but for now, permission will not be removed. You can build termux-tasker yourself with the permission removed if you want.

https://termux.dev/en/posts/general/2022/02/15/termux-apps-vulnerability-disclosures.html#discussion

[ilyapashuk]

thank you for your reply.

if I will build the plugin with modified configuration, is it necessary to rebuild other termux parts?

is the "same signing key" rule 100% required for this particular plugin?

[agnostic-apollo]

Just remove the android:permission line and rebuild. Plugin config screen will still warn of missing permission but should execute fine.

You will have to use github builds for everything. We don't have F-Droid keys.