change request: make com.termux.permission.RUN_COMMAND permission enforcement optional

[ilyapashuk]

Feature description

feature description:
please make it possible to disable the com.termux.permission.RUN_COMMAND permission enforcement in termux-tasker plugin, allow to manually revert the old behavior when any app was able to request that plugin.

why I need it:
Tasker added that permission from version 5.9

but some users are not able to use that version.

1. because starting from version 5.2 tasker uses google play licensing service, users without google play can't buy or use this app.
2. users from Russia can't buy new license do to of google's restrictions.

such users are forced to use tasker 5.1 or prior, which can be used without licensing.

permission enforcement makes termux-tasker plugin useless in this case.

to workaround this we may start http server inside the termux environment (on 127.0.0.1) and request it from the tasker, but this will be even mor insecure.

[agnostic-apollo]

The permission is hardcoded in AndroidManifest.xml and cannot be checked or removed dynamically and separate build would be required to remove it.

termux-tasker/app/src/main/AndroidManifest.xml

Lines 65 to 69 in 10cc047

	<receiver
	android:name=".FireReceiver"
	android:exported="true"
	android:process=":background"
	android:permission="${TERMUX_PACKAGE_NAME}.permission.RUN_COMMAND">

If google services aren't available for you, get a direct purchase license for one time payment of $4 from joao's patreon.

https://tasker.joaoapps.com/faq-ov.html#de

The plugin permissions model of automation apps is completely broken and allows any app to send commands to privileged plugins, I plan on working on a new design in future that won't require a permission, but for now, permission will not be removed. You can build termux-tasker yourself with the permission removed if you want.

https://termux.dev/en/posts/general/2022/02/15/termux-apps-vulnerability-disclosures.html#discussion

[ilyapashuk]

thank you for your reply.

if I will build the plugin with modified configuration, is it necessary to rebuild other termux parts?

is the "same signing key" rule 100% required for this particular plugin?

[agnostic-apollo]

Just remove the android:permission line and rebuild. Plugin config screen will still warn of missing permission but should execute fine.

You will have to use github builds for everything. We don't have F-Droid keys.