GrapheneOS disables dynamic code loading for the base OS by default and has toggles to disable it for apps. We enforce it for both native code and Android Runtime (ART) class loading for Java/Kotlin. iOS largely has this for the base OS by default for native code other than Safari and Apple devices which apps are allowed to bypass it in the app store.
Our Vanadium browser has per-site enforcement for this built on top of the per-site JIT toggle. By default, the JIT is disabled in the browser and for the WebView other than a default exception users can disable for our pdf.js-based PDF Viewer app since it only runs fixed JavaScript code from the APK rather than anything dynamic.
For now, this could be a single row called "Dynamic code loading prevention for apps" where the value for GrapheneOS can be "System (default) and non-system (opt-in)". The title text can explain that this applies to both code loading via memory and storage along with applying to both native code and Android Runtime class loading for Java/Kotlin. If any operating systems add a partial implementation, it could be split up more. DivestOS may add this at some point in the future but doesn't currently have it so the other operating systems should be red with "None". AOSP allows both dynamic in-memory code generation and dynamic code loading from storage for all apps. It only has restrictions for non-app base OS components.
Limiting the row to being about apps makes the most sense since AOSP has it mostly covered for the base OS and the non-app portion of the GrapheneOS restrictions for the base OS are part of the static SELinux policy so they're partly covered by that very generic row already.
The color for GrapheneOS should likely just be green since not having it be opt-in for user installed apps would be very impractical. iOS has the native part enforced for many apps by default but not all apps and users can't see or control which are allows.
GrapheneOS disables dynamic code loading for the base OS by default and has toggles to disable it for apps. We enforce it for both native code and Android Runtime (ART) class loading for Java/Kotlin. iOS largely has this for the base OS by default for native code other than Safari and Apple devices which apps are allowed to bypass it in the app store.
Our Vanadium browser has per-site enforcement for this built on top of the per-site JIT toggle. By default, the JIT is disabled in the browser and for the WebView other than a default exception users can disable for our pdf.js-based PDF Viewer app since it only runs fixed JavaScript code from the APK rather than anything dynamic.
For now, this could be a single row called "Dynamic code loading prevention for apps" where the value for GrapheneOS can be "System (default) and non-system (opt-in)". The title text can explain that this applies to both code loading via memory and storage along with applying to both native code and Android Runtime class loading for Java/Kotlin. If any operating systems add a partial implementation, it could be split up more. DivestOS may add this at some point in the future but doesn't currently have it so the other operating systems should be red with "None". AOSP allows both dynamic in-memory code generation and dynamic code loading from storage for all apps. It only has restrictions for non-app base OS components.
Limiting the row to being about apps makes the most sense since AOSP has it mostly covered for the base OS and the non-app portion of the GrapheneOS restrictions for the base OS are part of the static SELinux policy so they're partly covered by that very generic row already.
The color for GrapheneOS should likely just be green since not having it be opt-in for user installed apps would be very impractical. iOS has the native part enforced for many apps by default but not all apps and users can't see or control which are allows.