[1] https://developer.android.com/training/safetynet/attestation... (note the table under "Possible attestation results". This is what I meant by you are not allowed to own your device's own filesystem (root access).
But Google is moving towards reading hardware fuses, and has been working together with OEMs to use secure enclaves to securely attest the status of the system in the future.
By requiring the attestation results to be signed by a key burnt into the CPU, they also prevent virtualisation.
I'm not against, non-network, hardware-based security features. In fact, I think we need them. I would certainly desire a phone where someone can't simply access my private key with a soldering iron and flash programmer.
And I wouldn't mind a bootloader that is locked to prevent tampering with the device, as long as I can unlock it, and unlocking it wipes the device or something. I wouldn't mind using Android as intended without root access. But, I want control over the decision. I want to control the OS I run on my device. I want the freedom to increase its lifespan beyond whenever the manufacturer stops provided security updates. I want to have the ability to enable root to inspect my data on my device using my storage, without sacrificing my ability to watch movies on the $600 device I paid for that somehow has a better quality display than my monitor. And also, I want the ability to block ads that gulp down my expensive mobile data so that I can instead pay for a service like Netflix.
Yep, I had the same thought. Can't wait to see full-system Android emulators running on a phone :)
Will not, as in you can theoretically get it to "say the right answers" if you have root? It seems like the best way to "crack" this protection would be something like virtualisation, where the binary is run in an environment that "looks good" to it. (This also reminds me of a lot of malware, which actively tries to determine if it's being run in a VM or otherwise being analysed.)