Last week I received (finally) my Fairphone 4, supplied with a de-googled operating system, which I had ordered from the E Foundation’s shop in December. (I’m am very hard on hardware and my venerable Fairphone 2 is really on its last legs.)

I expect to have full control over the software on any computing device I own which is as complicated, capable, and therefore, hazardous, as a mobile phone. Unfortunately the Eos image (they prefer to spell it “/e/ os”, srsly!) doesn’t come with a way to get root without taking fairly serious measures including unlocking the bootloader. Unlocking the bootloader wouldn’t be desirable for me but I can’t live without root. So.

I started with these helpful instructions: https://forum.xda-developers.com/t/fairphone-4-root.4376421/

I found the whole process a bit of a trial, and I thought I would write down what I did. But, it’s not straightforward, at least for someone like me who only has a dim understanding of all this Android stuff. Unfortunately, due to the number of missteps and restarts, what I actually did is not really a sensible procedure. So here is a retcon of a process I think will work:

Unlock the bootloader

The E Foundation provide instructions for unlocking the bootloader on a stock FP4, here https://doc.e.foundation/devices/FP4/install and they seem applicable to the “Murena” phone supplied with Eos pre-installed, too.

NB tht unlocking the bootloader wipes the phone. So we do it first.

So:

1. Power on the phone, with no SIM installed
2. You get a welcome screen.
3. Skip all things on startup including wifi
4. Go to the very end of the settings, tap a gazillion times on the phone’s version until you’re a developer
5. In the developer settings, allow usb debugging
6. In the developer settings, allow oem bootloader unlocking
7. Connect a computer via a USB cable, say yes on phone to USB debugging
8. adb reboot bootloader
9. The phone will reboot into a texty kind of screen, the bootloader
10. fastboot flashing unlock
11. The phone will reboot, back to the welcome screen
12. Repeat steps 3-9 (maybe not all are necessary)
13. fastboot flashing unlock_critical
14. The phone will reboot, back to the welcome screen

Note that although you are running fastboot, you must run this command with the phone in “bootloader” mode, not “fastboot” (aka “fastbootd”) mode. If you run fastboot flashing unlcok from fastboot you just get a “don’t know what you’re talking about”. I found conflicting instructions on what kind of Vulcan nerve pinches could be used to get into which boot modes, and had poor experiences with those. adb reboot bootloader always worked reliably for me.

Some docs say to run fastboot oem unlock; I used flashing. Maybe this depends on the Android tools version.

Initial privacy prep and OTA update

We want to update the supplied phone OS. The build mine shipped with is too buggy to run Magisk, the application we are going to use to root the phone. (With the pre-installed phone OS, Magisk crashes at the “patch boot image” step.) But I didn’t want to let the phone talk to Google, even for the push notifications registration.

1. From the welcome screen, skip all things except location, date, time. Notably, do not set up wifi
2. In settings, “microg” section
   1. turn off cloud messaging
   2. turn off google safetynet
   3. turn off google registration (NB you must do this after the other two, because their sliders become dysfunctional after you turn google registration off)
   4. turn off both location modules
3. In settings, location section, turn off allowed location for browser and magic earth
4. Now go into settings and enable wifi, giving it your wifi details
5. Tell the phone to update its operating system. This is a big download.

Install Magisk, the root manager

(As a starting point I used these instructions https://www.xda-developers.com/how-to-install-magisk/ and a lot of random forum posts.)

You will need the official boot.img. Bizarrely there doesn’t seem to be a way to obtain this from the phone. Instead, you must download it. You can find it by starting at https://doc.e.foundation/devices/FP4/install which links to https://images.ecloud.global/stable/FP4/. At the time of writing, the most recent version, whose version number seemed to correspond to the OS update I installed above, was IMG-e-0.21-r-20220123158735-stable-FP4.zip.

1. Download the giant zipfile to your computer
2. Unzip it to extract boot.img
3. Copy the file to your phone’s “storage”. Eg, via adb: with the phone booted into the main operating system, using USB debugging, adb push boot.img /storage/self/primary/Download.
4. On the phone, open the browser, and enter https://f-droid.org. Click on the link to install f-droid. You will need to enable installing apps from the browser (follow the provided flow to the settings, change the setting, and then use Back, and you can do the install). If you wish, you can download the f-droid apk separately on a computer, and verify it with pgp.
5. Using f-droid, install Magisk. You will need to enable installing apps from f-droid. (I installed Magisk from f-droid because 1. I was going to trust f-droid anyway 2. it has a shorter URL than Magisk’s.)
6. Open the Magisk app. Tell Magisk to install (Magisk, not the app). There will be only one option: patch boot file. Tell it to patch the boot.img file from before.
7. Transfer the magisk_patched-THING.img back to your computer (eg via adb pull).
8. adb reboot bootloader
9. fastboot boot magisk_patched-THING.img (again, NB, from bootloader mode, not from fastboot mode)
10. In Magisk you’ll see it shows as installed. But it’s not really; you’ve just booted from an image with it. Ask to install Magisk with “Direct install”.

After you have done all this, I believe that each time you do an over-the-air OS update, you must, between installing the update and rebooting the phone, ask Magisk to “Install to inactive slot (after OTA)”. Presumably if you forget you must do the fastboot boot dance again.

After all this, I was able to use tsu in Termux. There’s a strange behaviour with the root prompt you get apropos Termux’s request for root; I found that it definitely worked if Termux wasn’t the foreground app…

You have to leave the bootloader unlocked. Howwever, as I understand it, the phone’s encryption will still prevent an attacker from hoovering the data out of your phone. The bootloader lock is to prevent someone tricking you into entering the decryption passkey into a trojaned device.

Other things to change

• Probably, after you’re done with this, disable installing apps from the Browser. I will install Signal before doing that, since that’s not in f-droid because of mutual distrust between the f-droid and Signal folks. The permission is called “Install unknown apps”.

• Turn off “instant apps” aka “open links in apps even if the app is not installed”. OMG WTF BBQ.

• Turn off “wifi scanning even if wifi off”. WTF.

• I turned off storage manager auto delete, on the grounds that I didn’t know what the phone might think of as “having been backed up”. I can manage my own space use, thanks very much.

There are probably other things to change. I have not yet transferred my Signal account from my old phone. It is possible that Signal will require me to re-enable the google push notifications, but I hope that having disabled them in microg it will be happy to use its own system, as it does on my old phone.