| Version | Supported |
|---|---|
| 4.17.x (latest) | ✅ Active |
| < 4.17 | ❌ End of Life |
Only the latest minor release receives security updates. Ensure you are on the most recent version (umo version) before reporting.
If you discover a security vulnerability in UMO, please report it responsibly and privately - never in a public issue or pull request.
| Channel | Where |
|---|---|
| Preferred | Private security advisory |
| Alternative | GitHub direct message to @shadow-x78 |
Include: a clear description, reproduction steps (minimal PoC if possible), the affected component and version, and the impact. Expect acknowledgment within 72 hours, an impact assessment within 7 days, and a critical patch within 30 days. Public disclosure is coordinated after the fix is released, with credit to the reporter if desired.
UMO is a POSIX sh installer that runs inside Termux on Android: it downloads Ubuntu rootfs images, configures proot containers, installs VNC/PulseAudio/desktop environments, and writes wrapper scripts - all in plain, auditable shell (no compiled binaries, no setuid, no kernel modules).
| Area | Risk | Mitigation |
|---|---|---|
| Rootfs download | Supply-chain / MITM | HTTPS mirrors only; release tarballs and rootfs archives verified via SHA-256 |
| Proot execution | Container escape to Termux host | User-space proot - no root required; mounts limited to dev, proc, sys, sdcard, termux |
| VNC exposure | Remote access to the desktop | Server always binds 127.0.0.1 (hardcoded); random per-install password at ~/.umo/vnc-pass (0600) |
| Sudo inside Ubuntu | umo user has passwordless sudo |
By design - local single-user Termux environment |
Do these three things: change the VNC password (vncpasswd) right after first login, install via the official one-liner (release-verified), and never expose port 5901 to untrusted networks without a tunnel. Keep Termux itself updated from F-Droid or GitHub - not Play Store.
Built by shadow-x78 · ubuntu-modded-optimized · Back to README
© 2026 Ubuntu Modded Optimized (UMO)