↓ Skip to main content
Ivon’s Blog

Installing Linux on an iPhone 6: Run postmarketOS Through a checkra1n Jailbreak

·
Categories Smartphones Linux Phones
Tags IOS PostmarketOS Checkm8 Jailbreak IPhone
Table of Contents

For attempts at running Linux on iOS devices, I have previously discussed iSH Shell terminal and the UTM virtual machine approach. This time I am going to try installing Linux directly on an iPhone.

1. Background
#

checkm8 is arguably Apple’s biggest vulnerability in recent years. Combined with checkra1n, it can complete the jailbreak process before boot. In 2020, some wizard put together Project Sandcastle and successfully ran Android 10 on the iPhone 7. The author also started porting the Linux kernel. Even though Apple almost sued them, the project is still under development.

Recently, people have already developed LineageOS ports, such as Android device tree for “snowcastle”, which can run the latest Android 16 on supported iPhones.

A few years later, more developers tried running Linux on other iPhones. The vulnerability checkm8 relies on only supports A7 to A11 chips, meaning devices from the iPhone 5S through the iPhone X. Older or newer devices do not work.

Ideally, the iPhone 7 is currently one of the better-supported devices. It can mount postmarketOS on AFPS and boot, and some developers have even gotten Wayland running on it. Unfortunately, I do not have one.

I have two old iOS devices that support checkm8: an iPhone SE (iOS 15) and an iPod touch 6 (iOS 12). There are many successful Linux boot cases online, but they do not mention their iOS versions. On iOS 15 and later, you can only jailbreak with palera1n, and you need to use the command palera1n -p -f to start the pongoOS Shell. I tested it and ran into other problems. So I switched to the iPod touch 6 for testing. Its processor is similar to the iPhone 6, so it should theoretically work.

So how do we run Linux? First, enter the pongoOS Shell through checkra1n, then boot Linux from there.

Which Linux distro should we pick? Although someone on Reddit successfully compiled Ubuntu and booted it, and someone on Twitter got Asahi Linux running (see references at the end), there are more successful photos on the postmarektOS Wiki. Also, that community pays more attention to mobile Linux, so I used that distro as the base for this attempt.

There are two possible approaches after that. One is to compile Linux into a ramdisk and boot it; after rebooting, the data disappears.

The second is to use the Netboot feature provided by pmbootstrap for network booting. Data still disappears after reboot, but the rootfs stays on the computer.

So, strictly speaking, none of this is really “installing” Linux on an iPhone. The system is not actually written to the iPhone’s storage; it only boots Linux temporarily. At the moment, no matter which method you use, you still need a computer to guide the device into Linux.

2. Requirements
#

  • A Linux or Mac computer. I used Ubuntu 24.04.
  • An iOS device that supports checkra1n, meaning A7 to A11 chip devices from the iPhone 5S through the iPhone X. I used an iPod touch 6 running iOS 12.5.7.
  • Lightning to USB OTG adapter, mouse, and keyboard. Linux has no touch driver, so after the iPhone boots you need to control it with a keyboard and mouse. If you are comfortable controlling X11 with SSH commands, you can skip these.

3. Compile pongoOS
#

pongoOS is the program that runs before loading the iOS XNU kernel.

  1. Before compiling pongoOS, you need checkr1an. (paler1an does not require compiling pongoOS.)

  2. Download the checkra1n executable from the official website and put it in a system directory.

wget https://assets.checkra.in/downloads/linux/cli/x86_64/dac9968939ea6e6bfbdedeb41d7e2579c4711dc2c5083f91dced66ca397dc51d/checkra1n

sudo mv checkra1n /usr/bin/
  1. Install Clang 11 on Linux.
sudo apt install clang-11 xdd
  1. Install ld64 and cctools-strip from the checkra1n package repository. Other distros need to manually compile them for newer Clang versions.
echo 'deb https://assets.checkra.in/debian /' | sudo tee /etc/apt/sources.list.d/checkra1n.list
sudo apt-key adv --fetch-keys https://assets.checkra.in/debian/archive.key

sudo apt update

sudo apt install ld64 cctools-strip
  1. Get the pongoOS source code and compile it, using konradybcio’s fork.
git clone https://github.com/konradybcio/pongoOS

cd pongoOS

LD_LIBRARY_PATH="/usr/lib/llvm-11/lib/" EMBEDDED_CC="/usr/bin/clang-11" EMBEDDED_LDFLAGS=-fuse-ld=/usr/bin/ld64 STRIP=cctools-strip make all

Note: the pongoOS source has not been updated in a long time, so it sometimes fails to compile. You can also compile it inside a macOS virtual machine. The following commands compile it with Xcode on macOS Ventura:

xcode-select --install

git clone https://github.com/konradybcio/pongoOS

cd pongoOS

make all

You will end up with build/Pongo.bin.

4. Compile the Linux Kernel
#

  1. Install build dependencies.
sudo apt install build-essential clang  libncurses5 flex git bc bison
  1. Get the linux-apple kernel source provided by konradybcio.
git clone https://github.com/konradybcio/linux-apple

cd linux-apple
  1. Get the defconfig provided by SoMainline.
wget https://raw.githubusercontent.com/SoMainline/linux-apple-resources/master/example.config -O ./.config
  1. Adjust PAGESIZE.
make ARCH=arm64 LLVM=1 menuconfig

  1. Press / to search, enter _PAGE, and press 1.

  2. For PAGESIZE, set A8 processors to 4K and A9 or newer processors to 16K. Then press Exit and save .config.

  3. Compile the kernel.

make ARCH=arm64 LLVM=1 -j$(nproc) Image.lzma dtbs

  1. You will end up with arch/arm64/boot/Image.lzma.

  2. Get the dtbpack script and put it in the Linux kernel directory.

wget https://raw.githubusercontent.com/SoMainline/linux-apple-resources/master/dtbpack.sh

chmod +x dtbpack.sh
  1. Generate dtbpack.
./dtbpack.sh

5. Compile the postmarketOS rootfs
#

  1. Install pmbootstrap.

  2. Initialize it. Select apple-iphone6 as the device model and xfce4 as the desktop environment.

pmbootstrap init
  1. Create the rootfs.
pmbootstrap install

6. Boot into Linux
#

  1. Set up libimobiledevice and confirm that Linux recognizes the iPhone.

  2. Connect the iPhone to the computer and manually enter DFU mode: power it off and wait 5 seconds. Hold the power button for 3 seconds, then hold power + Home for 10 seconds. Release the power button and keep holding Home.

  3. After confirming it is in DFU mode, open a terminal in the pongoOS source directory and use checkra1n to enter the pongoOS Shell.

cd pongoOS

sudo checkra1n -v -V -p -c -k ./build/Pongo.bin

  1. At this point, you should see the pongoOS Shell on the iOS device screen.

  2. Start postmarketOS netboot.

pmbootstrap initfs hook_add netboot

pmbootstrap export
  1. Send the Linux initramfs to the iOS device.
cd pongoOS

python3 scripts/load_linux.py -k "linux-apple-kernel-directory/arch/arm64/boot/Image.lzma" -d "linux-apple-kernel-directory/dtbpack" -r /tmp/postmarketOS-export/initramfs

  1. Wait for Linux to boot… and it kernel panics. Damn it.

  2. If it boots normally, send the Netboot rootfs and you can enter the Linux system.

pmbootstrap netboot serve

ssh user@172.16.42.1

7. Conclusion
#

Every time I do this kind of thing, I think of this song. It’s all a waste of time again.

At the moment, this is not practical. It is a bit like stubbornly flashing postmarketOS onto an Android phone with terrible driver support. The biggest problem is still poor driver support. Just look at the table provided by SoMainline: almost every hardware feature has an X next to it.

And who is going to reverse engineer Apple device drivers? Are there developers with Asahi Linux-level enthusiasm for this? On top of that, booting Linux still depends on a hardware vulnerability.

Aside from booting and running some Linux programs, there is not much room for this to grow.

A more realistic strategy is probably to run a JIT-accelerated UTM virtual machine on the iOS device, then run a Linux VM inside it. Much more practical, which is annoying but true.

References
#

Related

Thank you for reading. Public comments are not available on this website. I write to explore ideas honestly, not to chase social engagement or traffic. I would be glad to hear your thoughts after reading the article with care. If you found any errors, technical issues, or would like to share feedback, feel free to contact me via the email listed on the About page.