I am building an app that will be bundled on an android device as a system app. The manufacturer is a ways out on delivering the device to us, so in the meantime I'd like to grant my app system level permissions in the emulator so I can work on an auto update feature that will do silent installs of APKs without any interactions from the user. From what I've read, its my understanding that the only way to be able to do silent installs on android is if your app is signed with the same cert as the OS. So how can I simulate this in the emulator?
If you want a signatureOrSystem permission, you just need to be placed on the system image; you don't need to be signed with any special cert. You can do this as a one-off (until you exit the emulator) like this:
> adb root
> adb remount
> adb push /path/to/My.apk /system/app/My.apk
Once you have done that, you can use the normal process to install further updates on the data partition ("adb install -r /path/to/My.apk" which is what the developer tools do when you run from Eclipse). When installing this way, the app retains any signatureOrSystem permissions it had requested from the original version on the system image, but can not gain any new such permissions.
If you need pure signature permissions, you need to sign your app with the same cert as whatever is declaring those permissions (typically the core framework, but the media system is a separate cert etc). If you are requesting signature permissions you don't need to be installed on the system image, you can just install it as a normal app and it can still get the permissions because of the signing.
As far as I can tell, you need to:
download the Android source and build an emulator firmware image.
sign your application with the keys in the Android source tree at /build/target/product/security/.
add android:sharedUserId="android.uid.system" to your application's manifest.
run your application on an emulator using the image built in step 1.
The reason for having to build your own firmware image is so that you can get at the keys. Now, it might be possible that the keys for the standard emulator image are available somewhere, which will save you the long and exceedingly tedious process of building your own Android, but I'm afraid I have no idea where these might be.
Disclaimer: never tried this myself.
Related
I have access to an Android tablets' platform key and certificate. I'm attempting to build an app and install it with system level privileges by doing the following:
Create a Java KeyStore file with platform.pk8 and platform.x509.pem using the bash script called platform_import_keystore found on GitHub.
In AndroidManifex.xml add the following:
<uses-permission android:name="android.permission.READ_LOGS"/>
android:sharedUserId="android.uid.system"
Sign APK with PLATFORM key and certificate using a Java KeyStore file in Android Studio.
Install APK
When the app runs, the system denies READ_LOGS permission.
Why isn't my app running with system level permissions?
What #Mark mentions is correct to some extent, for system apps.
I think you are doing something else wrong.
I have tried this with system apps as well, and as long it was signed with the platform keystore, it works. Now this was on Android 8 and Android 9. You haven't mentioned the AOSP version running the device.
That changes things AFAIK, so if it's AOSP 10+, it might behave differently.
Also the other comments are missing another key thing SELinux. SELinux is not permissive for user builds. Verity is enabled, and you cannot have root access. So you cannot push the app into /system/priv-app/ or push it into /vendor/app/.
You cannot access system resources without proper SE Policy files. You can check the logs yourself, to see avc denied messages.
I think overall what you are seeing should be inline with AOSP's security ideals. An app signed with System keys should not be able to get system permissions. It also needs to be located in the correct place, either as a privileged app or vendor app. Such apps need to be whitelisted. There's a built in script in AOSP source to even generate the permissions for whitelisting (it produces the required xml)
There's two classes of system apps, /system/app/ and /system/priv-app/
The privileged apps are the only ones that get signature level permissions, and according to newer versions of android, you need to enable whitelisting in the /system/etc/priv_app-permissions_device_name.
If you make any changes to the system or vendor when verity is enabled, firstly they are mounted read only, but somehow if you do make a change, the device will brick itself. This is the security feature. All custom development needs to be done in userdebug builds with SELinux in permissive mode, and then all the permissions need to be predefined, SE Policies fine tuned to utmost minimal, only then the user build can function normally. User build is not at all suitable for AOSP development activities, even if it's just for testing or trying out a single app.
User build is production type build that the end user can use and is not for development. It's the most secure form of android, so if you have platform keys, it may never be enough.
All that being said, I'm sure you don't have the right keys. Just pull an app from system/priv-app/ and use keytool or similar to check it's signature, and then try to match with your release apk.
It's little complicated as it is, and kind of hard to explain and there are levels of permissions also in android, so if you aren't following a specific approach/path, you will not be able to get it to work.
I've a signing and compiled APK but I can not install it on a rooted device.
I've tried:
- Put APK on system/priv-app folder
- Run adb set-device-owner
- Install apk using adb install
And nothing...
I want to enroll my device with COPE ownership.
Thanks in advance
Martín
In order to use system service, you might need to sign the system service with system signing key (i.e the key which used to sign the Android OS). In the system service manifest, it set as follows in order to work as a system application
android:sharedUserId="android.uid.system"
However if you need to run this on a rooted device, you can simply remove that attribute from the manifest and make app as a system app using root utility application in order to enroll device with COPE ownership.
I'm developing a non google play application, that will be delivered as an unsigned release assembly apk to device manufacturers that will sign it with their own private system key signature.
the system signature is essential, because the app uses permissions with protection level signatureOrSystem .
since the app not going to be installed as a system privileged app, it must be signed with the system's signature.
since I'm not going to have access to the final signed apk (or the signing key itself) I don't know how can I test the product I'm delivering (on a real device and not emulator) since it functionality depends on been signed with a system signature.
so far, only reference I found is a very old thread discussing about how to sign with system signature, but as I understand - it will not work anymore.
I would like to understand what is the recommended work-flow for how to test my app behavior as it signed with a system signature on a real device.
With larger companies, the company manufacturing the device will provide a version of the OS for the app developer to flash to a device that has a different set of recognized signing keys for you to test with. This is how they would expect app developers to be able to test their apps as if they were running on a full production device.
You might be able to get away with rooting a device and sideloading your APK in /system/app instead of the usual install location of /data/app. Once you have an app with a manifest with necessary system permissions installed there, reboot, and install normally (adb install to /data/app) and then you will be able to use the system permissions define in the app in /system/app.
What I should to do to create a system app (to obtain rights to use android:sharedUserId="android.uid.system"in manifest file without receiving an error from package manager about certification problem?
I use rooted phone with stock firmware.
Ok, I think that I find sollution from great xda developers: http://forum.xda-developers.com/showthread.php?t=1776095 here is full description how to obtain access to apps signed by platform keys.
Do you apply with this approach?
PS it is interesting that users from stack instead of investigating hard problem immediately say that you can not solve it, then reduce novice user's reputation...
What I should to do to create a system app
There are two types of system apps:
Apps installed on the system partition, which can be accomplished by users with root privileges
Apps signed by the same signing key that signed the firmware
to obtain rights to use android:sharedUserId="android.uid.system"
That definitely would require your app to be signed by the same signing key that signed the firmware. That's true for any android:sharedUserId.
But some guys edit stock apps, prepare zip file which user can update system apps by recovery.
You are welcome to provide any evidence that what they do somehow involves android:sharedUserId="android.uid.system".
A system app must be signed with the platform key. This is done by developers deploying an android platform on their own device, or mobile carriers.
If that is your case, the easiest way is to add this to your Android.mk:
LOCAL_CERTIFICATE := platform
LOCAL_PRIVILEGED_MODULE := true
or this to your Android.bp:
certificate: "platform",
privileged: true,
If you add those lines without adding android:sharedUserId="android.uid.system" to your manifest, you will be a platform_app. A system app is more privileged than a platform app. That uses the platform key and runs as the system user.
If you are not the platform vendor, the platform vendor would need to sign your application using their platform key. Some vendors, including my company, will do this for 3rd parties demonstrating a valid reason for doing so.
Without the signature, your application can only be used on rooted devices.
I did not need to sign my app with the firmware signature! I have a rooted device. Therefore I can grant myself rights to write to certain directories using adb.
I moved my app to /system/priv-app instead of /system/app using those steps: Push my apk to /system/app
Now, I can access system permissions like android.permission.SHUTDOWN
There is two types of system apps.
Type 1: The App which is in the same signature of the Device ROM .
Type 2: The Signed app which is in system/priv-app ( Might differ based on adnroid version ) in your device storage location .
Visit this link -> http://www.archive.ricston.com/blog/explaining-behavior-android-application-system-apps-nonsystem-apps/
I want to add this permission to my Android manifest:
<uses-permission android:name="android.permission.MODIFY_PHONE_STATE" />
But after I paste this permission in my manifest, it tests red underline and says:
permission is only granted to system apps
What can I do?
MODIFY_PHONE_STATE permission is granted to system apps only.
For your information, there are 2 types of Android apps: system & user
User apps are just all your normal app installations through the Google Play Store, Amazon Appstore or sideloading. These go into the /data partition of your Android phone, which is the part of the internal memory made available for user data and apps.
System apps are basically the apps that come pre-installed with your ROM. In a standard Android user environment, the user doesn’t have write access to the /system partition and thus, installing or uninstalling system apps directly isn’t possible.
In order to install an app as a system app on your Android device,
your device must either be rooted or have a custom recovery installed (or both).
That being said, that error is actually wrong because you have a valid code and compilation should work. It would be better if it gave a warning instead. In Eclipse you can easily fix it. Just go to:
Window -> Preferences -> Android -> Lint Error Checking.
Find ProtectedPermission from the list and set the severity to something other than error(info for example). This way your project will still compile.
MODIFY_PHONE_STATE is a system-only permission. System Apps are either pre-installed into a system folder or compiled by a manufacturer using their security certificate.
Hence, if you are trying to do this you are trying to use API which are no longer supported. With Android versions 2.3+ you can monitor incoming calls, but blocking is not allowed (i think from the link you posted thats what you're trying to do).
Android issues if you need to follow: Issue 15022 and Issue 14789
This error appears in SDK 19 onwards, when you change the manifest.
Do Project Clean and Build.
It should clear this error.
just clean your project it will be fine like this :
project > Clean...
There are four types of Permission
Regular
Dangerous
Signed
Signed or System
The first two can be used by Simple Apps Other two can only be used by the app which is build in framework
Because this is the system level permission device developer not grant this so application development tools also warn against this so you have to
Simply Clean project & Rebuild this is it
Find ProtectedPermission from the list in
Window -> Preferences -> Android -> Lint Error Checking.
and set the severity to something other than error(info for example). This way your project will still compile.