Settings.Secure , Signing APK and Security Exception

[FrankG]

Dear all,

I struggling a lot with using Settings.Secure.. I always get an
Security Exception.

I read several discussion on this issue and also this posting from
Dianne

>From: Dianne Hackborn <hackbod <at> android.com>
>Subject: Re: problem occur while writing android.provider.Setting s.Secu­re.ENABLED_INPUT_METHODS
>Newsgroups: gmane.comp.handhelds.android.framework
>Date: 2009-03-17 18:54:39 GMT (1 year, 1 week, 1 day, 6 hours and 59 minutes ago)

>That's right, unless you are signed with the platform certificate, you can't write there. That is why they are >secure. ;)

So my question in the moment is how to sign correctly inside a whole
repositoy and how can I verify this ?

I tried this steps :

a) inside of Android.mk for this additional apk I used
LOCAL_CERTIFICATE := platform

to sign the apk with the platform certificate of this used repository

b) This seems to result in a call like this

java -jar out/host/linux-x86/framework/signapk.jar build/target/
product/security/platform.x509.pem build/target/product/security/
platform.pk8 out/target/product/<concretelatformdeleted>/obj/APPS/
TestSwitch_intermediates/package.apk.unsigned out/target/product/
<concreteplatformdeleted>/obj/APPS/TestSwitch_intermediates/
package.apk.signed

How can I verify that the apk is corretly signed ?

I tried comparing the sign of Settings.apk with my own .. but I don't
see any difference :

jarsigner -verify -verbose -certs out/target/product/
<concretelatformdeleted>/system/app/Settings.apk

show similar output to mine :

jarsigner -verify -verbose -certs out/target/product/
<concretelatformdeleted>/system/app/TestSwitch.apk

Where is my mistake and what else must be done ?

I must say I put this apk via adb on the real devise , not with
flashing ..
is this wrong ?

And hint would be very kind ! Thanks a lot !

Frank

[Dianne Hackborn]

The cert you are signing with must be the same cert as whatever system you are running on is using.  If you say you are putting this on a "real device," that device must be running a build you have made a flashed on to it from the build system.  Otherwise you can have different certs and won't match.

The platform cert is one that is associated with the device being manufactured.  The build system has a default test one just to be able to do builds, but no devices ship with that, and final user builds of devices are signed with their own certs that are typically different across carriers and specific device models.

--
You received this message because you are subscribed to the Google Groups "android-platform" group.
To post to this group, send email to android-...@googlegroups.com.
To unsubscribe from this group, send email to android-platfo...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/android-platform?hl=en.

--
Dianne Hackborn
Android framework engineer
hac...@android.com

Note: please don't send private questions to me, as I don't have time to provide private support, and so won't reply to such e-mails.  All such questions should be posted on public forums, where I and others can see and answer them.

[FrankG]

Hello Dianne,

thanks a lot for you fast answer.
Yes I totaly agree with you that the cert only match for this special
build and if we flash from this build the whole system.
We build the complete image for this new hardware. So this is not an
already manufactured
device. For our vendor extensions we need to provide also some kernel
extensions.

But step by step :

a) Is
LOCAL_CERTIFICATE := platform

the right way or is their any missing pease ( Setting the used UID
somewhere or change platform.xml ? )

b) How can I verify, whether my used cert differs with certs of
(system) apps which working fine.?

Was my way okay ?

I must say it is really difficult to figure out, what goes wrong ...

Thanks a lot for any hint or suggestion, what to do.

Frank

[Dianne Hackborn]

On Sun, Mar 28, 2010 at 12:36 PM, FrankG <frank...@googlemail.com> wrote:

a) Is
LOCAL_CERTIFICATE := platform

the right way or is their any missing pease ( Setting the used UID
somewhere or change platform.xml ? )

Yes, this changes the cert.  Using that cert should allow you to be granted the various low-level platform perms.  It doesn't make you run under the system uid, which also requires setting the shared user id in AndroidManifest.xml.  See packages/apps/Settings for examples.

 

b) How can I verify, whether my used cert differs with certs of
(system) apps which working fine.?

You can use jarsigner to look at the certs of the .apk.  You can also use "adb shell dumpsys package" to see the package manager state, or look at /data/system/packages.xml for the package manager setting files which holds the certs is has assigned.

I must say it is really difficult to figure out, what goes wrong ...

Generally there are messages in the log describing bad things going on.  Be sure to look at what is being printed during boot as well as when installing your app.

[FrankG]

Dear Dianne,

thanks a lot for your kind help and hints.

Is the format of packages.xml somewhere described ?

I'm astonished about this part from package.xml :

Permission [android.permission.<some special permission>] (43dd4a98)
sourcePackage=android
uid=1000 gids=[] type=0^

What controls this enty ? Means how can I add my own package hierachy
to have certain permissons inside of the system ?
All thought as a vendor extension.

Thanks a lot !

Frank

On 28 Mrz., 22:21, Dianne Hackborn <hack...@android.com> wrote:

> On Sun, Mar 28, 2010 at 12:36 PM, FrankG <frankgru...@googlemail.com> wrote:
> > a) Is
> > LOCAL_CERTIFICATE := platform
>
> > the right way or is their any missing pease ( Setting the used UID
> > somewhere or change platform.xml ? )
>
> Yes, this changes the cert.  Using that cert should allow you to be granted
> the various low-level platform perms.  It doesn't make you run under the
> system uid, which also requires setting the shared user id in
> AndroidManifest.xml.  See packages/apps/Settings for examples.
>
> > b) How can I verify, whether my used cert differs with certs of
> > (system) apps which working fine.?
>
> You can use jarsigner to look at the certs of the .apk.  You can also use
> "adb shell dumpsys package" to see the package manager state, or look at
> /data/system/packages.xml for the package manager setting files which holds
> the certs is has assigned.
>
> I must say it is really difficult to figure out, what goes wrong ...
>
>
>
> Generally there are messages in the log describing bad things going on.  Be
> sure to look at what is being printed during boot as well as when installing
> your app.
>
> --
> Dianne Hackborn
> Android framework engineer

> hack...@android.com