system vs privilege apps

3,277 views

Skip to first unread message

A J

unread,

Oct 7, 2019, 11:36:10 AM10/7/19

to android-platform

Hello,

I've been trying to understand the system and privileged level apps on Android.

And, looking to find an answer to confirm my understanding of the following queries related to the same.

1. What makes an app as "system" or "privileged" apps? Does the

a. OEM signing and android.uid.system mandatory, or

b. Just putting inside the /system/app and /system/priv-app is enough.

2. What's the difference between the system (/system/app) and privileged (/system/priv-app)?

3. Do they share the same or different uid?

4. Basic principle in introducing priv-app, when system app concept was already present?

5. What does OR means in "SignatureORSystem"? Why can't it just be "System"?

My understanding so far:

1. "SignatureOrSystem" permissions are only granted to apps present inside /system/priv-app and whitelisted in /etc/permissions. It need not be OEM signed or contains an android.uid.system.

2. "Signature" permissions are only be granted if an app is OEM signed (for pre-defined permissions). It need not be inside /system/priv-app or contains android.uid.system.

3. Declaring android.uid.system in Manifest does not make an app as a system app.

It's more of a reverse, only apps already satisfying system privilege conditions can ask for android.uid.system.

4. If an app is needed for a device to work but, doesn't hold any sensitive permissions then it can be placed in /system/app.

If it holds the sensitive permissions then it's placed inside /system/priv-app.

5. Apps inside /system/priv-app and whitelisted in /etc/permission is implicitly granted system privilege.

6. Apps inside /system/app is just like 3rd party apps unless it's OEM signed. (except the uninstallation part)