164 lines
9.5 KiB
Diff
164 lines
9.5 KiB
Diff
From db57e0cf315286e83e3855d8aaf465fe5ea22dcb Mon Sep 17 00:00:00 2001
|
|
From: Danny Lin <danny@kdrag0n.dev>
|
|
Date: Sat, 16 Oct 2021 05:27:57 -0700
|
|
Subject: [PATCH 02/11] Add support for app signature spoofing
|
|
|
|
This is needed by microG GmsCore to pretend to be the official Google
|
|
Play Services package, because client apps check the package signature
|
|
to make sure it matches Google's official certificate.
|
|
|
|
This was forward-ported from the Android 10 patch by gudenau:
|
|
https://github.com/microg/android_packages_apps_GmsCore/pull/957
|
|
|
|
Changes made for Android 11:
|
|
- Updated PackageInfo calls
|
|
- Added new permission to public API surface, needed for
|
|
PermissionController which is now an updatable APEX on 11
|
|
- Added a dummy permission group to allow users to manage the
|
|
permission through the PermissionController UI
|
|
(by Vachounet <vachounet@live.fr>)
|
|
- Updated location provider comment for conciseness
|
|
|
|
Changes made for Android 12:
|
|
- Moved mayFakeSignature into lock-free Computer subclass
|
|
- Always get permissions for packages that request signature spoofing
|
|
(otherwise permissions are usually ommitted and thus the permission
|
|
check doesn't work properly)
|
|
- Optimize mayFakeSignature check order to improve performance
|
|
|
|
Changes made for Android 13:
|
|
- Computer subclass is now an independent class.
|
|
|
|
Change-Id: Ied7d6ce0b83a2d2345c3abba0429998d86494a88
|
|
---
|
|
core/api/current.txt | 2 ++
|
|
core/res/AndroidManifest.xml | 15 ++++++++++
|
|
core/res/res/values/strings.xml | 12 ++++++++
|
|
.../com/android/server/pm/ComputerEngine.java | 30 +++++++++++++++++--
|
|
4 files changed, 56 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/core/api/current.txt b/core/api/current.txt
|
|
index 288ab479c0fb..2124d89c6e6f 100644
|
|
--- a/core/api/current.txt
|
|
+++ b/core/api/current.txt
|
|
@@ -95,6 +95,7 @@ package android {
|
|
field public static final String EXECUTE_APP_ACTION = "android.permission.EXECUTE_APP_ACTION";
|
|
field public static final String EXPAND_STATUS_BAR = "android.permission.EXPAND_STATUS_BAR";
|
|
field public static final String FACTORY_TEST = "android.permission.FACTORY_TEST";
|
|
+ field public static final String FAKE_PACKAGE_SIGNATURE = "android.permission.FAKE_PACKAGE_SIGNATURE";
|
|
field public static final String FOREGROUND_SERVICE = "android.permission.FOREGROUND_SERVICE";
|
|
field public static final String FOREGROUND_SERVICE_CAMERA = "android.permission.FOREGROUND_SERVICE_CAMERA";
|
|
field public static final String FOREGROUND_SERVICE_CONNECTED_DEVICE = "android.permission.FOREGROUND_SERVICE_CONNECTED_DEVICE";
|
|
@@ -326,6 +327,7 @@ package android {
|
|
field public static final String CALL_LOG = "android.permission-group.CALL_LOG";
|
|
field public static final String CAMERA = "android.permission-group.CAMERA";
|
|
field public static final String CONTACTS = "android.permission-group.CONTACTS";
|
|
+ field public static final String FAKE_PACKAGE = "android.permission-group.FAKE_PACKAGE";
|
|
field public static final String LOCATION = "android.permission-group.LOCATION";
|
|
field public static final String MICROPHONE = "android.permission-group.MICROPHONE";
|
|
field public static final String NEARBY_DEVICES = "android.permission-group.NEARBY_DEVICES";
|
|
diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
|
|
index 8c9a3ff5149f..4a55643dc503 100644
|
|
--- a/core/res/AndroidManifest.xml
|
|
+++ b/core/res/AndroidManifest.xml
|
|
@@ -4250,6 +4250,21 @@
|
|
android:description="@string/permdesc_getPackageSize"
|
|
android:protectionLevel="normal" />
|
|
|
|
+ <!-- Dummy user-facing group for faking package signature -->
|
|
+ <permission-group android:name="android.permission-group.FAKE_PACKAGE"
|
|
+ android:label="@string/permgrouplab_fake_package_signature"
|
|
+ android:description="@string/permgroupdesc_fake_package_signature"
|
|
+ android:request="@string/permgrouprequest_fake_package_signature"
|
|
+ android:priority="100" />
|
|
+
|
|
+ <!-- Allows an application to change the package signature as
|
|
+ seen by applications -->
|
|
+ <permission android:name="android.permission.FAKE_PACKAGE_SIGNATURE"
|
|
+ android:permissionGroup="android.permission-group.UNDEFINED"
|
|
+ android:protectionLevel="signature|privileged"
|
|
+ android:label="@string/permlab_fakePackageSignature"
|
|
+ android:description="@string/permdesc_fakePackageSignature" />
|
|
+
|
|
<!-- @deprecated No longer useful, see
|
|
{@link android.content.pm.PackageManager#addPackageToPreferred}
|
|
for details. -->
|
|
diff --git a/core/res/res/values/strings.xml b/core/res/res/values/strings.xml
|
|
index 9c018c30f9e3..966fec172070 100644
|
|
--- a/core/res/res/values/strings.xml
|
|
+++ b/core/res/res/values/strings.xml
|
|
@@ -991,6 +991,18 @@
|
|
|
|
<!-- Permissions -->
|
|
|
|
+ <!-- Title of an application permission, listed so the user can choose whether they want to allow the application to do this. -->
|
|
+ <string name="permlab_fakePackageSignature">Spoof package signature</string>
|
|
+ <!-- Description of an application permission, listed so the user can choose whether they want to allow the application to do this. -->
|
|
+ <string name="permdesc_fakePackageSignature">Allows the app to pretend to be a different app. Malicious applications might be able to use this to access private application data. Legitimate uses include an emulator pretending to be what it emulates. Grant this permission with caution only!</string>
|
|
+ <!-- Title of a category of application permissions, listed so the user can choose whether they want to allow the application to do this. -->
|
|
+ <string name="permgrouplab_fake_package_signature">Spoof package signature</string>
|
|
+ <!-- Description of a category of application permissions, listed so the user can choose whether they want to allow the application to do this. -->
|
|
+ <string name="permgroupdesc_fake_package_signature">allow to spoof package signature</string>
|
|
+ <!-- Message shown to the user when the apps requests permission from this group. If ever possible this should stay below 80 characters (assuming the parameters takes 20 characters). Don't abbreviate until the message reaches 120 characters though. [CHAR LIMIT=120] -->
|
|
+ <string name="permgrouprequest_fake_package_signature">Allow
|
|
+ <b><xliff:g id="app_name" example="Gmail">%1$s</xliff:g></b> to spoof package signature?</string>
|
|
+
|
|
<!-- Title of an application permission, listed so the user can choose whether they want to allow the application to do this. -->
|
|
<string name="permlab_statusBar">disable or modify status bar</string>
|
|
<!-- Description of an application permission, listed so the user can choose whether they want to allow the application to do this. -->
|
|
diff --git a/services/core/java/com/android/server/pm/ComputerEngine.java b/services/core/java/com/android/server/pm/ComputerEngine.java
|
|
index 78f1fa60b69f..fb2f7da97cda 100644
|
|
--- a/services/core/java/com/android/server/pm/ComputerEngine.java
|
|
+++ b/services/core/java/com/android/server/pm/ComputerEngine.java
|
|
@@ -1450,6 +1450,29 @@ public class ComputerEngine implements Computer {
|
|
return result;
|
|
}
|
|
|
|
+ private boolean requestsFakeSignature(AndroidPackage p) {
|
|
+ return p.getMetaData() != null &&
|
|
+ p.getMetaData().getString("fake-signature") != null;
|
|
+ }
|
|
+
|
|
+ private PackageInfo mayFakeSignature(AndroidPackage p, PackageInfo pi,
|
|
+ Set<String> permissions) {
|
|
+ try {
|
|
+ if (p.getMetaData() != null &&
|
|
+ p.getTargetSdkVersion() > Build.VERSION_CODES.LOLLIPOP_MR1) {
|
|
+ String sig = p.getMetaData().getString("fake-signature");
|
|
+ if (sig != null &&
|
|
+ permissions.contains("android.permission.FAKE_PACKAGE_SIGNATURE")) {
|
|
+ pi.signatures = new Signature[] {new Signature(sig)};
|
|
+ }
|
|
+ }
|
|
+ } catch (Throwable t) {
|
|
+ // We should never die because of any failures, this is system code!
|
|
+ Log.w("PackageManagerService.FAKE_PACKAGE_SIGNATURE", t);
|
|
+ }
|
|
+ return pi;
|
|
+ }
|
|
+
|
|
public final PackageInfo generatePackageInfo(PackageStateInternal ps,
|
|
@PackageManager.PackageInfoFlagsBits long flags, int userId) {
|
|
if (!mUserManager.exists(userId)) return null;
|
|
@@ -1483,13 +1506,14 @@ public class ComputerEngine implements Computer {
|
|
|| ArrayUtils.isEmpty(p.getPermissions())) ? Collections.emptySet()
|
|
: mPermissionManager.getInstalledPermissions(ps.getPackageName());
|
|
// Compute granted permissions only if package has requested permissions
|
|
- final Set<String> grantedPermissions = ((flags & PackageManager.GET_PERMISSIONS) == 0
|
|
+ final Set<String> grantedPermissions = (((flags & PackageManager.GET_PERMISSIONS) == 0
|
|
+ && !requestsFakeSignature(p))
|
|
|| ArrayUtils.isEmpty(p.getRequestedPermissions())) ? Collections.emptySet()
|
|
: mPermissionManager.getGrantedPermissions(ps.getPackageName(), userId);
|
|
|
|
- PackageInfo packageInfo = PackageInfoUtils.generate(p, gids, flags,
|
|
+ PackageInfo packageInfo = mayFakeSignature(p, PackageInfoUtils.generate(p, gids, flags,
|
|
state.getFirstInstallTimeMillis(), ps.getLastUpdateTime(), installedPermissions,
|
|
- grantedPermissions, state, userId, ps);
|
|
+ grantedPermissions, state, userId, ps), grantedPermissions);
|
|
|
|
if (packageInfo == null) {
|
|
return null;
|
|
--
|
|
2.41.0
|
|
|