Re: [android-developers] Abusing system privileges?

On Wed, Sep 14, 2011 at 1:19 PM, Peter Knego <peter@knego.net> wrote:
> It seems that it's possible to acquire system privileges by adding
>
> android:sharedUserId="android.uid.system"
>
> to manifest and using platform.pk8 & platform.x509.pem from android
> GIT to sign the app. The claim is here:
>
> http://stackoverflow.com/questions/7419924/android-system-apis
>
> Is this indeed possible?

For devices that signed their firmware with those keys, presumably.
AFAIK, those keys are for the emulator.

> Doesn't this defeat the purpose of system apps, i.e. apps that only
> Google or OEMs can provide?

Not really. Device manufacturers who use those keys are specifically
looking to enable these sorts of apps. Or, possibly, they are morons.

For further discussion of firmware issues, please use one of the
Google Groups found on http://source.android.com.

--
Mark Murphy (a Commons Guy)
http://commonsware.com | http://github.com/commonsguy
http://commonsware.com/blog | http://twitter.com/commonsguy

_The Busy Coder's Guide to *Advanced* Android Development_ Version 2.0
Available!

--
You received this message because you are subscribed to the Google
Groups "Android Developers" group.
To post to this group, send email to android-developers@googlegroups.com
To unsubscribe from this group, send email to
android-developers+unsubscribe@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/android-developers?hl=en