lbdroid
commented
8 years ago Should have been issued to global project
Closed lbdroid closed 8 years ago
lbdroid
commented
8 years ago Should have been issued to global project
Some projects, i.e. http://forum.xda-developers.com/nexus-6/themes-apps/viper4android-t2952137 require ability to add persistent changes to sepolicy. While it is certainly possible to add workarounds for specific projects in an as-needed basis, such as https://github.com/phhusson/super-bootimg/commit/213b4d92eb9d8f7a620b23693e7032b0c224ff02 , this solution is not sustainable long term.
Reasons; 1) Unknown number of projects may require such changes, 2) Such policy changes always introduce some security compromise by definition, even if not serious. 3) Potential for two or more policy changes working together to create an unexpected significant hole in security. 4) Causes harm through weakening of selinux policy to end users who don't need those compromises. 5) Requires maintenance on THIS end.
Solution; Have a list of custom policy changes required by end-users. Read that list during execution of this update package. Append them.
Might be appropriate to use the Superuser android application for maintenance of this list, having an appropriate intent for end user application to call in order to add policy change, and requiring user-authentication to complete the request. Superuser application can periodically check the installed applications to verify that all those with current policy changes are still installed, clear out policy changes for removed applications. It is also possible for Superuser application to initiate a reboot and update cycle.
http://android.stackexchange.com/questions/67622/shell-script-to-reboot-into-recovery-and-install-zip