Android : programmatically copying apk to /system/app

Question

I am trying to install a system app from my java code, and so far, I haven't had any success.

Following is what I have done so far:

1. My device is rooted.
2. My "installer" app is installed as a system app. (copied it manually to /system/app)
3. I have signed the installer apk with platform key, and I have android:sharedUserId="android.uid.system" in the Manifest.

4. I have been trying (and trying, and then some more) for Runtime.getRuntime.exec("su"). I intend to mount the system partition as rw, do a cat for the apk, and then make system partition ro. Following is the list of commands:

   mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system<br>
   cat /sdcard/application.apk > /system/app/application.apk<br>
   mount -o remount,ro -t yaffs2 /dev/block/mtdblock3 /system<br><br>The application.apk here is the app being installed from the installer app. This app is also signed with platform key, and has the sharedUserId configured.
   

5. I have requested for the INSTALL_PACKAGES permission in the manifest.

I have tried a number of variations of the exec("") format, including using 'su -c' with every command. I have gotten the Broken Pipe exception and Security exception. Sometimes, I don't get an exception, but the file isn't copied.

Please let me know what I am missing here. Has anyone got this working?

Thanks!

Deland

on a related note, what is the difference between an app signed with platform key and having sharedUserId=system; and an app present in /system/app? – Deland

applications in /system/app have access to permissions level 2 (not 1 as far as I know). Regardless of the permissions granted, applications with a sharedUserId of system inherit the permissions granted to the "parent" application, and in addition run in the same proces id as it's "parent". Various API's check the app's process id, and deny access to them if they are not of a specific kind. Although the 2 are mostly tightly linked, they do not always go hand in hand. This is the non-tech way to describe it, I'm sure other people would do a better job... – Singultus

Answer 1

I kept on digging, and here are the results:

• Android has this check in su.c: ["root of android source"/system/extras/su/su.c]

/* Until we have something better, only root and the shell can use su.*/
myuid = getuid();
if (myuid != AID_ROOT && myuid != AID_SHELL) {
    fprintf(stderr,"su: uid %d not allowed to su\n", myuid);
    return 1;
}

ChainsDD (SuperUser) and cyanogen mod get around this by implementing their own su.c: https://github.com/CyanogenMod/android_system_su/blob/master/su.c

• What's special about /system/app? It seems that it is the fact that the partition is read-only on non-rooted devices, preventing modification/uninstall of applications put there. https://android.stackexchange.com/questions/17871/what-are-the-differences-between-a-system-app-and-user-app

• An app signed with platform key and with sharedUserId = system is 'good enough' for my purposes, I don't specifically have to copy it to /system/app.

I am accepting this as answer for now.

Deland

can an app copy itself to system folder instead of using an external application? Can you please clarify the commands used to copy the app? Also, how can I get the platform key?Thank you. – Cresida