Install apps silently, with granted INSTALL_PACKAGES permission

Question

I am trying to silently install apk into the system. My app is located in /system/app and successfully granted permission "android.permission.INSTALL_PACKAGES"

However I can't find anywhere how to use this permission. I tried to copy files to /data/app and had no success. Also I tried using this code

    Intent intent = new Intent(Intent.ACTION_VIEW);
    intent.setDataAndType(
            Uri.parse("file:///sdcard/app.apk"),
            "application/vnd.android.package-archive");
    startActivity(intent);

But this code opens standard installation dialog. How can I install app silently without root with granted android.permission.INSTALL_PACKAGES?

PS I am writing an app that will install many apks from folder into the system on the first start (replace Setup Wizard). I need it to make firmware lighter.

If you think that I am writing a virus: All programs are installed into /data/app. Permission Install_packages can only be granted to system-level programs located in /system/app or signed with the system key. So virus can't get there.

As said http://www.mail-archive.com/[email protected]/msg06281.html apps CAN be silent installed if they have install_packages permission. Moreover you don't need Install_packages permission to install packages not silently. Plus http://www.androidzoom.com/android_applications/tools/silent-installer_wgqi.html

Pasho

@Fosco Suppose he's making such a device as original equipment manufacturer? – Tytybald

@Fosco Who cares? It's a valid question like dascandy describes. It's generally unproductive when people respond to questions like these with "You shouldn't be doing that". What understanding are we gaining with that kind of an answer? – Kalpa

Speaking of unproductive.. you're a little more than 2 years late to this party Zach, and the question looks far different than it originally did. – Brochure

@Brochure LOL. Also I can confirm that this is still working in newest android OS. – Pasho

How does FDroid accomplish this? Or does it not install things silently? – Spiker

@Spiker I just installed the F-Droid app: They don't install things silently, They just prompt the Android'd Package Manager. – Coroner

Answer 1

Your first bet is to look into Android's native PackageInstaller. I would recommend modifying that app the way you like, or just extract required functionality.

---

Specifically, if you look into PackageInstallerActivity and its method onClickListener:

 public void onClick(View v) {
    if(v == mOk) {
        // Start subactivity to actually install the application
        Intent newIntent = new Intent();
        ...
        newIntent.setClass(this, InstallAppProgress.class);
        ...
        startActivity(newIntent);
        finish();
    } else if(v == mCancel) {
        // Cancel and finish
        finish();
    }
}

Then you'll notice that actual installer is located in InstallAppProgress class. Inspecting that class you'll find that initView is the core installer function, and the final thing it does is call to PackageManager's installPackage function:

public void initView() {
...
pm.installPackage(mPackageURI, observer, installFlags, installerPackageName);
}

Next step is to inspect PackageManager, which is abstract class. You'll find installPackage(...) function there. The bad news is that it's marked with @hide. This means it's not directly available (you won't be able to compile with call to this method).

 /**
  * @hide
  * ....
  */
  public abstract void installPackage(Uri packageURI,
             IPackageInstallObserver observer, 
             int flags,String installerPackageName); 

But you will be able to access this methods via reflection.

If you are interested in how PackageManager's installPackage function is implemented, take a look at PackageManagerService.

Summary

You'll need to get package manager object via Context's getPackageManager(). Then you will call installPackage function via reflection.

Kaleidoscope

Help! This technique results in: Caused by: java.lang.SecurityException: Neither user 10101 nor current process has android.permission.INSTALL_PACKAGES. Even though my app has that permission – Shovelboard

Your app requests that permission, but Android does not grant that permission to 3rd party apps. See LogCat for permission related logs. – Kaleidoscope

@Kaleidoscope i read that apps installed in /system/app will gain automaticly permission to use install_pakages but as described in this post it seems to not work. can you give me some hints? – Laundrywoman

The application must be signed with system certificate. Otherwise it will not get system privileges. – Kaleidoscope

Reflection doesn't work to access the function installPackage, I am getting permission err from the system. – Tantalate

How can I call installPackage via reflection? actually I can't do Method method = aPackageManagerClass.getMethod("installPackage", new Class[]{Uri.class, IPackageInstallObserver.class, Integer.TYPE, String.class}); given that also IPackageInstallObserver is hidden, can someone help me plese, posting the correct code to do reflection here. – Adallard

how to do it silently i.e without user's knowledge – Primine

@Kaleidoscope please give some clear examples? And what to do if i change these classes? – Vltava

If I compile my own PackageInstaller, does it need to be signed on a rooted device; i.e. can I use my own PackageInstaller instead of this one? – Filmer

I can't find the method "installPackage" into the PackageManager. Did it change name? – Kenner

All links in the answer are dead. – Sorites

What is the value of flags inside the installPackage parameter? – Showers

@Shilaghae, this interface is aidl. You can add aidl to your app and make own implementation. – Keeping

Answer 2

I have been implementing installation without user consent recently - it was a kiosk application for API level 21+ where I had full control over environment.

The basic requirements are

• API level 21+
• root access to install the updater as a system privileged app.

The following method reads and installs APK from InputStream:

public static boolean installPackage(Context context, InputStream in, String packageName)
            throws IOException {
        PackageInstaller packageInstaller = context.getPackageManager().getPackageInstaller();
        PackageInstaller.SessionParams params = new PackageInstaller.SessionParams(
                PackageInstaller.SessionParams.MODE_FULL_INSTALL);
        params.setAppPackageName(packageName);
        // set params
        int sessionId = packageInstaller.createSession(params);
        PackageInstaller.Session session = packageInstaller.openSession(sessionId);
        OutputStream out = session.openWrite("COSU", 0, -1);
        byte[] buffer = new byte[65536];
        int c;
        while ((c = in.read(buffer)) != -1) {
            out.write(buffer, 0, c);
        }
        session.fsync(out);
        in.close();
        out.close();

        Intent intent = new Intent(context, MainActivity.class);
        intent.putExtra("info", "somedata");  // for extra data if needed..

        Random generator = new Random();

        PendingIntent i = PendingIntent.getActivity(context, generator.nextInt(), intent,PendingIntent.FLAG_UPDATE_CURRENT);
            session.commit(i.getIntentSender());


        return true;
    }

The following code calls the installation

 try {
     InputStream is = getResources().openRawResource(R.raw.someapk_source);
                    installPackage(MainActivity.this, is, "com.example.apk");
     } catch (IOException e) {
                    Toast.makeText(MainActivity.this, e.getMessage(), Toast.LENGTH_SHORT).show();
     }

for the whole thing to work you desperately need INSTALL_PACKAGES permission, or the code above will fail silently

<uses-permission
        android:name="android.permission.INSTALL_PACKAGES" />

to get this permission you must install your APK as System application which REQUIRES root (however AFTER you have installed your updater application it seem to work WITHOUT root)

To install as system application I created a signed APK and pushed it with

adb push updater.apk /sdcard/updater.apk

and then moved it to system/priv-app - which requires remounting FS (this is why the root is required)

adb shell
su
mount -o rw,remount /system
mv /sdcard/updater.apk /system/priv-app
chmod 644 /system/priv-app/updater.apk

for some reason it didn't work with simple debug version, but logcat shows useful info if your application in priv-app is not picked up for some reason.

Pertain

"for some reason it didn't work with simple debug version" Do you mean it worked in release, or some other less "simple" debug version? – Continuator

@JMLord It worked with signed release version, and did not work both with signed and unsigned debug versions - I find it strange that it didn't work with signed debug version I but I didn't have time to investigate. Nevertheless system logcat log is very important to find out if the APK is installed or not. – Pertain

Indeed, for some reason, installing as release was the key to get the INSTALL_PACKAGES permission. The app could run in signed debug from priv-app, but the permission request was rejected. Thanks a lot! – Continuator

@BorisTreukhov Hey can I check with you regarding what is the packageName parameter is for? I changed the InputStream to FileInputStream but I am getting this error message: Failed to parse /data/app/vmdl676191029.tmp/COSU – Martine

how to install system priv app after these commands ? – Rutilant

I can verify this works in 2022 in Android 13. The exec approach that is more popular I could not get working. – Gaylor

Answer 3

I have checked how ADB installs apps.
- It copies the APK to /data/local/tmp
- it runs 'shell:pm install /data/local/tmp/app.apk'

I have tried to replicate this behaviour by doing: (on pc, using usb-cable)
adb push app.apk /sdcard/app.apk
adb shell
$ pm install /sdcard/app.apk
This works. The app is installed.

I made an application (named AppInstall) which should install the other app.
(installed normally, non-rooted device)
It does:
Runtime.getRuntime().exec("pm install /sdcard/app.apk").waitFor();
But this gives the error:
java.lang.SecurityException: Neither user 10019 nor current process has android.permission.INSTALL_PACKAGES.
It seems like the error is thrown by pm, not by AppInstall.
Because the SecurityException is not catched by AppInstall and the app does not crash.

I've tried the same thing on a rooted device (same app and AppInstall) and it worked like a charm.
(Also normally installed, not in /system or anything)
AppInstall didn't even ask root-permission.
But thats because the shell is always # instead of $ on that device.

Btw, you need root to install an app in /system, correct?
I tried adb remount on the non-rooted device and got:
remount failed: Operation not permitted.
That's why I could not try the /system thing on the non-rooted device.

Conclusion: you should use a rooted device
Hope this helps :)

Jenaejenda

I can't seem to get this to work. It's interesting that the command works fine in ADB shell and then doesn't seem to work when I try to run it programmatically. – Bidwell

Yep, I have the same problem - works in shell, but not when called from my app, even if I call it via su) – Cayenne

Is there any other way to work in Google devices like get super admin permissions? – Scrub

If you want super admin permissions you should: 1) root your device, 2) have the app installed on the system-partition, 3) or the app should be signed with the same key as the OS itself. – Jenaejenda

It happens because ADB user and your application`s user have different permissions – Hyder

Answer 4

You should define

<uses-permission
    android:name="android.permission.INSTALL_PACKAGES" />

in your manifest, then if whether you are in system partition (/system/app) or you have your application signed by the manufacturer, you are going to have INSTALL_PACKAGES permission.

My suggestion is to create a little android project with 1.5 compatibility level used to call installPackages via reflection and to export a jar with methods to install packages and to call the real methods. Then, by importing the jar in your project you will be ready to install packages.

Holmberg

Answer 5

I tried on rooted Android 4.2.2 and this method works for me:

private void installApk(String filename) {
    File file = new File(filename); 
    if(file.exists()){
        try {   
            final String command = "pm install -r " + file.getAbsolutePath();
            Process proc = Runtime.getRuntime().exec(new String[] { "su", "-c", command });
            proc.waitFor();
        } catch (Exception e) {
            e.printStackTrace();
        }
     }
}

Tartrazine

The question was about installing apps without root, but with system "INSTALL_PACKAGES" permission. I see "su" in your answer, so it requires root. – Pasho

Thank you so much for this answer! I had the same code but I was using "adb install -r " instead of "pm install -r " and it would NOT work for me. You have saved me a lot of time here! – Punnet

@Vladmir i need your help. Can u give me some time. I will be very grateful to u – Granular

What is "-c" in the commands ? It is not working in Android 10 even in rooted device? – Outofdoor

Answer 6

I had no idea of how to do this, because nobody answered that time, and I found no documentation about this permission. So I found my own solution. It is worser that yours, but this is a solution anyway.

I installed busybox, that set 777 permission to /data/app (I dont care about security). Then just executed "busybox install" from app. This works, but has a big security leak. If you set permissions 777, no root required.

Pasho

did you use code like this? Process install; install = Runtime.getRuntime().exec("/system/bin/busybox install " + myAPK.getAbsolutePath()); int iSuccess = install.waitFor(); – Mccrea

Answer 7

You can use the hidden API android.content.pm.IPackageInstallObserver by reflection:

public class PackageManagement {
    public static final int INSTALL_REPLACE_EXISTING = 0x00000002;
    public static final int INSTALL_SUCCEEDED = 1;

    private static Method installPackageMethod;
    private static Method deletePackageMethod;

    static {
        try {
            installPackageMethod = PackageManager.class.getMethod("installPackage", Uri.class, IPackageInstallObserver.class, Integer.TYPE, String.class);
        } catch (NoSuchMethodException e) {
            e.printStackTrace();
        }
    }

    public static void installPackage(PackageManager pm, Uri mPackageUri, IPackageInstallObserver observer, int installFlags, String installerPackageName) {
        try {
            installPackageMethod.invoke(pm, mPackageUri, observer, installFlags, installerPackageName);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

Import android.content.pm.IPackageInstallObserver into your project. Your app must be system. You must activate the permission android.permission.INSTALL_PACKAGES in your manifest file.

Languishment

Have you tested this code on Lollipop and Marshamallow ? Seems like an awesome approach to me and I want to use it – Tack

I have tested from ICS to Lollipop – Languishment

The line to look is "your app must be system". I'm fairly sure this would work on lollipop or whatever - granted that your app is "system", that is, your app has system permissions(basically root). In that case though, you can also use the command line installer. – Mihalco

how am I calling the installPackage method? Meaning, how do I get a IPackageInstallObserver for example? – Triangular

What is thevalue of installFlags? – Showers

Since android.content.pm.IPackageInstallObserver is hidden, you can't import it to your project. – Darnelldarner

Answer 8

You can simply use adb install command to install/update APK silently. Sample code is below

public static void InstallAPK(String filename){
    File file = new File(filename); 
    if(file.exists()){
        try {   
            String command;
            filename = StringUtil.insertEscape(filename);
            command = "adb install -r " + filename;
            Process proc = Runtime.getRuntime().exec(new String[] { "su", "-c", command });
            proc.waitFor();
        } catch (Exception e) {
        e.printStackTrace();
        }
     }
  }

Chungchungking

Here what is meant by StringUtils? Am facing error as cannot be resolved? – Celebrity

sorry I should've explained. this is my custom class for strings and this method make sures that path is correct. you can ignore that – Chungchungking

what is StringUtil class. can you post StringUtil.insertEscape() method?. beuause if i comment that line i am getting exception Error running exec(). Command: [su, -c, adb install -r /storage/sdcard0/Android/data/com.install.file Thanks in advance – Hum

java.io.IOException: Error running exec(). Command: [su, -c, adb install -r /storage/emulated/0/download/SwipeAnimation.apk] Working Directory: null Environment: null -- can you explain the error.. ? and if any permissions in manifest – Stemson

@SandeepMaram public static String insertEscape(String text){ return text.replace(" ", "\\ "); } – Chungchungking

@Sandy09 is you device is rooted? – Chungchungking

@ZeeShaNAbbAs after rooting problem solved .. thanks – Stemson

Answer 9

I checked all the answers, the conclusion seems to be you must have root access to the device first to make it work.

But then I found these articles very useful. Since I'm making "company-owned" devices.

How to Update Android App Silently Without User Interaction

Android Device Owner - Minimal App

Here is google's the documentation about "managed-device"

Fully managed device

Sanguineous

Answer 10

Prerequisite:

Your APK needs to be signed by system as correctly pointed out earlier. One way to achieve that is building the AOSP image yourself and adding the source code into the build.

Code:

Once installed as a system app, you can use the package manager methods to install and uninstall an APK as following:

Install:

public boolean install(final String apkPath, final Context context) {
    Log.d(TAG, "Installing apk at " + apkPath);
    try {
        final Uri apkUri = Uri.fromFile(new File(apkPath));
        final String installerPackageName = "MyInstaller";
        context.getPackageManager().installPackage(apkUri, installObserver, PackageManager.INSTALL_REPLACE_EXISTING, installerPackageName);
        return true;
    } catch (Exception e) {
        e.printStackTrace();
        return false;
    }
}

Uninstall:

public boolean uninstall(final String packageName, final Context context) {
    Log.d(TAG, "Uninstalling package " + packageName);
    try {
        context.getPackageManager().deletePackage(packageName, deleteObserver, PackageManager.DELETE_ALL_USERS);
        return true;
    } catch (Exception e) {
        e.printStackTrace();
        return false;
    }
}

To have a callback once your APK is installed/uninstalled you can use this:

/**
 * Callback after a package was installed be it success or failure.
 */
private class InstallObserver implements IPackageInstallObserver {

    @Override
    public void packageInstalled(String packageName, int returnCode) throws RemoteException {

        if (packageName != null) {
            Log.d(TAG, "Successfully installed package " + packageName);
            callback.onAppInstalled(true, packageName);
        } else {
            Log.e(TAG, "Failed to install package.");
            callback.onAppInstalled(false, null);
        }
    }

    @Override
    public IBinder asBinder() {
        return null;
    }
}

/**
 * Callback after a package was deleted be it success or failure.
 */
private class DeleteObserver implements IPackageDeleteObserver {

    @Override
    public void packageDeleted(String packageName, int returnCode) throws RemoteException {
        if (packageName != null) {
            Log.d(TAG, "Successfully uninstalled package " + packageName);
            callback.onAppUninstalled(true, packageName);
        } else {
            Log.e(TAG, "Failed to uninstall package.");
            callback.onAppUninstalled(false, null);
        }
    }

    @Override
    public IBinder asBinder() {
        return null;
    }
}

/**
 * Callback to give the flow back to the calling class.
 */
public interface InstallerCallback {
    void onAppInstalled(final boolean success, final String packageName);
    void onAppUninstalled(final boolean success, final String packageName);
}

===> Tested on Android 8.1 and worked well.

Triangular

i need your help. Can u give me some time. I will be very grateful to u – Granular

I want your help. I need to know how can we create our own AOSP – Granular

Answer 11

As @inazaruk mentioned in the answer, installPackage method is hidden, and you need to call it by reflection. But, IPackageInstallObserver callback is also hidden which is passed to installPackage as a parameter, so you need to use a Dynamic Proxy to be able to implement this interface. Below you can find a code snippet using both reflection and proxy:

private void silentAppInstall(Uri apkUri){
        PackageManager pm = getContext().getPackageManager();
        try {
            Class<?> cPackageInstallObserver = Class.forName("android.content.pm.IPackageInstallObserver");
            Object installObserver = Proxy.newProxyInstance(cPackageInstallObserver.getClassLoader(),
                    new Class[]{cPackageInstallObserver}, new InstallObserverHandler());
            Class<?>[] types = new Class[] {Uri.class, cPackageInstallObserver, int.class, String.class};
            Method method = pm.getClass().getMethod("installPackage", types);
            method.invoke(pm, apkUri, installObserver, 2, null);
        } catch (NoSuchMethodException | ClassNotFoundException | IllegalAccessException | InvocationTargetException e) {
            e.printStackTrace();
        }
}

static class InstallObserverHandler implements InvocationHandler {

        @Override
        public Object invoke(Object o, Method method, Object[] args) throws Throwable {
            if (method.getName().equals("packageInstalled")){
                // Place you code here
            }
            return null;
        }
}

Darnelldarner

Answer 12

I made a test app for silent installs, using PackageManager.installPackage method.

I get installPackage method through reflection, and made android.content.pm.IPackageInstallObserver interface in my src folder (because it's hidden in android.content.pm package).

When i run installPackage, i got SecurityException with string indication, that my app has no android.permission.INSTALL_PACKAGES, but it defined in AndroidManifest.xml.

So, i think, it's not possible to use this method.

PS. I tested in on Android SDK 2.3 and 4.0. Maybe it will work with earlier versions.

Brasilein

It's working in 4.1 and 4.0 as well as in any android version higher that 2.1 (including 2.1). I am using 4.0 SDK now. You need to add it to /system/app folder, otherwise your app wont have required system-level (not root) permissions. Also I as able to delete apps silently with this method, check my other question related to deletion. – Pasho

Yes, it works, but with root's permissions only. And it's not possible to install app into system/app on not-rooted device. – Tarbox

Not with root, but with system-level permissions. You can add it to /system/app if you are an manufacturer of firmware. In my case - I am (I ask manufacturers of devices to add my apks to firmware). You won't be able to install apps silently any other way - otherwise it would be a great security hole. – Pasho

About security hole - i absolutely agree with you. And it will be suprise for me, if this method works with any app. How can i install app into /system/app without rooting? I'm not manufacturer. – Tarbox

Without root or reflashing you can't. – Pasho

Answer 13

Try this LD_LIBRARY_PATH=/vendor/lib:/system/lib before pm install. It works well.

Doubleheader

Answer 14

An 3rd party application cannot install an Android App sliently. However, a 3rd party application can ask the Android OS to install a application.

So you should define this:

Intent intent = new Intent(Intent.ACTION_VIEW);
intent.setDataAndType(Uri.parse("file:///sdcard/app.apk", "application/vnd.android.package-archive");
startActivity(intent);

You can also try to install it as a system app to grant the permission and ignore this define. (Root Required)

You can run the following command on your 3rd party app to install an app on the rooted device.

The code is:

private void installApk(String filename) {
File file = new File(filename); 
if(file.exists()){
    try {   
        final String command = "pm install -r " + file.getAbsolutePath();
        Process proc = Runtime.getRuntime().exec(new String[] { "su", "-c", command });
        proc.waitFor();
    } catch (Exception e) {
        e.printStackTrace();
    }
 }
}

I hope that this answer is helpful for you.

Combs

Answer 15

Its possible to do silent install on Android 6 and above. Using the function supplied in the answer by Boris Treukhov, ignore everything else in the post, root is not required either.

Install your app as device admin, you can have full kiosk mode with silent install of updates in the background.

Camass

Answer 16

you can use this in terminal or shell

adb shell install -g MyApp.apk

see more in develope google

Dobruja

Answer 17

!/bin/bash

f=/home/cox/myapp.apk   #or $1 if input from terminal.

#backup env var
backup=$LD_LIBRARY_PATH
LD_LIBRARY_PATH=/vendor/lib:/system/lib
myTemp=/sdcard/temp.apk
adb push $f $myTemp
adb shell pm install -r $myTemp
#restore env var
LD_LIBRARY_PATH=$backup

This works for me. I run this on ubuntu 12.04, on shell terminal.

Pomfrey