Skip to content

fwb: Added support for Signature Spoofing #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: c11
Choose a base branch
from
Open

fwb: Added support for Signature Spoofing #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
36e287e
fwb: Add support for app signature spoofing
kdrag0n Oct 5, 2020
c99025f
Use name instead of package name
Oct 13, 2020
8187642
PM: Signature spoofing [1/2]
mar-v-in Oct 18, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions api/current.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,7 @@ package android {
field public static final String DUMP = "android.permission.DUMP";
field public static final String EXPAND_STATUS_BAR = "android.permission.EXPAND_STATUS_BAR";
field public static final String FACTORY_TEST = "android.permission.FACTORY_TEST";
field public static final String FAKE_PACKAGE_SIGNATURE = "android.permission.FAKE_PACKAGE_SIGNATURE";
field public static final String FOREGROUND_SERVICE = "android.permission.FOREGROUND_SERVICE";
field public static final String GET_ACCOUNTS = "android.permission.GET_ACCOUNTS";
field public static final String GET_ACCOUNTS_PRIVILEGED = "android.permission.GET_ACCOUNTS_PRIVILEGED";
Expand Down Expand Up @@ -183,6 +184,7 @@ package android {
field public static final String CALL_LOG = "android.permission-group.CALL_LOG";
field public static final String CAMERA = "android.permission-group.CAMERA";
field public static final String CONTACTS = "android.permission-group.CONTACTS";
field public static final String FAKE_PACKAGE = "android.permission-group.FAKE_PACKAGE";
field public static final String LOCATION = "android.permission-group.LOCATION";
field public static final String MICROPHONE = "android.permission-group.MICROPHONE";
field public static final String NETWORK = "android.permission-group.NETWORK";
Expand Down
8 changes: 8 additions & 0 deletions core/java/android/provider/Settings.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15790,6 +15790,14 @@ public static final class Global extends NameValueTable {
LOCATION_GLOBAL_KILL_SWITCH,
};

/**
* Whether applications can fake a signature.
* 1 = permit apps to fake signature
* 0 = disable this feature
* @hide
*/
public static final String ALLOW_SIGNATURE_FAKE = "allow_signature_fake";

/**
* Keys we no longer back up under the current schema, but want to continue to
* process when restoring historical backup datasets.
Expand Down
15 changes: 15 additions & 0 deletions core/res/AndroidManifest.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2882,6 +2882,21 @@
android:description="@string/permdesc_getPackageSize"
android:protectionLevel="normal" />

<!-- Dummy user-facing group for faking package signature -->
<permission-group android:name="android.permission-group.FAKE_PACKAGE"
android:label="@string/permgrouplab_fake_package_signature"
android:description="@string/permgroupdesc_fake_package_signature"
android:request="@string/permgrouprequest_fake_package_signature"
android:priority="100" />

<!-- Allows an application to change the package signature as
seen by applications -->
<permission android:name="android.permission.FAKE_PACKAGE_SIGNATURE"
android:permissionGroup="android.permission-group.UNDEFINED"
android:protectionLevel="dangerous"
android:label="@string/permlab_fakePackageSignature"
android:description="@string/permdesc_fakePackageSignature" />

<!-- @deprecated No longer useful, see
{@link android.content.pm.PackageManager#addPackageToPreferred}
for details. -->
Expand Down
12 changes: 12 additions & 0 deletions core/res/res/values/colt_strings.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,4 +72,16 @@
<string name="systemui_restart_title">SystemUI restart required</string>
<string name="systemui_restart_message">For all changes to take effect, a SystemUI restart is required. Restart SystemUI now?</string>

<!-- MicroG -->
<string name="permlab_fakePackageSignature">Spoof package signature</string>
<!-- Description of an application permission, listed so the user can choose whether
they want to allow the application to do this. -->
<string name="permdesc_fakePackageSignature">Allows the app to pretend to be a different app. Malicious applications might be able to use this to access private application data. Legitimate uses include an emulator pretending to be what it emulates. Grant this permission with caution only!</string>
<!-- Title of a category of application permissions, listed so the user can choose whether they want to allow the application to do this. -->
<string name="permgrouplab_fake_package_signature">Spoof package signature</string>
<!-- Description of a category of application permissions, listed so the user can choose whether they want to allow the application to do this. -->
<string name="permgroupdesc_fake_package_signature">allow to spoof package signature</string>
<!-- Message shown to the user when the apps requests permission from this group. If ever possible this should stay below 80 characters (assuming the parameters takes 20 characters). Don't abbreviate until the message reaches 120 characters though. [CHAR LIMIT=120] -->
<string name="permgrouprequest_fake_package_signature">Allow
&lt;b><xliff:g id="app_name" example="Gmail">%1$s</xliff:g>&lt;/b> to spoof package signature?</string>
</resources>
2 changes: 2 additions & 0 deletions non-updatable-api/current.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,7 @@ package android {
field public static final String DUMP = "android.permission.DUMP";
field public static final String EXPAND_STATUS_BAR = "android.permission.EXPAND_STATUS_BAR";
field public static final String FACTORY_TEST = "android.permission.FACTORY_TEST";
field public static final String FAKE_PACKAGE_SIGNATURE = "android.permission.FAKE_PACKAGE_SIGNATURE";
field public static final String FOREGROUND_SERVICE = "android.permission.FOREGROUND_SERVICE";
field public static final String GET_ACCOUNTS = "android.permission.GET_ACCOUNTS";
field public static final String GET_ACCOUNTS_PRIVILEGED = "android.permission.GET_ACCOUNTS_PRIVILEGED";
Expand Down Expand Up @@ -183,6 +184,7 @@ package android {
field public static final String CALL_LOG = "android.permission-group.CALL_LOG";
field public static final String CAMERA = "android.permission-group.CAMERA";
field public static final String CONTACTS = "android.permission-group.CONTACTS";
field public static final String FAKE_PACKAGE = "android.permission-group.FAKE_PACKAGE";
field public static final String LOCATION = "android.permission-group.LOCATION";
field public static final String MICROPHONE = "android.permission-group.MICROPHONE";
field public static final String NETWORK = "android.permission-group.NETWORK";
Expand Down
27 changes: 24 additions & 3 deletions services/core/java/com/android/server/pm/PackageManagerService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4468,8 +4468,9 @@ private PackageInfo generatePackageInfo(PackageSetting ps, int flags, int userId
});
}

PackageInfo packageInfo = PackageInfoUtils.generate(p, gids, flags,
ps.firstInstallTime, ps.lastUpdateTime, permissions, state, userId, ps);
PackageInfo packageInfo = mayFakeSignature(p, PackageInfoUtils.generate(p, gids, flags,
ps.firstInstallTime, ps.lastUpdateTime, permissions, state, userId, ps),
permissions);

if (packageInfo == null) {
return null;
Expand Down Expand Up @@ -4505,6 +4506,26 @@ private PackageInfo generatePackageInfo(PackageSetting ps, int flags, int userId
}
}

private PackageInfo mayFakeSignature(AndroidPackage p, PackageInfo pi,
Set<String> permissions) {
try {
if (permissions.contains("android.permission.FAKE_PACKAGE_SIGNATURE")
&& p.getTargetSdkVersion() > Build.VERSION_CODES.LOLLIPOP_MR1
&& android.provider.Settings.Global.getInt(mContext.getContentResolver(),
android.provider.Settings.Global.ALLOW_SIGNATURE_FAKE, 0) == 1
&& p.getMetaData() != null) {
String sig = p.getMetaData().getString("fake-signature");
if (sig != null) {
pi.signatures = new Signature[] {new Signature(sig)};
}
}
} catch (Throwable t) {
// We should never die because of any failures, this is system code!
Log.w("PackageManagerService.FAKE_PACKAGE_SIGNATURE", t);
}
return pi;
}

@Override
public void checkPackageStartable(String packageName, int userId) {
final int callingUid = Binder.getCallingUid();
Expand Down Expand Up @@ -10662,7 +10683,7 @@ private void executeSharedLibrariesUpdateLPr(AndroidPackage pkg,
continue;
}
final PackageSetting staticLibPkgSetting = getPackageSetting(
toStaticSharedLibraryPackageName(sharedLibraryInfo.getPackageName(),
toStaticSharedLibraryPackageName(sharedLibraryInfo.getName(),
sharedLibraryInfo.getLongVersion()));
if (staticLibPkgSetting == null) {
Slog.wtf(TAG, "Shared lib without setting: " + sharedLibraryInfo);
Expand Down