2

I have an application that needs root permissions to run. No biggie, all of my personal devices are rooted, so I am very comfortable with the process. The problem is that this application is to be used on company owned devices issued to certain employees and I don't want them to be able to uninstall the application nor do I want them having root access to the device.

I was thinking that the following process would accomplish my goals:

  1. Root the device
  2. Install my app as a system app
  3. Launch the application and grant su rights to it
  4. Unroot the device

Since it would be a system app, and the device wouldn't be rooted, users would be prevented from removing the app. What I am unsure of is whether or not that application would retain its root privileges once the device is unrooted?

Any feedback or insight would be greatly appreciated!

Improve this question
8
  • 2
    You cannot install your app as system app, as you need the same signing key that was used to sign the ROM in question. If device becomes unrooted, it automatically loses root.
    – t0mm13b
    Feb 27, 2014 at 14:19
  • 1
    What about applications like Titanium Backup Pro or /system/app mover that convert user apps to system apps? Using one of those applications it is possible to make a user app a system app.
    – ProNetGuru
    Feb 27, 2014 at 18:01
  • Even if this worked, what would prevent someone from rooting the device again and removing the app?
    – Chahk
    Feb 27, 2014 at 18:03
  • Technically, nothing. But since the app I'm looking to install is for monitoring and managing the device remotely, I'd be able to tell if they had.
    – ProNetGuru
    Feb 27, 2014 at 18:17
  • 3
    @t0mm13b Actually, that TiBu approach should work: root → install TiBu → convert app to system app (i.e. it gets installed to /system/apps) → uninstall TiBu → unroot. Done. That app would have access up to "signatureOrSystem" protection levels then. But giving it root access is something different (and probably not even needed here).
    – Izzy ♦
    Feb 27, 2014 at 22:30

1 Answer 1

Reset to default
1

As ProNetGuru already pointed out, Titanium Backup could indeed be used for that:

  1. root
  2. install TiBu
  3. convert app to system app (i.e. it gets installed to /system/apps
  4. uninstall TiBu
  5. unroot.

Done. That app would have access up to "signatureOrSystem" protection levels then (if specified so in its Manifest).

Giving it root access is something different – but probably not even needed here.

Improve this answer
12
  • For an app to have signatureOrSystem level would have to have android:sharedUserId="android.uid.system" in the manifest and signed with the same signing key as the ROM... tbh, have never tried it.. for a normal app that has normal manifest as in not having the above tag does not necessarily imply that it has that signatureOrSystem protection level, even if it was installed as a "system app".
    – t0mm13b
    Feb 27, 2014 at 22:43
  • Oh. I might have gotten that part wrong (so it's only protection-level "system" then; but what, please, is the difference between "signature" and "signatureOrSystem" then? There's no separate "protectionlevel system"). But please correct me: I thought it's not possible to "give an app root access" and then unroot the device while still having that sticking. So this is the closest one can get to, given the circumstances.
    – Izzy ♦
    Feb 27, 2014 at 22:54
  • signatureOrSystem protection level means it can do rm -rf / without needing root! And do things that a normal root can do (uid of 0) - that is ultimate. There's many different sharedUserId levels, such as for example: android.uid.phone, if that android:sharedUserId tag has the above example, it means an app can do anything relating to the telephony layer and nothing else. Its a far more finer grain of access control behind the scenes for system level apps and also to minimize breach and malice. All TiBu does, it remounts system r/w and moves the app there, nothing else.
    – t0mm13b
    Feb 27, 2014 at 23:03
  • 1
    OK, so I'll leave at this point. OP should test if it works for him, and then accept whichever of the two answers proved correct.
    – Izzy ♦
    Feb 28, 2014 at 13:07
  • 2
    I very much appreciate all of the information and insight provided by everyone. I will be testing this in the next week or so and will accept an answer and let everyone know how it works out.
    – ProNetGuru
    Feb 28, 2014 at 13:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .