2

I have an application that needs root permissions to run. No biggie, all of my personal devices are rooted, so I am very comfortable with the process. The problem is that this application is to be used on company owned devices issued to certain employees and I don't want them to be able to uninstall the application nor do I want them having root access to the device.

I was thinking that the following process would accomplish my goals:

  1. Root the device
  2. Install my app as a system app
  3. Launch the application and grant su rights to it
  4. Unroot the device

Since it would be a system app, and the device wouldn't be rooted, users would be prevented from removing the app. What I am unsure of is whether or not that application would retain its root privileges once the device is unrooted?

Any feedback or insight would be greatly appreciated!

  • 2
    You cannot install your app as system app, as you need the same signing key that was used to sign the ROM in question. If device becomes unrooted, it automatically loses root. – t0mm13b Feb 27 '14 at 14:19
  • 1
    What about applications like Titanium Backup Pro or /system/app mover that convert user apps to system apps? Using one of those applications it is possible to make a user app a system app. – ProNetGuru Feb 27 '14 at 18:01
  • Even if this worked, what would prevent someone from rooting the device again and removing the app? – Chahk Feb 27 '14 at 18:03
  • Technically, nothing. But since the app I'm looking to install is for monitoring and managing the device remotely, I'd be able to tell if they had. – ProNetGuru Feb 27 '14 at 18:17
  • 3
    @t0mm13b Actually, that TiBu approach should work: root → install TiBu → convert app to system app (i.e. it gets installed to /system/apps) → uninstall TiBu → unroot. Done. That app would have access up to "signatureOrSystem" protection levels then. But giving it root access is something different (and probably not even needed here). – Izzy Feb 27 '14 at 22:30
1

As ProNetGuru already pointed out, Titanium Backup could indeed be used for that:

  1. root
  2. install TiBu
  3. convert app to system app (i.e. it gets installed to /system/apps
  4. uninstall TiBu
  5. unroot.

Done. That app would have access up to "signatureOrSystem" protection levels then (if specified so in its Manifest).

Giving it root access is something different – but probably not even needed here.

  • For an app to have signatureOrSystem level would have to have android:sharedUserId="android.uid.system" in the manifest and signed with the same signing key as the ROM... tbh, have never tried it.. for a normal app that has normal manifest as in not having the above tag does not necessarily imply that it has that signatureOrSystem protection level, even if it was installed as a "system app". – t0mm13b Feb 27 '14 at 22:43
  • Oh. I might have gotten that part wrong (so it's only protection-level "system" then; but what, please, is the difference between "signature" and "signatureOrSystem" then? There's no separate "protectionlevel system"). But please correct me: I thought it's not possible to "give an app root access" and then unroot the device while still having that sticking. So this is the closest one can get to, given the circumstances. – Izzy Feb 27 '14 at 22:54
  • signatureOrSystem protection level means it can do rm -rf / without needing root! And do things that a normal root can do (uid of 0) - that is ultimate. There's many different sharedUserId levels, such as for example: android.uid.phone, if that android:sharedUserId tag has the above example, it means an app can do anything relating to the telephony layer and nothing else. Its a far more finer grain of access control behind the scenes for system level apps and also to minimize breach and malice. All TiBu does, it remounts system r/w and moves the app there, nothing else. – t0mm13b Feb 27 '14 at 23:03
  • 1
    OK, so I'll leave at this point. OP should test if it works for him, and then accept whichever of the two answers proved correct. – Izzy Feb 28 '14 at 13:07
  • 2
    I very much appreciate all of the information and insight provided by everyone. I will be testing this in the next week or so and will accept an answer and let everyone know how it works out. – ProNetGuru Feb 28 '14 at 13:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.