[Android Apps and Games] Tsjoklat:
On Post #92, I have removed the "nosigcheck" patch and added a "sysonly" patch instead to the modified versions of GSF. At first, I was concerned about removing the application level signature check security feature because any applications installed would be able to request sensitive permissions from Google's Framework Services. With my latest "sysonly" patch, instead of changing the "signature" permission to "normal" permission, I have changed it to "signatureOrSystem". What this means is, GSF will now only trust applications that exist on the system partition (/system/app/*) instead of trusting everything. So, if you install a malicious program and then move it over to your system partition, only then can it request sensitive permissions from GSF. I figured this was a much safer alternative. The permissions are also set to trust applications with the same signature, but I have created a secure private key to sign these modified versions with (so nobody will be able to make a malicious application with this signature).

--- AndroidManifest.xml.orig	2012-05-09 23:46:53.823494863 +0200
+++ AndroidManifest.xml	2012-05-09 23:48:47.627994470 +0200
@@ -9,23 +9,23 @@
<adopt-permissions android:name="com.google.android.googleapps" />
<permission android:label="@string/ro_perm_label" android:name="com.google.android.providers.talk.permission.READ_ONLY" android:protectionLevel="dangerous" android:permissionGroup="android.permission-group.MESSAGES" android:description="@string/ro_perm_desc" />
<permission android:label="@string/wo_perm_label" android:name="com.google.android.providers.talk.permission.WRITE_ONLY" android:protectionLevel="dangerous" android:permissionGroup="android.permission-group.MESSAGES" android:description="@string/wo_perm_desc" />
- <permission android:label="@string/sendTalkMsg_perm_label" android:name="com.google.android.gtalkservice.permission.GTALK_SERVICE" android:protectionLevel="signature" android:permissionGroup="android.permission-group.MESSAGES" android:description="@string/sendTalkMsg_perm_desc" />
+ <permission android:label="@string/sendTalkMsg_perm_label" android:name="com.google.android.gtalkservice.permission.GTALK_SERVICE" android:protectionLevel="signatureOrSystem" android:permissionGroup="android.permission-group.MESSAGES" android:description="@string/sendTalkMsg_perm_desc" />
<permission android:label="@string/permlab_heartbeat" android:name="com.google.android.gtalkservice.permission.SEND_HEARTBEAT" android:protectionLevel="signatureOrSystem" android:permissionGroup="android.permission-group.NETWORK" android:description="@string/permdesc_heartbeat" />
<permission android:label="@string/perm_data_msg_broadcast_label" android:name="com.google.android.permission.BROADCAST_DATA_MESSAGE" android:protectionLevel="signatureOrSystem" android:permissionGroup="android.permission-group.NETWORK" android:description="@string/perm_data_msg_broadcast_desc" />
<permission android:label="@string/perm_data_msg_broadcast_label" android:name="com.google.android.c2dm.permission.SEND" android:protectionLevel="signatureOrSystem" android:permissionGroup="android.permission-group.NETWORK" android:description="@string/perm_data_msg_broadcast_desc" />
<permission android:label="@string/perm_receive_data_message_label" android:name="com.google.android.c2dm.permission.RECEIVE" android:protectionLevel="normal" android:permissionGroup="android.permission-group.NETWORK" android:description="@string/perm_receive_data_message_desc" />
<permission android:label="@string/perm_xmpp_broadcast_label" android:name="com.google.android.xmpp.permission.BROADCAST" android:protectionLevel="signatureOrSystem" android:permissionGroup="android.permission-group.NETWORK" android:description="@string/perm_xmpp_broadcast_desc" />
- <permission android:label="@string/perm_receive_xmpp_label" android:name="com.google.android.xmpp.permission.SEND_RECEIVE" android:protectionLevel="signature" android:permissionGroup="android.permission-group.NETWORK" android:description="@string/perm_receive_xmpp_desc" />
- <permission android:label="@string/permlab_intentVendingOnly" android:name="com.android.vending.INTENT_VENDING_ONLY" android:protectionLevel="signature" android:description="@string/permdesc_intentVendingOnly" />
- <permission android:label="@string/permlab_readGsettings" android:name="com.google.android.providers.settings.permission.READ_GSETTINGS" android:protectionLevel="signature" android:description="@string/permdesc_readGsettings" />
- <permission android:label="@string/permlab_writeGsettings" android:name="com.google.android.providers.settings.permission.WRITE_GSETTINGS" android:protectionLevel="signature" android:description="@string/permdesc_writeGsettings" />
+ <permission android:label="@string/perm_receive_xmpp_label" android:name="com.google.android.xmpp.permission.SEND_RECEIVE" android:protectionLevel="signatureOrSystem" android:permissionGroup="android.permission-group.NETWORK" android:description="@string/perm_receive_xmpp_desc" />
+ <permission android:label="@string/permlab_intentVendingOnly" android:name="com.android.vending.INTENT_VENDING_ONLY" android:protectionLevel="signatureOrSystem" android:description="@string/permdesc_intentVendingOnly" />
+ <permission android:label="@string/permlab_readGsettings" android:name="com.google.android.providers.settings.permission.READ_GSETTINGS" android:protectionLevel="signatureOrSystem" android:description="@string/permdesc_readGsettings" />
+ <permission android:label="@string/permlab_writeGsettings" android:name="com.google.android.providers.settings.permission.WRITE_GSETTINGS" android:protectionLevel="signatureOrSystem" android:description="@string/permdesc_writeGsettings" />
<permission android:label="@string/permlab_readGservices" android:name="com.google.android.providers.gsf.permission.READ_GSERVICES" android:protectionLevel="normal" android:permissionGroup="android.permission-group.ACCOUNTS" android:description="@string/permdesc_readGservices" />
<permission android:label="@string/permlab_writeGservices" android:name="com.google.android.providers.gsf.permission.WRITE_GSERVICES" android:protectionLevel="signatureOrSystem" android:description="@string/permdesc_writeGservices" />
<permission-tree android:label="Google Services Permissions" android:name="com.google.android.googleapps.permission.GOOGLE_AUTH" />
- <permission android:label="@string/permlab_googleMailSwitch" android:name="com.google.android.googleapps.permission.GOOGLE_MAIL_SWITCH" android:protectionLevel="signature" android:description="@string/permdesc_googleMailSwitch" />
- <permission android:label="@string/permlab_googleAuthPassword" android:name="com.google.android.googleapps.permission.ACCESS_GOOGLE_PASSWORD" android:protectionLevel="signature" android:description="@string/permdesc_googleAuthPassword" />
+ <permission android:label="@string/permlab_googleMailSwitch" android:name="com.google.android.googleapps.permission.GOOGLE_MAIL_SWITCH" android:protectionLevel="signatureOrSystem" android:description="@string/permdesc_googleMailSwitch" />
+ <permission android:label="@string/permlab_googleAuthPassword" android:name="com.google.android.googleapps.permission.ACCESS_GOOGLE_PASSWORD" android:protectionLevel="signatureOrSystem" android:description="@string/permdesc_googleAuthPassword" />
<permission android:label="@string/permlab_googleAuth" android:name="com.google.android.googleapps.permission.GOOGLE_AUTH" android:protectionLevel="normal" android:permissionGroup="android.permission-group.ACCOUNTS" android:description="@string/permdesc_googleAuth" />
- <permission android:label="@string/permlab_googleAuth_ALL" android:name="com.google.android.googleapps.permission.GOOGLE_AUTH.ALL_SERVICES" android:protectionLevel="signature" android:permissionGroup="android.permission-group.ACCOUNTS" android:description="@string/permdesc_googleAuth_ALL" />
+ <permission android:label="@string/permlab_googleAuth_ALL" android:name="com.google.android.googleapps.permission.GOOGLE_AUTH.ALL_SERVICES" android:protectionLevel="signatureOrSystem" android:permissionGroup="android.permission-group.ACCOUNTS" android:description="@string/permdesc_googleAuth_ALL" />
<permission android:label="@string/permlab_googleAuth_OTHER" android:name="com.google.android.googleapps.permission.GOOGLE_AUTH.OTHER_SERVICES" android:protectionLevel="dangerous" android:permissionGroup="android.permission-group.ACCOUNTS" android:description="@string/permdesc_googleAuth_OTHER" />
<permission android:label="@string/permlab_googleAuth_mail" android:name="com.google.android.googleapps.permission.GOOGLE_AUTH.mail" android:protectionLevel="dangerous" android:permissionGroup="android.permission-group.ACCOUNTS" android:description="@string/permdesc_googleAuth_mail" />
<permission android:label="@string/permlab_googleAuth_cl" android:name="com.google.android.googleapps.permission.GOOGLE_AUTH.cl" android:protectionLevel="dangerous" android:permissionGroup="android.permission-group.ACCOUNTS" android:description="@string/permdesc_googleAuth_cl" />
@@ -62,8 +62,8 @@
<permission android:label="@string/permlab_googleAuth_writely" android:name="com.google.android.googleapps.permission.GOOGLE_AUTH.writely" android:protectionLevel="dangerous" android:permissionGroup="android.permission-group.ACCOUNTS" android:description="@string/permdesc_googleAuth_writely" />
<permission android:label="@string/permlab_googleAuth_wise" android:name="com.google.android.googleapps.permission.GOOGLE_AUTH.wise" android:protectionLevel="dangerous" android:permissionGroup="android.permission-group.ACCOUNTS" android:description="@string/permdesc_googleAuth_wise" />
<permission android:label="@string/permlab_googleAuth_grandcentral" android:name="com.google.android.googleapps.permission.GOOGLE_AUTH.grandcentral" android:protectionLevel="dangerous" android:permissionGroup="android.permission-group.ACCOUNTS" android:description="@string/permdesc_googleAuth_grandcentral" />
- <permission android:name="com.google.android.gsf.subscribedfeeds.permission.C2D_MESSAGE" android:protectionLevel="signature" />
- <permission android:name="android.server.checkin.CHECKIN.permission.C2D_MESSAGE" android:protectionLevel="signature" />
+ <permission android:name="com.google.android.gsf.subscribedfeeds.permission.C2D_MESSAGE" android:protectionLevel="signatureOrSystem" />
+ <permission android:name="android.server.checkin.CHECKIN.permission.C2D_MESSAGE" android:protectionLevel="signatureOrSystem" />
<uses-permission android:name="com.google.android.gsf.subscribedfeeds.permission.C2D_MESSAGE" />
<uses-permission android:name="android.server.checkin.CHECKIN.permission.C2D_MESSAGE" />
<uses-permission android:name="com.google.android.c2dm.permission.SEND" />