[Android Software/Hacking General [Developers Only]] wbedard:
OK, let's see if I can take a few bites at this elephant!

Your thoughts and insights are, likewise, greatly appreciated!

A default policy for user apps of "deny until allowed" would be my preference, too and I agree with much of your reasoning. I wonder if FFU5y would get a good sense for what the "lurker" portion of the OpenPDroid (OPD) community wanted if he established a Poll at the top of the thread? I think it's a good tool to use and, now that the thread has a lot of good content to help people base a decision on, maybe we should try it out!

As I have stated before, I rather like the idea of PDroid using something like PAC to "manage" the inner workings of OPD, though I am not enough of a developer to understand the ramifications of doing so. I can imagine PAC (possibly as a root app, less of an issue since it's open source) providing the option to "allow everything" or "deny everything" in case of an emergency/testing/whatever. This would be regardless of the individual app settings in PDroid Manager...and certainly not affecting/resetting them! Likewise, I think this is where you could set a default policy to "allow" or "deny." Obviously, arguments have been made against an "allow" policy, which I largely agree with, but this is where I imagine such functionality would be configured if both options were eventually provided for.

While I think I understand your point, this sounds like quite a bit of overkill, especially the rootkit part. Currently, I believe it would be quite trivial to detect PDroid since an app needs no permissions at all to detect the presence of the WRITE_PRIVACY_SETTINGS permission that a OPD management app would have registered. So, without some serious re-tooling, I think this is impractical in the short term. In the long term, I'd have to think about it but my gut is telling me that I wouldn't even want this (probably because of your usage of "rootkit"...).

I really do like the idea of "informed consent" to the user. Currently, a lot can be gleaned by a technical user looking at a "logcat." However, when a user decides to do something drastic, I really like the idea of a dialog that uses big fonts, big buttons with semi-randomized choices for "Yes" or "No" (cut down on a muscle memory response...) and gives them a bottom-line, worst-case summary like "all your data will be vulnerable" or "all access to your data will be blocked".

The idea of leveraging the "device admin" role is intriguing. I doubt it would block any realistic uptake of OPD since I'm guessing not many corporate phones using this Device Admin functionality would also be running OPD. I'll look into that feature and get a better understanding of how it works and what mechanisms it uses.

In case I missed something, could on of you please clarify what the "use case" for having a "tree" of apps each contributing to a inherited set of permissions? I may have missed something there but I agree that it sounds horribly complicated for what it might be worth.

I'll admit that I had to re-read this section several times before I (think I) understood what you were saying. On this last point though, I thought the database entries were created by the framework itself, not the manager app. For instance, if someone flashes a new OPD-enabled ROM but doesn't have the manager app installed yet, doesn't the framework apply the default profile (currently "allow") to new database entries as all the system apps get "discovered" during initial boot? On your other point though, I agree that the "sensible setting" you describe is what I would use, though I would be interested input from the broader community.[/QUOTE]

That's about all I have right now. I look fwd to continued discussion on these topics!

R/

wbedard