[Android Software/Hacking General [Developers Only]] Lanchon:
> One of the things discussed is how to only allow PDroid settings to be changed by approved management apps. A solution might be to add signature-verification, but leave that available upon request. So anyone could fork the core and add their application to the approved managers list, or simply ask a maintainer of the OpenPDroid core to add it for them. But that is just one idea, and maybe there is problems there.

forking the core or having a centrally maintained whitelist seem like terrible solutions for users IMHO. if you consider that applying customized patches is such a big PITA compared to running autopatcher, i'm not sure they even qualify as solutions, i'd consider them very ugly hacks. please avoid this at all costs.

a) one solution would entail a very simple, small, no frills app that would be considered part of openpdroid. it's only job would be to let the user select which apps have access to the pdroid core. the core would be hard-linked to this app and this app only.

option 1: no app discovery: the app doesn't know which apps are interested in controlling pdroid.

the app would list all apps that have pdroid rights and let u revoke them in its main screen. to add an app, there could be an add button that lists all other apps (not nice), or instead of the add button there could be an activity that pdroid managers should be able invoke pointing to themselves (better option?). this screen would display a big warning and let u add the app or cancel the request. this precludes the need for app discovery.

option 2: there could be a tell tale sign in the pdroid manager apps that this app could detect and use to enumerate manager candidates. a checkbox list would determine which apps have rights. though more complex, the advantage of this option is that this whole thing has already been implemented in android in a security sensitive context and published under a free software license, so it can just be reused. i've seen this code; i can try and find it if there's interest.

b) a different solution wouldn't involve maintaining an app and would instead piggyback on android's existing infrastructure. it feels much more like a hack, it's not as clean, but it's better than hard-coding manager signatures IMHO. manager apps should request to be device administrators, and the user has to grant them this right in order for the pdroid core to honor their requests. unless android's admin framework can add custom permissions (i suspect it can't, but it might, i don't know), this would open the door to trojans: apps that request admin status with the excuse of, say, providing an instant security lock button for your phone (google "screen off and lock"), when in reality they want to covertly manipulate pdroid. if there is no custom admin permission support in android (again, IDK), some other fix would be needed to avoid this attack. one possibility: in order to access the core an app must 1) be a phone admin, 2) have a name that starts with "[PDroid] ". (told u it was more hackish! :) ) at least the apps that want to touch pdroid would be conspicuous, be listed together, and have to be manually authorized. this still leaves the door open to trojans: an app that requests admin and later gets renamed with a "[PDroid] " prefix in a later update. still, this might be visible during the update and one has very few trustworthy admin apps anyway. of particular concern is a trojan app that renames itself to mimic a well known manager name we r already using, say "[PDroid] PDroid Manager". would we be able to realize this is happening? if not, this whole idea should be discarded.