4 ms·
Does the patch allow the spoofing of Google packages only, or are signature checks disabled for all apps?
by dessant 7y ago
Does the patch allow the spoofing of Google packages only, or are signature checks disabled for all apps?
- SXX 7y agoSignature spoof require specific permission and it's only available for system apps. So there is no way any app can abuse it unless you specifically allow it.
- codethief 7y agoFrom the FAQ on the page I linked to above: > Why do we need a custom build of LineageOS to have microG? Can't I install microG on the official LineageOS? > MicroG requires a patch called "signature spoofing", which allows the microG's apps to spoof themselves as Google Apps. LineageOS' developers refused (multiple times) to include the patch, forcing us to fork their project. > Wait, on their FAQ page I see that they don't want to include the patch for security reasons. Is this ROM unsafe? > No. LineageOS' developers decided not to include this patch for various reasons. The signature spoofing could be an unsafe feature only if the user blindly gives any permission to any app, as this permission can't be obtained automatically by the apps. Moreover, to further strengthen the security of our ROM, we modified the signature spoofing permission so that only system privileged apps can obtain it, and no security threat is posed to our users.
- testvox 7y agoIt allows spoofing for any apps the user gives the spoofing permission to.