oxmc
a48077078c
Android counterpart to git.oxmc.me/PawletOS/profiled's Linux daemon -- independent implementation, not a port. Same .vconfig profile format and 17 payload types, but implemented against DevicePolicyManager/VpnManager/ WifiManager/WallpaperManager/KeyChain instead of a native NDK Binder daemon, since that's where AOSP actually exposes this functionality. Self-provisions as device owner at first boot (DeviceOwnerProvisioner.kt) to unlock the DevicePolicyManager-gated payload types (cert, pkcs12, passcode, proxy, screensaver lock enforcement). 16 of 17 payload types are real implementations; firewall is a documented platform dead end (no app UID gets CAP_NET_ADMIN). See README's capability matrix for the full per-payload breakdown. Reviewed against the documented @SystemApi/hidden-API surface, not compiled -- no AOSP toolchain available in this environment.
94 lines
4.0 KiB
Plaintext
94 lines
4.0 KiB
Plaintext
// vendor/oxmc/PawletProfiled/Android.bp
|
|
// ─────────────────────────────────────────────────────────────────────────
|
|
// Drop this directory at vendor/oxmc/PawletProfiled/ and add
|
|
// "PawletProfiled" to PRODUCT_PACKAGES, plus
|
|
// PRODUCT_COPY_FILES += vendor/oxmc/PawletProfiled/etc/privapp-permissions-os.pawlet.profiled.xml:$(TARGET_COPY_OUT_SYSTEM)/etc/permissions/privapp-permissions-os.pawlet.profiled.xml
|
|
//
|
|
// This is the Android counterpart to git.oxmc.me/PawletOS/profiled's Linux
|
|
// daemon: same profile format (.vconfig, CMS/PKCS#7-signed YAML), same
|
|
// payload types, but implemented as a platform-signed priv-app + device
|
|
// owner instead of a native Binder daemon — most of what these payloads
|
|
// need (DevicePolicyManager, VpnManager, WifiManager, WallpaperManager,
|
|
// KeyChain) is Java-SDK-first on Android, not reachable cleanly from a
|
|
// native process. See README.md for the full capability matrix.
|
|
// ─────────────────────────────────────────────────────────────────────────
|
|
|
|
// ── AIDL interface ────────────────────────────────────────────────────────
|
|
|
|
aidl_interface {
|
|
name: "os.pawlet.profiled",
|
|
srcs: ["aidl/os/pawlet/profiled/IPawletProfileService.aidl"],
|
|
unstable: true, // app-hosted bound service, not a servicemanager HAL
|
|
backend: {
|
|
java: {
|
|
enabled: true,
|
|
sdk_version: "system_current",
|
|
},
|
|
cpp: { enabled: false },
|
|
ndk: { enabled: false },
|
|
},
|
|
}
|
|
|
|
// ── App ──────────────────────────────────────────────────────────────────
|
|
//
|
|
// Third-party deps (snakeyaml, Bouncy Castle bcprov/bcpkix, UnboundID
|
|
// LDAP SDK) are NOT vendored in this repo — pulled in via maven-to-lib
|
|
// (git.oxmc.me/PawletOS/maven-to-lib) as prebuilt_libs repos on the local
|
|
// manifest, same as every other Maven dep in the tree. Add to
|
|
// maven-to-lib's config.yml under `libs:`:
|
|
//
|
|
// - name: bouncycastle
|
|
// version: "1.78.1"
|
|
// artifacts:
|
|
// - { group: org.bouncycastle, artifact: bcprov-jdk18on, type: jar }
|
|
// - { group: org.bouncycastle, artifact: bcpkix-jdk18on, type: jar }
|
|
// - name: snakeyaml
|
|
// version: latest
|
|
// artifacts:
|
|
// - { group: org.yaml, artifact: snakeyaml, type: jar }
|
|
// - name: unboundid-ldapsdk
|
|
// version: latest
|
|
// artifacts:
|
|
// - { group: com.unboundid, artifact: unboundid-ldapsdk, type: jar }
|
|
//
|
|
// then add each output repo to the local manifest as
|
|
// prebuilts/application_libs/<name> (PawletOS/prebuilt_libs_<name>) per
|
|
// maven-to-lib's own docstring. Default bp_name is the bare artifact id,
|
|
// so the static_libs entries below (bcprov-jdk18on, bcpkix-jdk18on,
|
|
// snakeyaml, unboundid-ldapsdk) are what maven-to-lib generates unmodified
|
|
// — only add a bp_name override in config.yml if one of those collides
|
|
// with an existing in-tree module name.
|
|
|
|
android_app {
|
|
name: "PawletProfiled",
|
|
platform_apis: true,
|
|
certificate: "platform",
|
|
privileged: true,
|
|
system_ext_specific: false,
|
|
|
|
manifest: "AndroidManifest.xml",
|
|
resource_dirs: ["res"],
|
|
|
|
srcs: ["src/**/*.kt"],
|
|
|
|
static_libs: [
|
|
"os.pawlet.profiled-V1-java",
|
|
"snakeyaml",
|
|
"bcprov-jdk18on",
|
|
"bcpkix-jdk18on",
|
|
"unboundid-ldapsdk",
|
|
],
|
|
|
|
optimize: {
|
|
enabled: false, // system app; no need to shrink/obfuscate
|
|
},
|
|
|
|
required: ["privapp-permissions-os.pawlet.profiled.xml"],
|
|
}
|
|
|
|
prebuilt_etc {
|
|
name: "privapp-permissions-os.pawlet.profiled.xml",
|
|
src: "etc/privapp-permissions-os.pawlet.profiled.xml",
|
|
sub_dir: "permissions",
|
|
}
|