If you think API has security risk, please report bug to Google. We
all want secure Android when first device ship.
On Mar 24, 6:02 am, Ben Dodson <[EMAIL PROTECTED]> wrote:
> what does that snippet do now?
>
> I was also thinking on my approach of creating my own Context with my
> own ClassLoader. I haven't thought it out completely but it may be a
> security risk, as you could override "com.google.os.securePackage" to
> do something else, and it may be possible to skirt around permissions.
> This is of course not what I'm trying to do =) But it may mean that
> method is not possible and/or should be examined as a possible
> security risk.
>
> I'm going to try something later today- I can define my own
> Context.getResources() method, so rather than launching activities,
> I'll have an alternate entry point called MyActivity.load(), called
> from within a Context with getResources overwritten to use that apk's
> resources.
>
> So many paths, so many dead ends ; (
>
> On Mar 23, 9:17 pm, tu <[EMAIL PROTECTED]> wrote:
>
> > I do think so! I think there is no way to register a manifest other than
> > package manager API now. The nearest approach I got is the following:
> > ActivityThread thread = ActivityThread.currentActivityThread();
> > PackageManager manager = this.getPackageManager();
> > PackageInfo info =
> > manager.getPackageArchiveInfo("/data/data/my.test/install/testHello.apk",
> > 0xffff);
> > ApplicationInfo ai = info.applicationInfo;
> > ai.dataDir = "/data/data/my.test";
> > ai.processName = "my.test";
> > ai.uid = 10008; //uid of the running package
> > ActivityThread.PackageInfo actPackageInfo = thread.getPackageInfo(ai,
> > Context.CONTEXT_IGNORE_SECURITY|Context.CONTEXT_INCLUDE_CODE
> > );
> > thread.getApplicationThread().scheduleLaunchActivity(intent, null,
> > ai.packageName, "/data/data/my.test/",
> > "/data/data/my.test/", ai.theme, ai.nonLocalizedLabel, ai.labelRes,
> > null, null, null, false);
>
> > It would work if ApplicationThread class is public.
>
> > 2008/3/24, [EMAIL PROTECTED] <
> > [EMAIL PROTECTED]>:
>
> > > I guess package manager API is what you want, hackbod said is still
> > > under development.
>
> > > On Mar 23, 5:03 pm, Ben Dodson <[EMAIL PROTECTED]> wrote:
> > > > Right, but is there a way to load these dynamically, given another
> > > > manifest file? Can I edit my manifest file on the fly and inject the
> > > > activities of the .apk I want to load? Or can I adjust the context I'm
> > > > running in so the downloaded .apk's manifest is used instead of my own
> > > > until it is removed from the application stack?
>
> > > > On Mar 23, 7:54 pm, "[EMAIL PROTECTED]"
>
> > > > <[EMAIL PROTECTED]> wrote:
> > > > >http://code.google.com/android/devel/bblocks-manifest.html
>
> > > > > "Every Activity must have an <activity> tag in the manifest whether it
> > > > > is exposed to the world or intended for use only within its own
> > > > > package. If an Activity has no matching tag in the manifest, you won't
> > > > > be able to launch it."
>
> > > > > On Mar 23, 3:17 pm, Ben Dodson <[EMAIL PROTECTED]> wrote:
>
> > > > > > Well it looks like I jumped the gun.. no, I haven't yet been able to
> > > > > > launch an activity from my data folder. I can load classes from them
> > > > > > with the PathClassLoader, but can't call an activity. I think I need
> > > > > > to somehow create a new Context with my PathClassLoader as the
> > > > > > ClassLoader. Then use this context to run:
>
> > > > > > Context packageContext =
> > > > > > context.createPackageContext(mclassname.substring(
> > > mclassname.lastIndexOf(". ")),
> > > > > > Context.CONTEXT_IGNORE_SECURITY);
> > > > > > intent = new Intent();
> > > > > > intent.setClass(packageContext, m_class);
>
> > > > > > no luck yet on creating that context.. I'm not positive this is the
> > > > > > way to go, but it's my best guess for now.
>
> > > > > > Is it possible to load the contents of a foreign .apk's manifest
> > > file
> > > > > > into the current context?
>
> > > > > > On Mar 23, 2:15 pm, tu <[EMAIL PROTECTED]> wrote:
>
> > > > > > > Can you launch an activity defined in
> > > "/data/data/my.app/files/test.apk" ?!
> > > > > > > For start an acitivity in a installed apk, just use
> > > > > > > Intent.setClassName(packageName,
> > > > > > > foreignClassName)
>
> > > > > > > 2008/3/23, Ben Dodson <[EMAIL PROTECTED]>:
>
> > > > > > > > Well thanks for the help, I made some good progress on this once
> > > I
> > > > > > > > realized I needed the full path to the apk file
> > > (/data/data/my.app/
> > > > > > > > files/test.apk)
>
> > > > > > > > Now I'm able to load classes dynamically using the
> > > PathClassLoader and
> > > > > > > > instantiate/run methods on them. Dependency classes also load
> > > with no
> > > > > > > > problem, including the R class.
>
> > > > > > > > I'm still stuck on the last step of running an activity from
> > > > > > > > another .apk. I've tried two main approaches. One is to use
> > > > > > > > startActivity(this, foreignClass), so the context is that of the
> > > > > > > > calling app. The result:
>
> > > > > > > > ERROR/lobos(796): java.lang.RuntimeException: Not supported in
> > > system
> > > > > > > > context
> > > > > > > > ERROR/lobos(796): at
> > > > > > > > android.app.ApplicationContext.getPackageName(
> > > ApplicationContext.java:
> > > > > > > > 312)
> > > > > > > > ERROR/lobos(796): at
> > > > > > > > android.content.ComponentName.<init>(ComponentName.java:74)
> > > > > > > > ERROR/lobos(796): at android.content.Intent.setClass(
> > > Intent.java:
> > > > > > > > 2740)
> > > > > > > > [...]
>
> > > > > > > > I also tried instantiating the foreignClass (extends Activity)
> > > and
> > > > > > > > using that as the context:
>
> > > > > > > > ERROR/lobos(794): at
> > > > > > > > android.app.Activity.startSubActivity(Activity.java:1935)
> > > > > > > > ERROR/lobos(794): at
> > > > > > > > android.app.Activity.startActivity(Activity.java:1978)
> > > > > > > > ERROR/lobos(794): at
> > > > > > > > com.lobos.app.LobosAPKApp.launch(LobosAPKApp.java:68)
>
> > > > > > > > I'm sure there's a pretty hefty piece I'm not handling, but any
> > > ideas
> > > > > > > > what?
>
> > > > > > > > I tried overriding the getPackageName method
>
> > > > > > > > On Mar 19, 12:33 pm, tu <[EMAIL PROTECTED]> wrote:
> > > > > > > > > Yes, an apk file can be put into assets folder or any
> > > accessible path! I
> > > > > > > > > have been working on it over 2 months. I can download an apk
> > > file by
> > > > > > > > http
> > > > > > > > > and run code or use its resources dynamically, including
> > > version control
> > > > > > > > > features. It's a platfrom similar to OSGi or EclispeRCP. Now
> > > nearly
> > > > > > > > > everything goes smoothly.
>
> > > > > > > > > 2008/3/19, Peli <[EMAIL PROTECTED]>:
>
> > > > > > > > > > This sounds interesting. Can an apk file be put into the lib
> > > or assets
> > > > > > > > > > folder? If yes, then this would be an alternative to lib/jar
> > > for
> > > > > > > > > > including widgets with graphics and code...
>
> > > > > > > > > > Peli
>
> > > > > > > > > > On Mar 19, 3:14 pm, Ben Dodson <[EMAIL PROTECTED]> wrote:
> > > > > > > > > > > Thanks a ton, I'll play with this tonight and see how it
> > > goes.
>
> > > > > > > > > > > Ben
>
> > > > > > > > > > > On Mar 18, 4:46 pm, hackbod <[EMAIL PROTECTED]> wrote:
>
> > > > > > > > > > > > You should be able to use
> > > > > > > > > > > > android.lang.PathClassLoaderto create a
> > > > > > > > > > > > class loader for .apk. Just make an instance of the
> > > object with
> > > > > > > > the
> > > > > > > > > > > > full path the .apk and, if desired, a parent class
> > > loader that it
> > > > > > > > > > > > links with or
> > > > > > > > > > > > ClassLoader.getSystemClassLoader().getParent()
> > > for
> > > > > > > > just
> > > > > > > > > > > > the frameworks.
>
> > > > > > > > > > > > You can also load the resources from the .apk with code
> > > like this:
>
> > > > > > > > > > > > AssetManager assets = new AssetManager();
> > > > > > > > > > > > assets.addAssetPath(apkPath);
> > > > > > > > > > > > Resources r = new Resources(assets,
> > > myMetrics,
> > > > > > > > > > > > myConfiguration);
>
> > > > > > > > > > > > On Mar 18, 11:57 am, Ben Dodson <[EMAIL PROTECTED]>
> > > wrote:
>
> > > > > > > > > > > > > That sounds like exactly what we're hoping to do. Can
> > > you point
> > > > > > > > my
> > > > > > > > > > > > > towards any references for how to load the code from
> > > the
> > > > > > > > filesystem?
>
> > > > > > > > > > > > > Thanks,
> > > > > > > > > > > > > Ben
>
> > > > > > > > > > > > > On Mar 18, 1:06 pm, hackbod <[EMAIL PROTECTED]> wrote:
>
> > > > > > > > > > > > > > Hi Ben,
>
> > > > > > > > > > > > > > The package install API is still under development,
> > > and may
> > > > > > > > not be
> > > > > > > > > > > > > > working. I think right now the install package
> > > permission is
> > > > > > > > also
> > > > > > > > > > > > > > only allowed for built-in applications, since it
> > > will allow
> > > > > > > > you to
> > > > > > > > > > > > > > circumvent the permission system by deciding which
> > > permissions
> > > > > > > > to
> > > > > > > > > > > > > > allow: this API is really intended for use by a
> > > > > > > > graphicalinstaller
> > > > > > > > > > > > > > that is included with a shipping device, and when
> > > third party
> > > > > > > > apps
> > > > > > > > > > > > > > want to install something we will probably have an
> > > activity
> > > > > > > > they
> > > > > > > > > > can
> > > > > > > > > > > > > > launch to do so (to ensure the user is always
> > > involved in this
> > > > > > > > > > > > > > process).
>
> > > > > > > > > > > > > > I don't understand what you mean by your app being
> > > the launch
> > > > > > > > > > point of
> > > > > > > > > > > > > > other applications. Do you mean you want to make
> > > your own
> > > > > > > > private
> > > > > > > > > > > > > > world of applications that others don't see? If so,
> > > I really
> > > > > > > > > > don't
>
> ...
>
> read more »
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google
Groups "Android Developers" group.
To post to this group, send email to android-developers@googlegroups.com
To unsubscribe from this group, send email to
[EMAIL PROTECTED]
Announcing the new M5 SDK!
http://android-developers.blogspot.com/2008/02/android-sdk-m5-rc14-now-available.html
For more options, visit this group at
http://groups.google.com/group/android-developers?hl=en
-~----------~----~----~----~------~----~------~--~---
