ActivityManager.forceStopPackage() from Task Manager

Question

This is my first time posting here. I'm not sure if this is the right place to ask this question, but I don't seem to find other more appropriate places. Here's my question anyways.

I understand that the API ActivityManager.forceStopPackage() is an internal one and can be called only from system process. However, it puzzles me that the built-in Task Manager app (with package name com.motorola.PerformanceManager) on my motorola atrix phone can directly call it without being a system process. There are two things that I verified.

First, it is non-system process from ps command:

app_64 13681 1379 170788 29820 ffffffff 00000000 S com.motorola.PerformanceManager

Second, it indeed calls the ActivityManager.forceStopPackage() API from its odex file (decompiled into smali, then into dex, and then into java). From the smali code, it is already clear that it calls this API.

I also checked its AndroidManifest.xml file which seems nothing special to me (the forum mistakenly recognizes the content as URLs and prevents me from posting them).

The manifest file does include the android.permission.FORCE_STOP_PACKAGES permission which is supposed to be a system one. A non-system app will still get permission denial error even with this permission. I tried using reflection to access this API with android.permission.FORCE_STOP_PACKAGES permission but still get the runtime error.

Now, how can the built-in Task Manager app call the internal API without being a system process. One possibility is that the app is signed with the same platform private key. However, I'm not sure how I can verify that. Further, it is still supposed to be a system process with additional descriptions in the manifest file.

Hope someone can answer my question. Thanks.

Answer 1

The "android.permission.FORCE_STOP_PACKAGES" permission is protected by the platform signature.

If you have Android source code then check the declaration of the permission:

/frameworks/base/core/res/AndroidManifest.xml

...
    <permission android:name="android.permission.FORCE_STOP_PACKAGES"
        android:permissionGroup="android.permission-group.SYSTEM_TOOLS"
        android:protectionLevel="signature"
...

You can see its protection level is signature, then check the SDK documentation for the explaination:

"android:protectionLevel"

http://developer.android.com/guide/topics/manifest/permission-element.html#plevel

"signature...A permission that the system grants only if the requesting application is signed with the same certificate as the application that declared the permission. If the certificates match, the system automatically grants the permission without notifying the user or asking for the user's explicit approval"

The permission is declared by the framework-res which is signed by the platform signature, so the application that wants to use the permission shall also be signed with the same signature.

/frameworks/base/core/res/Android.mk

...
     LOCAL_PACKAGE_NAME := framework-res
     LOCAL_CERTIFICATE := platform
...

Regards

Ziteng Chen