Android仅允许安装指定签名apk

需求：仅允许安装特定签名apk，其它签名apk禁止安装。

一、移植下面代码

shenhb@dqrd01:~/code/rk3288$ git show 814c25ddd422f8f44a3de9451ef25e296a298ea0
commit 814c25ddd422f8f44a3de9451ef25e296a298ea0
Author: shenhb <shenhb@topband.com.cn>
Date:   Thu Feb 20 11:31:19 2020 +0800

    仅允许安装指定签名apk，通过属性ro.signature配置签名sha1值

diff --git a/frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java b/frameworks/base
index b7171ba..414a064 100755
--- a/frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -355,6 +355,7 @@ import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.zip.GZIPInputStream;
+import java.util.Locale;
 
 /**
  * Keep track of all those APKs everywhere.
@@ -18605,6 +18606,37 @@ public class PackageManagerService extends IPackageManager.Stub
         Trace.traceEnd(TRACE_TAG_PACKAGE_MANAGER);
     }
 
+    // Add by shenhb@topband.com.cn, for only allow the specified signature apk.
+    private static String getFingerprint(Signature signature, String hashAlgorithm) {
+        if (signature == null) {
+            return null;
+        }
+        try {
+            MessageDigest digest = MessageDigest.getInstance(hashAlgorithm);
+            return toHexadecimalString(digest.digest(signature.toByteArray()));
+        } catch (NoSuchAlgorithmException e) {
+            // ignore
+        }
+        return null;
+    }
+
+    private static String toHexadecimalString(byte[] value) {
+        StringBuffer sb = new StringBuffer();
+        int len = value.length;
+        for (int i = 0; i < len; i++) {
+            int num = ((int) value[i]) & 0xff;
+            if (num < 0x10) {
+                sb.append('0');
+            }
+            sb.append(Integer.toHexString(num));
+            if (i < len - 1) {
+                sb.append(':');
+            }
+        }
+        return sb.toString().toUpperCase(Locale.US);
+    }
+    // Add end
+
     private void installPackageTracedLI(InstallArgs args, PackageInstalledInfo res) {
         try {
             Trace.traceBegin(TRACE_TAG_PACKAGE_MANAGER, "installPackage");
@@ -18771,6 +18803,20 @@ public class PackageManagerService extends IPackageManager.Stub
             return;
         }
 
+        // Add by shenhb@topband.com.cn, for only allow the specified signature apk.
+        String customSignature = SystemProperties.get("ro.signature", "");
+        if (!TextUtils.isEmpty(customSignature)) {
+            final Signature[] signatures = pkg.mSignatures;
+            Slog.d(TAG, "installPackageLI, Signature fingerprint "
+                    + getFingerprint(signatures[0], "SHA-1"));
+            if (!getFingerprint(signatures[0], "SHA-1").equals(customSignature)) {
+                res.setError(PackageManager.INSTALL_FAILED_VERIFICATION_FAILURE,
+                        "Signature verification failed");
+                return;
+            }
+        }
+        // Add end
+
         // Get rid of all references to package scan path via parser.
         pp = null;
         String oldCodePath = null;

二、属性配置签名sha1

考虑到方案的通用性，因此通过属性来配置签名。属性不配置的情况下，走Android默认逻辑，允许安装所有apk。属性配置后，只允许跟此签名匹配的apk安装。

2.1 获取签名sha1

1. 解压apk文件，提到META-INF/CERT.RSA（既签名文件公钥）。
2. 执行下面命令得到公钥sha1值。

F:\download
λ keytool -printcert -file CERT.RSA
所有者: CN=xxx, OU=xxx, O=xxx, L=xxx, ST=xxx, C=china
发布者: CN=xxx, OU=xxx, O=xxx, L=xxx, ST=xxx, C=china
序列号: xxxxxxx
有效期开始日期: Sun Feb 11 14:38:48 CST 2018, 截止日期: Thu Feb 05 14:38:48 CST 2043
证书指纹:
         MD5: 13:8A:22:DC:6E:6C:BA:27:42:8D:9F:C5:0D:D2:4E:14
         SHA1: 31:4E:FC:8C:68:FA:7E:F4:14:E7:27:C3:A9:C4:9C:F1:AB:1C:64:C2
         SHA256: 63:E0:0A:FF:45:7C:03:97:F5:27:64:C5:D4:DA:BD:8A:2E:63:40:E7:31:A3:C8:3D:FB:03:00:2A:9F:BE:71:EF
         签名算法名称: SHA256withRSA
         版本: 3

扩展:

#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: C9 41 D4 8D F0 58 FF E2   EE EF 7E 5E 3B 9D DA 44  .A...X.....^;..D
0010: 40 E5 DF FC                                        @...
]
]

2.2 配置属性

ro.signature=31:4E:FC:8C:68:FA:7E:F4:14:E7:27:C3:A9:C4:9C:F1:AB:1C:64:C2

三、验证

验证结果如下，非指定签名的apk安装失败，提示“Signature verification failed”，指定签名的apk安装成功。

λ adb install 001.apk
adb: failed to install 001.apk: Failure [INSTALL_FAILED_VERIFICATION_FAILURE: Signature verification failed]

λ adb install 002.apk
Success