Scenario: I have an Android app that uses a LGPL licensed library. In order to satisfy this license, I dynamically link to said lib at runtime which allows the user change out the .so file if there was an update to the library or for any other reason.
Issue: In order to swap out the .so file, the user would have to unpack the apk, replace the .so file, repack it, then resign it. Tools like apktool work well for this but my app relies heavily on a backend which requires the apk to be signed by my keystore. So swapping out this library would render the app useless.
My Solution: When the user starts the app, I simply copy the .so from its home in
"/data/data/package name/lib" to a directory that the user can access. I then use
void *handle = dlopen("path/to/external/storage", RTLD_NOW|RTLD_GLOBAL); to link to the library. This solution works great allowing the user to freely change the .so file as they please.
My Question: Is there any security risk involved here? Other than watching Mr. Robot, I have no experience with "hacking". In this case, someone could modify and compile their own .so using the same symbols I link to which would allow them to run their code behind all the permissions that my app has allowed. Is this a potential threat or does it not matter because it would only be on that user's device? Is there a better way to go about this? Finally, do I even need to give the user access in this way since technically they can unpack and repack the apk to change the .so file so the LGPL is satisfied even though they would not be able to get past the login activity after doing so?