2

Scenario: I have an Android app that uses a LGPL licensed library. In order to satisfy this license, I dynamically link to said lib at runtime which allows the user change out the .so file if there was an update to the library or for any other reason.

Issue: In order to swap out the .so file, the user would have to unpack the apk, replace the .so file, repack it, then resign it. Tools like apktool work well for this but my app relies heavily on a backend which requires the apk to be signed by my keystore. So swapping out this library would render the app useless.

My Solution: When the user starts the app, I simply copy the .so from its home in "/data/data/package name/lib" to a directory that the user can access. I then usevoid *handle = dlopen("path/to/external/storage", RTLD_NOW|RTLD_GLOBAL); to link to the library. This solution works great allowing the user to freely change the .so file as they please.

My Question: Is there any security risk involved here? Other than watching Mr. Robot, I have no experience with "hacking". In this case, someone could modify and compile their own .so using the same symbols I link to which would allow them to run their code behind all the permissions that my app has allowed. Is this a potential threat or does it not matter because it would only be on that user's device? Is there a better way to go about this? Finally, do I even need to give the user access in this way since technically they can unpack and repack the apk to change the .so file so the LGPL is satisfied even though they would not be able to get past the login activity after doing so?

Improve this question
2
  • 1
    Cross posted here: programmers.stackexchange.com/q/332635/60357 Cross posting across different Stack Exchange sites is frowned upon. Please delete one post, and/or tailor each post to the scope of the site you're posting on. E.g. the licensing aspect is irrelevant here, and we can't help you with the security aspect on Programmers.
    – amon
    Oct 3, 2016 at 11:06
  • 1
    It also allows anyone who wants access to your app/appdata a way to freely change the .so file to whatever they want. I don't really see the point in allowing the user to change a random library. In my opinion it'd be better to simply update your app with an updated library as you see fit. Rather than relying on the user.
    – RoraΖ
    Oct 3, 2016 at 11:26

1 Answer 1

Reset to default
5

This is definitely dangerous as any program with the permission to change external storage (a large proportion of Android apps have this) can change the .so and run arbitrary code with your app's permissions.

If you really want the users to be able to change the library. You should provide a UI which allows them to pick a file and then copy the .so to your own app's /data directory before linking to it.

Improve this answer
2
  • Side note: to avoid file duplication, you could probably instead have the library selection dialog, but store a hash of the file rather than the file itself. ...There might be a possibility of the file getting changed WHILE you're using it, maybe, though I'm not sure.
    – Erhannis
    Jan 17, 2018 at 18:22
  • I would assume that .so files are small enough not to cause any issue even if copied to app's /data directory before using. A clever user could even create an .so file with only selected functions overridden and chain-link to original .so file to run other functions.
    – Mikko Rantalainen
    Feb 14, 2020 at 11:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .