2.9 KiB
2.9 KiB
Deployment-path comparison
| Path | Privilege / signer | AVB and SELinux | Persistence / rollback | Rating |
|---|---|---|---|---|
| A. ordinary APK update | exact Philips platform signer; no root | no AVB change; existing app domain | persistent in /data/app; OEM-tested uninstall-system-update rollback |
BEST FIRST TEST for APK targets when signed |
B. updated-system-app in /data/app |
same as A; Package Manager-managed | no image change; shared UID/signer still mandatory | OTA/factory-reset interactions testable; base APK remains | BEST FIRST TEST; technically the mechanism behind A |
| C. runtime instrumentation | root/engineering/instrumentation authority | may hit SELinux; no durable image | temporary, fragile, timing-dependent | HIGH RISK, diagnostic prototype only |
| D. bind mount changed file | root every boot plus compatible binary | underlying AVB unchanged, but labels/ART/package signature remain problems | nonstandard persistence; remove mount/reboot rollback | NOT PRACTICAL for APK/shared library release |
| E. system partition/image patch | vendor build or root+unlocked accepted image; platform signer for APKs | filesystem and AVB/vbmeta must be regenerated; labels exact | persistent; A/B image rollback if proven | GOOD LONG-TERM, currently blocked/high risk |
| F. vendor partition patch | accepted vendor image and policy coordination | cannot correctly relocate current /system targets; split-policy risk |
OTA-coupled | NOT PRACTICAL for these four targets |
| G. complete modified firmware | Philips source, platform/AVB/container keys and recovery | coherent SELinux, preopt and AVB | strongest reproducibility and A/B rollback when OEM-supported | GOOD LONG-TERM, unavailable today |
Exact root boundary
| Operation | UID1000 enough? | Root? | Bootloader/AVB? | Reason |
|---|---|---|---|---|
| one-time EPG data repair | yes | no | no | provider-owned app data; already validated |
| install accepted platform-signed APK update | Package Manager path | no | no | /data/app overlay mechanism |
| persistent Channels/GEL/TPTv replacement without OEM signer | no | not sufficient | image/accepted trust chain | shared UID signature remains enforced |
replace tvfw.jar temporarily |
no | yes | no for volatile bind; still unsafe | root mount plus shared-library/ART restart |
replace tvfw.jar persistently |
no | image path | yes/accepted AVB | verified /system and preopt coupling |
| bind mount | no | yes | no if volatile | mount capability and process restart |
| modify system/vendor image | no | build/flash authority | yes | locked green verified boot |
| selective adopted OEM directory/policy | app code plus vold/SELinux integration | engineering image, not runtime root as design goal | accepted image | new policy and lifecycle code |
Root is a deployment tool, not a fix. It neither reconstructs Philips private keys nor makes a modified image acceptable to locked AVB.