philips-tv-speicher-voll/patches/phase7/TRUST-GRAPH.md

Phase 7B – Shared-UID and signature trust graph

Core graph

Philips/Android Platform Signer D8:FF:E0:AF:...:90:68
  ├─ framework-res.apk (`android`)
  ├─ Channels ───────────────┐
  ├─ GEL ────────────────────┤
  ├─ TPTvService ────────────┤
  ├─ Settings/OAD/USBService ┤
  └─ 58 packages total ──────┴─> sharedUser `android.uid.system`
                                      └─ Linux UID 1000 / `system_app`
                                           ├─ signature/platform permissions
                                           ├─ privileged Binder services
                                           ├─ Settings/Package/USB/user control
                                           └─ Philips TV providers/services

Separate trust domains:
  OTA release cert E0:18:AB:...:A0:F8 -> recovery/OTA certificate store
  AVB/vbmeta key                     -> public key not extracted; identity unknown

Exact UID1000 membership

The live PackageManager lists 58 packages in android.uid.system:

com.mediatek.tunerservice, org.droidtv.alhuewizard, org.droidtv.tv.packageinfo, com.android.networkstack.inprocess, org.droidtv.lkb, org.droidtv.epgdata, org.droidtv.factory, org.droidtv.homeintentresolver, com.mediatek.backgrounddetection, com.android.tv.settings, com.mediatek.tv.agent, org.droidtv.euinstallersat, com.mediatek.network, org.droidtv.nettvbrowser, android, org.droidtv.channels, com.android.location.fused, org.droidtv.sunrise, org.droidtv.tv.frameworklogger, com.android.providers.settings, com.android.inputdevices, org.droidtv.GlobalKey, org.droidtv.ci, org.droidtv.networkwizard, com.mediatek.tvinput, org.droidtv.xtv, org.droidtv.sam, org.droidtv.oad, org.droidtv.teletext, org.droidtv.nettvapps, org.droidtv.tv.tptvservice, com.android.localtransport, org.droidtv.devicesetup, com.phorus.playfi.softap, org.droidtv.contentexplorer, com.android.wallpaperbackup, org.droidtv.tv.inactivityservice, org.droidtv.icp, org.droidtv.settings, org.droidtv.tvsystemui, org.droidtv.exoplayerservice, org.droidtv.gel, org.droidtv.euinstallertc, com.android.dynsystem, com.android.keychain, org.droidtv.recommendation, org.droidtv.csm, org.droidtv.dukservice, org.droidtv.playtv, org.droidtv.common.accesshiddenapi, com.easy.oad, org.droidtv.candeebug, com.android.providers.tv, com.android.networkstack.tethering.inprocess, org.droidtv.usbbreakin, org.droidtv.tvpowermanagerservice.

Permission and dependency edges

The shared UID's PackageManager grant union includes especially sensitive platform permissions such as WRITE_SECURE_SETTINGS, INSTALL_PACKAGES, DELETE_PACKAGES, REBOOT, MASTER_CLEAR, MANAGE_USERS, INTERACT_ACROSS_USERS_FULL, MANAGE_USB, FORCE_STOP_PACKAGES, DUMP and TV_INPUT_HARDWARE, plus Philips TV/EPG channel/provider permissions. Some are also gated by privileged allowlists or component permissions; shared UID alone must not be read as an unconditional API guarantee.

Package	Shared boundary	Main dependency edges relevant to patching
Channels	UID1000 + Platform signer + privileged system app	EPG provider clients, channel/TV input data, Philips TV framework/library
GEL	UID1000 + Platform signer	WorkManager DB, Philips internal services, platform/signature APIs
TPTvService	UID1000 + Platform signer + persistent/core	boot-started TV service, storage monitor, Philips Binder/framework clients
Settings	UID1000 + Platform signer + privileged/persistent	UpdateEngine binding, secure/global settings, USB update receiver
OAD	UID1000 + Platform signer + privileged	OAD service and upgrade staging integration
EUM	Platform signer + privileged, separate UID	privileged package/update management; not protected by shared UID membership

Consequence of a signer change

Android requires applications sharing a UID to be signed compatibly. A newly built APK with a different certificate cannot legitimately join the existing android.uid.system group and cannot update the installed package. Removing the shared UID or changing package identity would create a different app, losing UID1000-owned data, access to signature permissions and provider/Binder relationships. Patching PackageManager checks would be a trust bypass and is outside scope.

Android's official app-signing documentation describes the same-certificate requirement for shared UIDs and signature permissions: https://source.android.com/docs/security/features/apksigning.