Feature Request: Implement per-package security patch configuration

[gavdoc38]

As per:
JingMatrix/TEESimulator#49

As a specific use case, this allows a private print (non Google Pixel beta/canary) to achieve <A13 PI STRONG and A13+ PI STRONG by specifying a different configuration for com.google.android.gms (separate from global config). This is not currently possible in TS.

[MhmRdd]

I don't think it can be implemented.
First, given that TrickyStore always tries to stay on the line with AOSP guidelines, putting an update to isolate this change is very unlikely.
and secondary, this information is usually backed by read-only props, unless we think of a way to specialize changes of it in the app process?

[gavdoc38]

I don't think it can be implemented. First, given that TrickyStore always tries to stay on the line with AOSP guidelines, putting an update to isolate this change is very unlikely. and secondary, this information is usually backed by read-only props, unless we think of a way to specialize changes of it in the app process?

I will leave the issue of deviating from AOSP guidelines as a decision for the authors (as indeed is the whole thing of course!).

But, in terms of possibility: firstly, TEE Simulator has implemented it so it is possible. But secondly, this isn't referring to modifying any read only props, but only the key attestation extension data which contains dates for os patch level, boot patch level and vendor patch level. Tricky Store already modifies this as specified in security_patch.txt for all packages in target.txt - it just takes only one configuration.

As is, Tricky Store does not modify any of the read only props and this change isn't requesting that. There are other solutions to do this whether on a global level with resetprop or targeted per app process like PIF does for DG or Targeted Fix does more generally.