AppSandbox-System

The modified AOSP system edition of App Sandbox, based on AOSP android-12.1.0_r5 (SP2A.220505.002) branch.

Features & Modified projects

Dex hook

Modified art/runtime/native: Record when dex files and in memory dex loaded。

System tools

Added packages/apps/Terminal: Lineage OS Terminal application, run as shell permission.
Added external/libvterm: Dependency of Lineage OS Terminal application.
Modified system/core/run-as: Switch target application's permission but ignore debuggable flags, can access private files of applications.
Modified system/ca-certificates: Add charles (5f88ea7a.0) and burp (9a5ba575.0) root certificates to system.

SELinux policies

Modified system/sepolicy：Modified and added serveral SELinux policies.
- Allow app and system_server write unix socket to AppSandbox
- Set shell uid and label for com.wrlus.app.terminal
- Disable limitation of only allow com.android.shell package uses shell uid and label.
- Add property label for watched uid, and allow system_app read and write.

Build scripts

Modified build/soong/scripts/check_boot_jars：Add com.wrlus.app.sandbox.* to libcore package name allowlist.
Modified build/target/product：Add Terminal and libvterm to build targets.

FrontEnd

AppSandbox-FrontEnd application can receive data from system and save, see also: https://github.com/wrlu/AppSandbox-FrontEnd

TODO List

Custom platform key.
Import LSPosed.
Import frida-gadget.

Credits

Fork from AppSandbox-Framework project, keep useful features and delete unstable features.